hxxps://ruangdigital190-create[.]github[.]io/RuangDigita190V2

Analysis

user interaction
yes
max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/11/2026, 14:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://ruangdigital190-create.github.io/RuangDigita190V2
Sample261102-rvxpracy4n

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5092	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-524788801-3318743092-4051225893-1000\{4ED6E5D7-9530-423A-961D-2B6199ACC7ED}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
368	msedge.exe
368	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe
684	msedge.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 684 wrote to memory of 3664	684	msedge.exe	85
PID 684 wrote to memory of 5092	684	msedge.exe	86
PID 684 wrote to memory of 2408	684	msedge.exe	87
PID 684 wrote to memory of 2408	684	msedge.exe	87
PID 684 wrote to memory of 2408	684	msedge.exe	87
PID 684 wrote to memory of 816	684	msedge.exe	88
PID 684 wrote to memory of 816	684	msedge.exe	88
PID 684 wrote to memory of 3792	684	msedge.exe	89
PID 684 wrote to memory of 5080	684	msedge.exe	90
PID 684 wrote to memory of 3792	684	msedge.exe	89
PID 684 wrote to memory of 3792	684	msedge.exe	89
PID 684 wrote to memory of 5080	684	msedge.exe	90
PID 684 wrote to memory of 5080	684	msedge.exe	90
PID 684 wrote to memory of 4492	684	msedge.exe	92
PID 684 wrote to memory of 4492	684	msedge.exe	92
PID 684 wrote to memory of 4492	684	msedge.exe	92
PID 684 wrote to memory of 3208	684	msedge.exe	93
PID 684 wrote to memory of 3208	684	msedge.exe	93
PID 684 wrote to memory of 3208	684	msedge.exe	93
PID 684 wrote to memory of 1852	684	msedge.exe	97
PID 684 wrote to memory of 1852	684	msedge.exe	97
PID 684 wrote to memory of 3080	684	msedge.exe	98
PID 684 wrote to memory of 3080	684	msedge.exe	98
PID 684 wrote to memory of 4516	684	msedge.exe	102
PID 684 wrote to memory of 3240	684	msedge.exe	110
PID 684 wrote to memory of 3240	684	msedge.exe	110
PID 684 wrote to memory of 3240	684	msedge.exe	110
PID 684 wrote to memory of 2560	684	msedge.exe	111
PID 684 wrote to memory of 2560	684	msedge.exe	111
PID 684 wrote to memory of 2560	684	msedge.exe	111
PID 684 wrote to memory of 760	684	msedge.exe	112
PID 684 wrote to memory of 760	684	msedge.exe	112
PID 684 wrote to memory of 760	684	msedge.exe	112
PID 684 wrote to memory of 4236	684	msedge.exe	114
PID 684 wrote to memory of 4236	684	msedge.exe	114
PID 684 wrote to memory of 4236	684	msedge.exe	114
PID 684 wrote to memory of 4496	684	msedge.exe	116
PID 684 wrote to memory of 4352	684	msedge.exe	117
PID 684 wrote to memory of 4108	684	msedge.exe	118
PID 684 wrote to memory of 2092	684	msedge.exe	119
PID 684 wrote to memory of 2092	684	msedge.exe	119
PID 684 wrote to memory of 2092	684	msedge.exe	119
PID 684 wrote to memory of 1760	684	msedge.exe	120
PID 684 wrote to memory of 1760	684	msedge.exe	120
PID 684 wrote to memory of 1760	684	msedge.exe	120
PID 684 wrote to memory of 4528	684	msedge.exe	122
PID 684 wrote to memory of 4528	684	msedge.exe	122
PID 684 wrote to memory of 368	684	msedge.exe	124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://ruangdigital190-create.github.io/RuangDigita190V2
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ff894dec188,0x7ff894dec194,0x7ff894dec1a0
  2⤵
  PID:3664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1848,i,12744817269250726981,93369912808237420,524288 --field-trial-handle=2216,i,5908218475566538884,16116933949633518997,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,2173530850965854793,2784927703193782805,262144 --field-trial-handle=2216,i,5908218475566538884,16116933949633518997,262144 --variations-seed-version --mojo-platform-channel-handle=2212 /prefetch:2
  2⤵
  PID:2408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2532,i,6394752083562978318,12664855986823016563,524288 --field-trial-handle=2216,i,5908218475566538884,16116933949633518997,262144 --variations-seed-version --mojo-platform-channel-handle=2676 /prefetch:8
  2⤵
  PID:816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,2722325313099182588,10375052153041971102,2097152 --field-trial-handle=2216,i,5908218475566538884,16116933949633518997,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,11214014273789561365,6001849683268877539,2097152 --field-trial-handle=2216,i,5908218475566538884,16116933949633518997,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,14233575592289817216,8576968586602813205,2097152 --field-trial-handle=2216,i,5908218475566538884,16116933949633518997,262144 --variations-seed-version --mojo-platform-channel-handle=4592 /prefetch:1
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,11478873539670301515,17200928696114648606,2097152 --field-trial-handle=2216,i,5908218475566538884,16116933949633518997,262144 --variations-seed-version --mojo-platform-channel-handle=4596 /prefetch:2
  2⤵
  PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,1361670037420121784,18088724615053493410,524288 --field-trial-handle=2216,i,5908218475566538884,16116933949633518997,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:1852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,10607877239074671256,3420630569102216363,524288 --field-trial-handle=2216,i,5908218475566538884,16116933949633518997,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:3080
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,6482961779549059051,1267999126875700158,524288 --field-trial-handle=2216,i,5908218475566538884,16116933949633518997,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,6482961779549059051,1267999126875700158,524288 --field-trial-handle=2216,i,5908218475566538884,16116933949633518997,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5892,i,1340291700497715114,18435445726390272978,2097152 --field-trial-handle=2216,i,5908218475566538884,16116933949633518997,262144 --variations-seed-version --mojo-platform-channel-handle=4764 /prefetch:1
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6020,i,14384358591213341505,8154796689279978463,2097152 --field-trial-handle=2216,i,5908218475566538884,16116933949633518997,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:1
  2⤵
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3352,i,5591821025717527401,15952323661193445796,2097152 --field-trial-handle=2216,i,5908218475566538884,16116933949633518997,262144 --variations-seed-version --mojo-platform-channel-handle=4620 /prefetch:1
  2⤵
  PID:760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5684,i,637668978069893899,1854820339770770948,2097152 --field-trial-handle=2216,i,5908218475566538884,16116933949633518997,262144 --variations-seed-version --mojo-platform-channel-handle=6128 /prefetch:1
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6392,i,14055655542647152816,180658402439142298,524288 --field-trial-handle=2216,i,5908218475566538884,16116933949633518997,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:8
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4780,i,16574909636539724262,12919300565687747310,524288 --field-trial-handle=2216,i,5908218475566538884,16116933949633518997,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:8
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,1540818528333093809,17975660674004243229,524288 --field-trial-handle=2216,i,5908218475566538884,16116933949633518997,262144 --variations-seed-version --mojo-platform-channel-handle=6500 /prefetch:8
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6036,i,9170823858319135960,7527758868225750850,2097152 --field-trial-handle=2216,i,5908218475566538884,16116933949633518997,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:1
  2⤵
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6436,i,9232990593495826136,18431472992962966911,2097152 --field-trial-handle=2216,i,5908218475566538884,16116933949633518997,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:1
  2⤵
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5420,i,13707250047227563996,620540065555664209,524288 --field-trial-handle=2216,i,5908218475566538884,16116933949633518997,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:8
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5716,i,13025926293777213226,17348603390096335284,262144 --field-trial-handle=2216,i,5908218475566538884,16116933949633518997,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:368

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3356

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

08e578e7-a85c-46ff-b579-b441e335cc0a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\08e578e7-a85c-46ff-b579-b441e335cc0a.tmp
Size 18KB
SHA256 cce5f0e20952464e399a8e78d4411e9f3ab8ee3b03c314b080ccac9e10230a98
MD5 2c2017b96a65b14b75f6e6f8e654fe32
SHA1 95af924a2b209cc795c5ae8cfc6d9634269adf4a
SHA512 52b0f91d14a66ebb6d3006ae2f89584bdcd6d654309372b82c7c3f622ebe084b4d319b2b7137b975d0ceeee03ce29c3f5380af91cd8a8920f9e67399c43b297a
SSDEEP 384:zhmQkUSvPsNwAwV8Lfy4OjTVYudkG8+/Hw4H7vBE1oIIlD:tGPXQyLnhl/Hw4H75EGLx
TLSH
T118827D35A8783D7B0DE2A501E04B3603EFB4D167D9D52B90D9ED9B1C01DA6AC234BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

28d75adf-eef0-4fd0-9653-899a6c293eab.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\28d75adf-eef0-4fd0-9653-899a6c293eab.tmp
Size 26KB
SHA256 5be2279b8e316d00c64199293350f1889e37e4408bae65f381eb6a4a275aac39
MD5 e7bc09591e8864e41f930b79c8f2184a
SHA1 b3b4bc963cad92b7af2d507c920b013969c2061c
SHA512 85e842a5695b7b064ddcb87523870cc2b9c3463af3a2bda51f97e7212d323e37426c499e12de59586956f73fb7b1323f1e155e140325f9c382856f5876011f7d
SSDEEP 384:6hriFzQkUSvPksNw8TUNTUlIltwV8LtykOjTVYudkG8+//w4H7vBE1oIIlD:GGFd8Fwg0iyfnhl//w4H75EGLx
TLSH
T16DC218F258D7593AD9AE5703E77D2D039EBCC067F8956A90B7885A0CCC861BFD306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

35b6e4b7-abc4-4376-824b-7f110b087fa6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\35b6e4b7-abc4-4376-824b-7f110b087fa6.tmp
Size 8KB
SHA256 e565eb342dc14252dbacca339f5488383946357379ffa0b6a925b68ce3fb21a9
MD5 1da1fc0c02deea613db82933496e87b0
SHA1 5b616ae14fe7dc65cf2945a1feaf25495df3fe30
SHA512 a1fb1c0ff63fbc894204337f297321bc0235609a284f9c7a1cdd93e3bc2e28afddec61229cbbcf13a0e7e7a681df7f1cd4fb3bdf6fb798f36f6702c925a5cfca
SSDEEP 192:SONU6ygpQmiUyeptOCTVgvR+FdV6R0ozPw+GU6:SONU6lH5tOCTVYudkGSwNU6
TLSH
T1AE02D835AC783CBB8DF3AE06F48737139FD4116BEA912B94DAE81A0C009765C2346C36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5559d13f-e92f-416e-bea2-26f8a9a8459f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\5559d13f-e92f-416e-bea2-26f8a9a8459f.tmp
Size 18KB
SHA256 ce505265c12a5f9404d17f9a43daab3e6f0d97cb7ad1acd8f90da2f6f50d3a72
MD5 54a1bfb4d52d2b65b32c5559c170a850
SHA1 00eb9ccd90d9e9a4f43e29dfdef1afc339ec37d6
SHA512 ae73d1cee088ffe411777e56fa222c3385d529cd8b277fff29afafc1cc87080b5df22184e78aaceb1617c7f01512e9a3986787d1c00c22933f763de06c7bf995
SSDEEP 384:ChmQkUSvPsNwtwV8L1ykOjTVYudkG8+/Hw4H7vBE1oIIlD:eGPqmyfnhl/Hw4H75EGLx
TLSH
T1CE827D75A8783D7B0DE3A501E04B3603EFB4D167D9D92B90D9ED9B1C00DA6AC234BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c904cde2439d0f658b6928376273908e18874923ffb5ab0253d91ef97d247274
MD5 71592819d06ab9dfd94505cef3db0b85
SHA1 fa4c610ce7419e5f934db322abc11ec563259b9b
SHA512 f0dccb656458e10495c6728811a1fad970a69f8abb5ce8e9bcba9e93f496cd66fb3ce8ce1065b946203d7912789774c609787e85dd5139479b2562b6f05cfae0
TLSH
T16BD002F8BB950515C5C970F7713BDB8143B6EB218246265D64F21E082D747B23606895
MD5 SHA1 SHA512 TLSH

Submit Download

9f60cbee-970e-4b27-864c-fbd46569a33c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9f60cbee-970e-4b27-864c-fbd46569a33c.tmp
Size 11KB
SHA256 02274e8aa22fd16e513efef8c8ae25435277b55dce7173d1bd8522edfe79fae6
MD5 d50ab5e0907b6cd0c52a059dee9fd089
SHA1 6a94ae0f0678d34b92859e7e7dc09535cdc72266
SHA512 46a04e210eddfaafc0bc2e38f1061b82e08b9ae2574b9ccd254e36d6822883b15f6106ec41ee74b25cf2e0e5c16ca44e35c288bc47180564db8156a269ab64dc
SSDEEP 192:sxZ0RBWo/f9sSGXIdpwlCSHW6+WNJ2SZYRP8ZfXIg5mkcJ:sxZ0io/f9sSG4kHbtZmsDA
TLSH
T1F832C956AD38B97B9CCBD20DBE54BF53D6FA503291901E48AAFC961C04E76CE230740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000064

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000064
Size 51KB
SHA256 33017fa3edc7fe240f8ee81277d8c969af441c2dafbd27dd6eb6b73b855c28b5
MD5 0bde731503aaafb35b03e25dc51981c4
SHA1 4afc4acfc42fa4c93b0225f53628046072855a07
SHA512 4a791efcf957d20cf745a00ca6ff308688fb282f039468d78f5e964bc99ef0123e35c959fcd3df530a0e500e9ec14a60ee33c2c91468fa03f17a44ac87043f17
SSDEEP 768:qJbK34rl0VqCvZCJs+gbeZdyvbWP5M0W+5SKOVi7PbmmslvKpl2iHaZjAcPRmHUj:qYMl0EqCtTOTpHiSKOVi7PsGl2+cwHCX
TLSH
T1CF3302AA8C0C55FF964D3B777980231BDEB4445219A05378FFE09F1AD62A970364E08B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000065

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000065
Size 101KB
SHA256 ece964c0d79570154bde6c93e5dd4bcc0df3b9afdcfa705ef47e4acbfef58982
MD5 79d358db5eadd6167c73baf0e155c3a2
SHA1 48c40a3f4058f5247c8933926fc76165c69df097
SHA512 928d960fd44ca19bdca0303f9b86461a15148765b5418f7d80346e2a8f7159531051275fab21d78b62425a76c2aa7b29bc7f3aef187b065d349a46a1263d3d9b
SSDEEP 3072:fxXjoZAFAIVt0oHPjzmxY/bLsGWXnEm13G72m/Kvbl:5XKAFAINPjzmq3sGiP3G723
TLSH
T1CEA312CA92DA4277E24352F305A94D9F1E35B0B1C9B60B04E2AD8F31B93650B4D277E7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000066

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000066
Size 29KB
SHA256 4680e5eda638f154e321ae8bdb6bf582687ec0db413ef1fe1b77ac130cce9ae6
MD5 410c76ba8b7ca180aeed9a461e99764a
SHA1 a34a74558a488e8c09f139d38c6a02b768e915a7
SHA512 ed4207e0c150781a2154677feb7a6f43215119866ae8d79c33d9d4a7c17da640e97666b3c4c525f44a1d57adb6ba92c5788da0b9764d9cd079c85edd3af10ebd
SSDEEP 768:jLIXxwPcp0/12Y5QTjvlkKnOWNMtZVr8EQB2iKBmO3yPyAcV:jLIyEpC12bfvFnkF4KBBwWV
TLSH
T193D2C003238962D5D362EE9289582FA218D153E6EC6608D03550EBDB740CE5D8BD7AFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000067

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000067
Size 18KB
SHA256 b558dcf593bd2d76ca0deb1e88da74ff30bba0182fcdf329f5fac944071bd31a
MD5 32250cfe7da756147405b5447d3a8e07
SHA1 79cc302c34d512f8a272503babab42cf9dba7a44
SHA512 b6956eaa3e3a7bb794246c0614cee51a863a33251c63959f8115284382b66acdcb3fc1a9cdf811d6b9424ba834593e9fe88fd2e5e17236e801c060263e07e0bc
SSDEEP 384:2aJptluRvCeRcYxOKPJhZyQHAtiSDhF1my0VGbaGWnhsnuB4Pv1f:2aJCCeRcCOYPHAIwF1wsbaGW9Bix
TLSH
T14382D1AFDF0DC0221340B6E48EC473F504CA6456B628FD542696BD2A0AC17BDDE616FD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000068

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000068
Size 85KB
SHA256 d03d0f2dc347a2c1e0ba5bf1912794595efa0f6a55561dbb4ca92c87590af8b9
MD5 03ae9967c42f8510ad98f19aa323cc63
SHA1 e9ad744bf65cec701b34c9b753635c656e855015
SHA512 fd80032ce7c0b8c5e44feaf3b39de05c0e03f90836e738cda6ccfa8bc99190ea45b5d5edaed249f27a1a887efa1e81c889318bead092804c01a4ef1e0f64b0d0
SSDEEP 1536:F0X4vS/CIrRQN5gnoEtma+YHJ4Bl5nm9Np4TUOMxzOjJDqGp+:ap/CI+N2NQo94T9MIqy+
TLSH
T1C48302FE351D4BA5F95A4E944BC729A83DE90641E02DBC1308B98ED3E040AF5B670F76
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000069

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000069
Size 26KB
SHA256 fe9acdf50a4842655eb008db2ce35d265e728610e7f9047a9f36bd97b192476f
MD5 3f5521299a5d375d8562e69d2815b721
SHA1 39c728a84cba3e8c1b9fa3bd6099d96bed1bb08a
SHA512 d728e437400709485253bd520bd560c90ca5ce4c4618d17ab5882ca601636c72a812320c7f913d11e0b76d7fa343d26aa6a37366bfa44bb268a0a2ce4e9c62a0
SSDEEP 768:yGLEOwJb9lE9Du+7iNSux3c6BvPIILSfa71qBz:ytOF9Du+7UT3biILJcV
TLSH
T11EC2E020BDC295C625E7804E552DDBAB49D81DFCD8C3CF61539ED38940762B5AC0EB8D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006a
Size 44KB
SHA256 1beb99d02218041ecf50d7949fbdf33dc814d6cb80d143a22307f76ef199bd06
MD5 ed00d6b901072996628f0a3d86922a0f
SHA1 6c80307fb6bd3140b7127b717ce46cadad4572c1
SHA512 e02b77ca1d754f257d0075550dba12a43261d991edf0e50305e407fd9fae1b2557eb598a3b1cb4ab8351bbeb2d65fbeb1fdd5c4f6be924b42b80a70b9293dc59
SSDEEP 768:oXJDGnyRK2hU+ytA5W1yempyzlKRRYpCkgNF8wGdFHAYPiMnQwYolcanmaw:4h1RK2mt6W1xmpiURRYpwj81gY6ZwZlA
TLSH
T1BB23F25D8709947F22637C231E641EB35DE1B5CA795230AE936FA3E8C5C3382649A28D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006b
Size 272KB
SHA256 efa03118ef390ec23a0b40f57567d210aaa3ead96ed1402a65cc0e65c0a24a09
MD5 df9b7597885b340546c4924123e20171
SHA1 2556909adc597950b69ebb15874eb3bda57b9271
SHA512 36248a97550e8b876e244cc836efd28617df035e88d6024fcbaba72796c5da81bbc97c360fd46e742a875a07a336d103de03d467ad6d7d4751afaf2a617aa6b3
SSDEEP 6144:Cx6OrfSabWoqQ4F1eICt1W9u1LXC5txhMAgFFCnMYS:Gnr60WPQ4FUIg1mgLXcfHgzCnMF
TLSH
T1E854236D55A1CF9CBDF220421A9C60C0F80EB763CD37D2F4BB6D221CA5C53A6E583692
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 1900a2807e2fd654ad4a3632f1bcaa39dd4e98c65b8bf1b5690c1e9d39855a98
MD5 b3edb43c6689b857e61a6402f60257a4
SHA1 562936bf852528e88e459888a86cece7731bcde3
SHA512 71e93eb149f883ea84504b0a0b2b61bdb7e827c7e80246b6076ac52c0a056cb96cf0e1cff07a304d244aeacbc58f56c7c72554f5277d7eb667e28fabc57744f5
TLSH
T1CD71BA42A753539DF7BBB13181D519CF3A32448A454B1F2AC2D8D1B4B89F794AB1806F
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 80c01c616a9595e5de9a220317328a1d8af54b08e368135b7c129509c5115ca9
MD5 8c318e81873f8727a199c59d4fbca6c9
SHA1 5189aeb132ecf53940dc537bf114731f7e2541aa
SHA512 92c1da87b0ab7776d9ada58eddbb07728db454696eaf99131863d347e88ba69d0c66ad5a1204d2772fa52ce7aa95596cb21c4d61ca679dc18b61e4cb954bc57f
TLSH
T1015174429B5343ADF7BB603281D519CF3A35454A594B6F2AC1E4C278B49F714A71806F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a9fa6fed74f17338e3f3f254cf186db513ccd5c4bb103a8feb1c3cefe3efb745
MD5 deb74c22848aae3d4b854c9fadd1439f
SHA1 acef97f5d844cfdcd63475972a91d4647bf77ae2
SHA512 6f5df38d6930492d86b00c95cfb58e13e65c199bf61f454706604cef1c0bfe80a5b2354969c1aa5efb03983ab0909b9fe1f851de310b65dede3182ce6ce2f61e
TLSH
T1E65174429B5343ADF7BB603281D519CF3A35454A584B5F2AC1E8C278B89F714A71C06F
MD5 SHA1 SHA512 TLSH

Submit Download

642c62e0-54d0-4a64-8971-4f590ea9f436.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\642c62e0-54d0-4a64-8971-4f590ea9f436.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

4a3e2ed8-82ab-4531-9a75-f1d5dee23deb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\4a3e2ed8-82ab-4531-9a75-f1d5dee23deb.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

644cbe67-0ce9-4179-8b44-92be3fb14174.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\644cbe67-0ce9-4179-8b44-92be3fb14174.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

935b3289-f7a7-4c2e-941b-25e46d854072.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\935b3289-f7a7-4c2e-941b-25e46d854072.tmp
Size 5KB
SHA256 e85cebde48b2423478407fa60e3aea400d3625769a9a089b43d4cbd972a12cdd
MD5 5f660b3adb02a34a5e827a6057617092
SHA1 0e46ccbc9afc969dc662ace6f6a243c626ab1a54
SHA512 b8b93a489d3c482ed7ad48bb46e04ae21d487bf548395ab3b7fa26b504ec1e57eb92de3e949b81573598f2ad1306b772faee0861f781d622042cc837dd4d96dc
SSDEEP 96:DJOj42j4AqOgNVzbSj4uj4Jj47j49j4Dj4gj45MCj4JBj4NNBL1BCwNS8:DMj42j4fOgNVSj4uj4Jj47j49j4Dj4gy
TLSH
T136B1B0F6C3F4863EDD1216F45B19791BCE19091A82683D5AC8D4BF5BB3E2471E340A8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 0ff4bdd8766ee4e7d1fea16db478b0eac699145e80c11813512f59acd33d59ae
MD5 37dd5d44cbfa851a34d6047f97bc583f
SHA1 3a634506692cc9ded86cff352fda1fee386b3a1f
SHA512 c1c1743b55de5e71489da001229c32da20e0d5e0ded048340647c5df5fc98b54f9651ebd00e544dbe3c7eb1e910c3aed9150dc133c5d4694732d6832083265c7
SSDEEP 48:K0mIm10JF3jXYbLuLISdYK991vYxdIY+vF1yLmBcAeEE9bI/wISY9K981+9xWtYV:K0mpukKLCm2JiKSMVJmKq8l
TLSH
T19A91E09231BB175079BE295C40B4865B128132B33559EF2BBFBC4462CE6BE444CFE4DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c2de1351-6b37-4dbd-b534-54ba3a50a926.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c2de1351-6b37-4dbd-b534-54ba3a50a926.tmp
Size 10KB
SHA256 3f30f782727298d1768fdb088e52c409a0733b97771211c9e4680e7ba9487f95
MD5 73fea23fc31a6205810c95f8e98695f1
SHA1 dc0ae397d062d778f0a993cf2df59a945e435d33
SHA512 54ec284b6a321ab2b27c907df14276cc76fe84710cd222b29d7807398273c31bc33aec99ef6f002a0be04790790ae6a8cb5bed507a5a5ca7de55fc6253cbbe2d
SSDEEP 192:sxZ0RBWo/f9sSGXIdpelCSHW6+WNJ2SZYRPs6bXIg5mkcJ:sxZ0io/f9sSG4WHbtZmZDA
TLSH
T10632C856AD38B97B9CCBD209BE55BF53E6FA503251901E48EAFC961C04E66CE230740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d322f173-03c4-44e0-891a-80656ff4cbb6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d322f173-03c4-44e0-891a-80656ff4cbb6.tmp
Size 10KB
SHA256 5503e8aa571c09b2acae8dd26bd1e7f109ed88d769998b284a94ffc7d74f4616
MD5 1db8c7a7463e9c32c8691aa0226cc074
SHA1 45ba2477ddc28eaa2fb622ad701060804a8fab02
SHA512 6da57fd603bf8adfd98e8cf26bd3c4052179ec85eaaf061badb9cf1a4db7e37253f124981801a3d4d59c446c36e85cdaeb99e3c1a94da44e2d4b2c0e9d6929b7
SSDEEP 192:sxZ0RBWo/f9sv/KIdpelbHW6+WNJEV/YRPR2bXIg/kcJ:sxZ0io/f9sv/DUHbW/masA
TLSH
T1DB22C7566E38B97B8CCBD20ABE55BF53D6FA503291D41E48EAFC961C04E66CD230740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d551d5dd-2cf9-4b72-8fe3-2286dcde64b4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d551d5dd-2cf9-4b72-8fe3-2286dcde64b4.tmp
Size 10KB
SHA256 4e2a62b68e824112b0b385244f48d0272c517d22aa6ceb5cf17aae9640bbe0bb
MD5 510b249ff04d0a66c038a2b92982fba7
SHA1 7ff551fa7cae746fcdb35a084a26f0632728dee0
SHA512 91b612cdb4085f9411ed2026341044c585f4d3e1986d9f479b78a657aa05b448bbfe381f9d07da4eac7108fde7a6ac6bfb8153e25488f4d89244687a04d98333
SSDEEP 192:sxZ0RBWo/f9sS/KIdpelbHW6+WNJ9iXYRPo2bXIg5AkcJ:sxZ0io/f9sS/DUHbKXmbxA
TLSH
T1F522C856AE38B97B8CCBD20ABE55BF53D6FA503191D01E88EAFC961C04E66CD134740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d5daa1a4-254f-422b-a496-ef4dc4beba4d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d5daa1a4-254f-422b-a496-ef4dc4beba4d.tmp
Size 27KB
SHA256 1a622d901cef5f14ff7fddc466f269f0582953c77d3680414fd4b62d1ac5dff6
MD5 f6e138bbdb12750ee23e45da079a9798
SHA1 791b6d1eaa79e2d3ca797db09a33f0f50e6152c8
SHA512 fc1c29ebba6b2f7ab5d0b54efe11f9d4e6f9e2f3fe379ae8f22c5417114f9b5db416a45daa30b879f891c22ca1ca5c07cbb4dca878789451eb1758eebc0d7ea2
SSDEEP 768:8CK9uzYWvcQWs8F1+UoAYDCx9Tuqh0VfUC9xbog/OVpHLlh7k3xroe+pyy:8CK9uzYWvcQWsu1ja0HL7Q3Ke+pt
TLSH
T1E5C2093F640CCB7E5FC01A9DDC5A6F973E9802D7A6588D4047FA984C02C77EA52264DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d987b8e8-b5d8-46b4-8623-8353230f6b8b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\d987b8e8-b5d8-46b4-8623-8353230f6b8b.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f4c4cc92-14a5-4d21-91cf-2d16309e3eb6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f4c4cc92-14a5-4d21-91cf-2d16309e3eb6.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

88c660be-8596-4c53-b9f4-f22a542ec9aa.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\88c660be-8596-4c53-b9f4-f22a542ec9aa.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

d4d8e377-d6fa-4faf-b660-11eeeb074cd2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d4d8e377-d6fa-4faf-b660-11eeeb074cd2.tmp
Size 8KB
SHA256 77713972c8f3d21e5f9bd7b45d5db14a1a5d2fad634499d6426fb83165c5bc33
MD5 e12c7eaca3bc661e6a500375dbc94cfc
SHA1 07ba1e8e7aea10220f824508e21821bfc10b02c3
SHA512 4310b8e2ab04606cc78906b288e8ef186279e7449cfcb0da102c00b2f5e8d3655902b47ca5881c6cd1468aa4e5a3463f44b30456c7d9907a072e1248234e0b36
SSDEEP 192:nONB6ycQmiUy4pBOCTVgvR+FdV6R08dM/J3UwVqFU6:nONB6TFBOCTVYudkG8+/Kw4U6
TLSH
T10712F835A8787C7B5DD2B501E48736039FA891A7EE867B90D5EC1F1C01DFA6C234AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4703dd9c-8b0d-4cfc-8c49-52533b2cbc49.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\4703dd9c-8b0d-4cfc-8c49-52533b2cbc49.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 e3685aa4d6188139c41d02cf3acd871da7b8e50d31a76bd3532abc6e59b672d7
MD5 dcef1c5c8b07de324a763bbf1a95fdff
SHA1 b49ed0f29f7f04d4bef6f1dc3c38d14b99008c01
SHA512 72306c0e4ba186a48bf745b76e1a6cddb015cd9ff8d7d1e58b4c3393f034cdf223bdaca4bea5c0a2a442946d81929a11b12f4179735437aad79759b9452c229c
TLSH
T15D411858B6E91158B3B77E1AABF7A86D487F7C772F0AD45D10110D4E0A22B00C862773
MD5 SHA1 SHA512 TLSH

Submit Download