hxxp://url6074[.]mail[.]punchbowl[.]com/ls/click?upn=u001[.]AtwwX7QPmwRRLf5609viEu2zqxOjjeTPx-2B-2BnFp9dtQ81YoZw-2BhTFmaZqpG-2Fy-2FlgpEazz8f0O0AAC6x-2F7f6AQtpPr2tmHMAbqpV5in7C7SS557d2LWtFIN-2BE4-2FFWJ1FOkmteYmObPDUExXpl7adZEQmgbNvsyWbWu4ofvYo2RNnAdujqH5EFK9g-2Fm8mc0eWC8h5D-_wm1y8XOvKOJUJScRQ3Bpd67ho-2FWwVZo-2FhEvz0-2BCfIor-2F-2FM6Vq2QwXhPPsjUanLHPsw0ASDvzcpeGE8w-2FewoI-2FADlI-2BoE3sZGyRNYFjQHyp0poeOaGHG2r-2Fwac83qD3i2Xj0XgvB7ncDsgxf6oNJgLzU52BX44hs9c2y5q0WO6adUsR7e0-2FELcpC47Qu0sZO71cYQqMnb-2B6xD1uhtGQT50a0bWbz9JL4fcg2ET5TTvZPNfD4b0bCBYLuLR7gx5qH6d304yCHuVZfSXqzjqbhnU-2BtiMygIdRI9SfHXa7zhbOpCvdaRjU3Ay-2Fgacj6LWBMCxKqMzh44GlQ8tQTTFVF-2BmQToPaohGnDQTiLpQvJ6-2BaOYheng8UkX4LbX5mwGSv02ukI1wONyGgYvZBJBLWyMAFPscgFJfa5IWgeA7ozt-2FYKAKKkg14TpIuRE5X3TZE9qLwe2T-2Fsk0Bf5ONG2dGLMVaaeF-2FcYZfiMLcWtRMyvTzY-3D

Analysis

user interaction
yes
max time kernel
209s
max time network
206s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/11/2026, 16:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://url6074.mail.punchbowl.com/ls/click?upn=u001.AtwwX7QPmwRRLf5609viEu2zqxOjjeTPx-2B-2BnFp9dtQ81YoZw-2BhTFmaZqpG-2Fy-2FlgpEazz8f0O0AAC6x-2F7f6AQtpPr2tmHMAbqpV5in7C7SS557d2LWtFIN-2BE4-2FFWJ1FOkmteYmObPDUExXpl7adZEQmgbNvsyWbWu4ofvYo2RNnAdujqH5EFK9g-2Fm8mc0eWC8h5D-_wm1y8XOvKOJUJScRQ3Bpd67ho-2FWwVZo-2FhEvz0-2BCfIor-2F-2FM6Vq2QwXhPPsjUanLHPsw0ASDvzcpeGE8w-2FewoI-2FADlI-2BoE3sZGyRNYFjQHyp0poeOaGHG2r-2Fwac83qD3i2Xj0XgvB7ncDsgxf6oNJgLzU52BX44hs9c2y5q0WO6adUsR7e0-2FELcpC47Qu0sZO71cYQqMnb-2B6xD1uhtGQT50a0bWbz9JL4fcg2ET5TTvZPNfD4b0bCBYLuLR7gx5qH6d304yCHuVZfSXqzjqbhnU-2BtiMygIdRI9SfHXa7zhbOpCvdaRjU3Ay-2Fgacj6LWBMCxKqMzh44GlQ8tQTTFVF-2BmQToPaohGnDQTiLpQvJ6-2BaOYheng8UkX4LbX5mwGSv02ukI1wONyGgYvZBJBLWyMAFPscgFJfa5IWgeA7ozt-2FYKAKKkg14TpIuRE5X3TZE9qLwe2T-2Fsk0Bf5ONG2dGLMVaaeF-2FcYZfiMLcWtRMyvTzY-3D
Sample261102-t6epesdx3n

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
956	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-895009113-1202185046-1686627690-1000\{202CB1F4-0CE0-4847-BAD6-2E18240380D6}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-895009113-1202185046-1686627690-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4592	msedge.exe
4592	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe
1540	msedge.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 1540 wrote to memory of 1240	1540	msedge.exe	84
PID 1540 wrote to memory of 956	1540	msedge.exe	85
PID 1540 wrote to memory of 3196	1540	msedge.exe	86
PID 1540 wrote to memory of 3196	1540	msedge.exe	86
PID 1540 wrote to memory of 3196	1540	msedge.exe	86
PID 1540 wrote to memory of 1232	1540	msedge.exe	87
PID 1540 wrote to memory of 1232	1540	msedge.exe	87
PID 1540 wrote to memory of 4876	1540	msedge.exe	88
PID 1540 wrote to memory of 4876	1540	msedge.exe	88
PID 1540 wrote to memory of 4876	1540	msedge.exe	88
PID 1540 wrote to memory of 4580	1540	msedge.exe	89
PID 1540 wrote to memory of 4580	1540	msedge.exe	89
PID 1540 wrote to memory of 4580	1540	msedge.exe	89
PID 1540 wrote to memory of 1324	1540	msedge.exe	91
PID 1540 wrote to memory of 1488	1540	msedge.exe	92
PID 1540 wrote to memory of 1324	1540	msedge.exe	91
PID 1540 wrote to memory of 1324	1540	msedge.exe	91
PID 1540 wrote to memory of 1488	1540	msedge.exe	92
PID 1540 wrote to memory of 1488	1540	msedge.exe	92
PID 1540 wrote to memory of 3172	1540	msedge.exe	95
PID 1540 wrote to memory of 3172	1540	msedge.exe	95
PID 1540 wrote to memory of 3172	1540	msedge.exe	95
PID 1540 wrote to memory of 4828	1540	msedge.exe	101
PID 1540 wrote to memory of 1340	1540	msedge.exe	102
PID 1540 wrote to memory of 4828	1540	msedge.exe	101
PID 1540 wrote to memory of 1340	1540	msedge.exe	102
PID 1540 wrote to memory of 4684	1540	msedge.exe	105
PID 1540 wrote to memory of 2824	1540	msedge.exe	110
PID 1540 wrote to memory of 4980	1540	msedge.exe	111
PID 1540 wrote to memory of 4548	1540	msedge.exe	112
PID 1540 wrote to memory of 2548	1540	msedge.exe	114
PID 1540 wrote to memory of 2548	1540	msedge.exe	114
PID 1540 wrote to memory of 2452	1540	msedge.exe	115
PID 1540 wrote to memory of 2452	1540	msedge.exe	115
PID 1540 wrote to memory of 1304	1540	msedge.exe	116
PID 1540 wrote to memory of 1304	1540	msedge.exe	116
PID 1540 wrote to memory of 4592	1540	msedge.exe	117
PID 1540 wrote to memory of 2996	1540	msedge.exe	118
PID 1540 wrote to memory of 2996	1540	msedge.exe	118
PID 1540 wrote to memory of 3836	1540	msedge.exe	119
PID 1540 wrote to memory of 3836	1540	msedge.exe	119
PID 1540 wrote to memory of 5104	1540	msedge.exe	120
PID 1540 wrote to memory of 5104	1540	msedge.exe	120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://url6074.mail.punchbowl.com/ls/click?upn=u001.AtwwX7QPmwRRLf5609viEu2zqxOjjeTPx-2B-2BnFp9dtQ81YoZw-2BhTFmaZqpG-2Fy-2FlgpEazz8f0O0AAC6x-2F7f6AQtpPr2tmHMAbqpV5in7C7SS557d2LWtFIN-2BE4-2FFWJ1FOkmteYmObPDUExXpl7adZEQmgbNvsyWbWu4ofvYo2RNnAdujqH5EFK9g-2Fm8mc0eWC8h5D-_wm1y8XOvKOJUJScRQ3Bpd67ho-2FWwVZo-2FhEvz0-2BCfIor-2F-2FM6Vq2QwXhPPsjUanLHPsw0ASDvzcpeGE8w-2FewoI-2FADlI-2BoE3sZGyRNYFjQHyp0poeOaGHG2r-2Fwac83qD3i2Xj0XgvB7ncDsgxf6oNJgLzU52BX44hs9c2y5q0WO6adUsR7e0-2FELcpC47Qu0sZO71cYQqMnb-2B6xD1uhtGQT50a0bWbz9JL4fcg2ET5TTvZPNfD4b0bCBYLuLR7gx5qH6d304yCHuVZfSXqzjqbhnU-2BtiMygIdRI9SfHXa7zhbOpCvdaRjU3Ay-2Fgacj6LWBMCxKqMzh44GlQ8tQTTFVF-2BmQToPaohGnDQTiLpQvJ6-2BaOYheng8UkX4LbX5mwGSv02ukI1wONyGgYvZBJBLWyMAFPscgFJfa5IWgeA7ozt-2FYKAKKkg14TpIuRE5X3TZE9qLwe2T-2Fsk0Bf5ONG2dGLMVaaeF-2FcYZfiMLcWtRMyvTzY-3D
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ff83016c188,0x7ff83016c194,0x7ff83016c1a0
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,16556605237494759922,6255661257351864605,524288 --field-trial-handle=2304,i,7025294583189791045,16689074944835439597,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:3
  2⤵
  - System Time Discovery
  PID:956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1664,i,3145089606687712579,10350041778791722915,262144 --field-trial-handle=2304,i,7025294583189791045,16689074944835439597,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:2
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2628,i,15303641194524804586,16995037751628748645,524288 --field-trial-handle=2304,i,7025294583189791045,16689074944835439597,262144 --variations-seed-version --mojo-platform-channel-handle=2764 /prefetch:8
  2⤵
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,10365111978254626309,11683371112015075749,2097152 --field-trial-handle=2304,i,7025294583189791045,16689074944835439597,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,12609703628460852168,9946954100515953864,2097152 --field-trial-handle=2304,i,7025294583189791045,16689074944835439597,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4184,i,17729615761787674752,17154633740080779404,2097152 --field-trial-handle=2304,i,7025294583189791045,16689074944835439597,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:1
  2⤵
  PID:1324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4236,i,12844207950954576658,10031486615687098144,2097152 --field-trial-handle=2304,i,7025294583189791045,16689074944835439597,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:2
  2⤵
  PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3648,i,15094856386086956590,6757503387015864303,2097152 --field-trial-handle=2304,i,7025294583189791045,16689074944835439597,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3520,i,1900225865499645997,6522475911042469352,524288 --field-trial-handle=2304,i,7025294583189791045,16689074944835439597,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:8
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5032,i,3968505897193868214,8496542541228307647,524288 --field-trial-handle=2304,i,7025294583189791045,16689074944835439597,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:8
  2⤵
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4496,i,6116091495216638752,3626990649140963108,524288 --field-trial-handle=2304,i,7025294583189791045,16689074944835439597,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4496,i,6116091495216638752,3626990649140963108,524288 --field-trial-handle=2304,i,7025294583189791045,16689074944835439597,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4220,i,12994451938683291335,6989001370039601658,524288 --field-trial-handle=2304,i,7025294583189791045,16689074944835439597,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:8
  2⤵
  PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3444,i,3760237454644087050,12310100213541165473,524288 --field-trial-handle=2304,i,7025294583189791045,16689074944835439597,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:8
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4588,i,1250315284596797961,2877068669357507157,524288 --field-trial-handle=2304,i,7025294583189791045,16689074944835439597,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:8
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2956,i,17910953013208285727,4380987640317550368,524288 --field-trial-handle=2304,i,7025294583189791045,16689074944835439597,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:8
  2⤵
  PID:2548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,8115516205227397837,7864615215876367133,524288 --field-trial-handle=2304,i,7025294583189791045,16689074944835439597,262144 --variations-seed-version --mojo-platform-channel-handle=6480 /prefetch:8
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6568,i,14547121539845375368,3515313084030765553,524288 --field-trial-handle=2304,i,7025294583189791045,16689074944835439597,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:8
  2⤵
  PID:1304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6204,i,9510927086399723048,9907365328457796687,262144 --field-trial-handle=2304,i,7025294583189791045,16689074944835439597,262144 --variations-seed-version --mojo-platform-channel-handle=6816 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3524,i,17851706005020814258,14403436723702369831,524288 --field-trial-handle=2304,i,7025294583189791045,16689074944835439597,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:8
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1360,i,12570223163166074761,15030946321538379507,524288 --field-trial-handle=2304,i,7025294583189791045,16689074944835439597,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:8
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6860,i,5147179080168517840,14823036114207826943,524288 --field-trial-handle=2304,i,7025294583189791045,16689074944835439597,262144 --variations-seed-version --mojo-platform-channel-handle=5588 /prefetch:8
  2⤵
  PID:5104

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2352

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

30e3f8fd-3ec9-4a4e-b5b6-4a7a85374b0e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\30e3f8fd-3ec9-4a4e-b5b6-4a7a85374b0e.tmp
Size 8KB
SHA256 3c832f44f726460aa8471222a5ca3427e4af5a5b2ae2f6db11e13f74889cb224
MD5 147c8e96de1b15279d5142b619c158af
SHA1 255f1409c3ad2e80479b2e301d04e9de67498adb
SHA512 d615f8e28bba76d6295a44d3f142c08730f11364df2d89a920c8b49d7041fea2bd3fb89360a2665374800f4f1cd13cda822630d11622af421de5dc54670ca8fc
SSDEEP 192:9ONH6JUwQmiUy0ywo//OywtvC7OezfMNxdquU6:9ONH6+wmwo//at67gnU6
TLSH
T1AB121935B864BC7B5DD3A5A5F04336279E644167EB856F80DADD2B1C02EF09C530BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6497b531-bb4a-47d2-8089-6d7455eadb3e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6497b531-bb4a-47d2-8089-6d7455eadb3e.tmp
Size 392B
SHA256 a02275711d6a488093c8e99e665db706ec36e13c567c2fdac65bd86daca1991c
MD5 01e137009a38e4d802298cd6ef80e78a
SHA1 925d3b7f1ec42bdaf9e8aca3bd1fd769c1652ba2
SHA512 11a23744449e3cb84658179f2674aa8b5a8ffce486e52a4f588286c98fa558ace0ada82bece4dd2dadf129ae5c9e2e19f1963959212968723b411c89d78183fb
MD5 SHA1 SHA512

Submit Download

677a6502-7daf-4898-8999-925d76d89834.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\677a6502-7daf-4898-8999-925d76d89834.tmp
Size 26KB
SHA256 3c5da3b537511a38b18f7f7c9adb1af21a28bb39d8e9dea3c4907832cb656361
MD5 398b79c9d5b74149071c9413213470fa
SHA1 d0e54c3555e08b0e1ecb9ee694e40680250ee03b
SHA512 606c3ea07d18a91581ec0f16dced91829afb3fc0ae7904cb8b793a122b4d508413d10ed0aaa19a8aa1a0d0c8ee90fe84f2dd04e8477abbc5232bf02893ae0fd1
SSDEEP 384:+iFzQkUSvtzsNW8TUNTUlIlaIbObxwh//at67vnH7vBENuIIlT:VFdVTwgqM/znH75EwL5
TLSH
T1B6C227F258D7983AD9AE9B13A33D3D139E7CC067B4845A40F7899A1CCC960BFD306810
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9e30f685-fd19-40c8-823d-010d0bf7308a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9e30f685-fd19-40c8-823d-010d0bf7308a.tmp
Size 18KB
SHA256 695643693c2e92bf446557a46853f498310bd488b9e340c0b80de1832db88834
MD5 02231d2602f2930c2a21ec024f3bc728
SHA1 976160dce36a6988cd14853e5b81d8a0cf907efe
SHA512 c80e23f77e651613df2d27c4ea8615e74980a9cf26649cd77d5e0a3a88e533a3ec06d4cf2b47a9b935cd152c482722bc3027e21d9d08a40bbbdd29cbd81ac3cb
SSDEEP 384:kQkUSv0sNWnIbObNwh//at67HnH7vBENuIIlT:U0JM/bnH75EwL5
TLSH
T1A7828E71B878AC3B0EE3A661F0073617EE749067D6D91F50DADEAB2C01DA1D8234BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 928eda824fe964cd23927cf06086d7d24e20a3a5092daf1acee5b632c76c962a
MD5 4ac43ee6512ba8635b7ba6bd015c291b
SHA1 5f9e2474b00ec0e2a9472c049fbea550e26309aa
SHA512 e5ebf9e92458f66e31e080121135313e828b8ebade0bc0e085221ae0d4f5afe0d2035c566590cbfb5902d96f17befe7b24310b4fb9e647b999113175af800ebc
TLSH
T17BD022B2B3A038CFE300083302A083BA2C0A80F300FAE2208C30E08C0BCC02AC283880
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 93c2ca3ce74eca17f27aa90cc3323bb8d6aea5c365862a01a512ce14b9f825b4
MD5 e8a3239e6b22580d77fb537c7bea1fab
SHA1 a99ffe9234c27e560f1c607d3b6c6507928368a3
SHA512 17b0e6f99943a02540148a685b91c62eafca3ef65d9a628bfb59d3b69a93b27c7d3ac42bdc808c52b5b1eac9bf4466a1099df17cd3f5df0bbd5b5282ca8b904e
TLSH
T170D0247133D03CCFD7000433015043751C0540F300F5D3104C30D04C07CD055C143440
MD5 SHA1 SHA512 TLSH

Submit Download

0c04360c-24d0-4a93-8962-e70969e7626d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0c04360c-24d0-4a93-8962-e70969e7626d.tmp
Size 10KB
SHA256 f25f9c56d5b99ed4bcede54aa93969b093b1c568a5c3cb888a464af1db845540
MD5 e7bbc282d6c0638fe675270152f773b9
SHA1 d09df1451a7a311159103a63a4d568b04c931dde
SHA512 f542e0baa5ed548aa4ffbbf501b7c28299e96b3be1f5e3e67cbc11214bc522495a0500b477a908cae352cfbff4ea11780b8967295b89558b117bd86fc79641d5
SSDEEP 192:sxZGRFWx/fcsxnIdpSwHW6+WNaJ29Y36Z8n/Ig5jJ:sxZGax/fcsxovHb19XqP
TLSH
T16A22B7526D28A93B8CCBD20DBA65BF57E6F9503291911F44AAFC861C05F76DD230740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3627e558-59e8-4b76-bb16-4370fb6ee4a5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\3627e558-59e8-4b76-bb16-4370fb6ee4a5.tmp
Size 10KB
SHA256 aa2ff2a794aa37e425ddc5f7aa10082549b800bc532ce4d37d27910c28889549
MD5 c51dbb577683369ca107418ea069a061
SHA1 52376bc95d9a516ef595cd44f48098636684828c
SHA512 9fa4aa6e2366b91d6d325604913c2e9d12f496a0b4dbc80acfdadf42f0cc30fc85f5b60e1494cd5231cf23183a46f671cdb8509000df922818f9acd105021d6a
SSDEEP 192:sxZGRFWx/fcsx0IdpSSHW6+WNa5eXY3698n/Ig5jJ:sxZGax/fcsxtNHbxXXOP
TLSH
T17222C6126D28A93B8CC7E209BA25BF57E6F9503291911E48AAFCCA1C05F76CD234740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

50a8d677-2c7c-4250-932f-8913025c1712.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\50a8d677-2c7c-4250-932f-8913025c1712.tmp
Size 9KB
SHA256 b82c28a756bed6d3495eed49bbcda2cf04b26a6c4de903bdc75018356c27398a
MD5 ff981226507f36cf520aaab23fabf5fa
SHA1 2d0b76c45494d68f43be7812e8df26eca96e1e90
SHA512 8e094fa947849b52322c92780658b109d15e14f2ab4d4720272c764bf8255e45366848835c32335c8f8ffe328975a71e13463771a16aea6c46ee561a15b247e3
SSDEEP 192:sxZGRFWx/fcsdIIdpUKHW6+WNaEmb/Y36LDPn/IgrJ:sxZGax/fcsd53Hb9q/XL79
TLSH
T15D22C8526E38A93B8CC7D219BA25BF57E6F9503291D41E48AAFD861C05F76CD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

67385534-9712-4808-9a09-9ecf48ba427a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\67385534-9712-4808-9a09-9ecf48ba427a.tmp
Size 10KB
SHA256 be6a4fda9264667f98ea6f417a9e6c9844494f4d8891d397939526b77348311b
MD5 45e2580ab10dca00ba3636d415a28077
SHA1 66f66dd3da5da42afa06b3cb73346f6c7b49c66a
SHA512 2f392f106802499e25f5fa72817496f293e6b4c01b7d2e743619602c08220f3f4c3dd0c6bde240971bce2d7089f08652af5905aaa5dc1514530c74a2489c73e0
SSDEEP 192:sxZGRFWx/fcsxIIdpSKHW6+WNaEmb/Y36LB8n/Ig5jJ:sxZGax/fcsx5lHb9q/XLyP
TLSH
T1D022C7526D28A93B8CC7E219BA25BF57E6F9503291D01E48AAFDCA1C05F76CD234740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8173fb00-2ae1-4215-9340-3efba7ce96fe.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8173fb00-2ae1-4215-9340-3efba7ce96fe.tmp
Size 10KB
SHA256 9b4b3bdf33b23492d85afe7d466c33a67ca7c069477ee48b387358ab11fac9ed
MD5 46fc6f31c703d0dd838507095f23c25b
SHA1 bb662a9e3a5dd7f414f3505938c328495ee466e1
SHA512 52988f7abb62e094c6c310285d233ca8082210f1ab9e7d309db8bd372e9928dc86a1966daf3a6e6e544160abdfab25c466e6c3afcc5d5bb0bbf38ce815fa3a15
SSDEEP 192:sxZGRFWx/fcsxIIdpUKHW6+WNaEmb/Y36LL7n/Ig5jJ:sxZGax/fcsx53Hb9q/XLfP
TLSH
T18A22D8126D28A93B8CC7E209BA15BF17E6F9503291D41E44AAFDCA1C05F76CD234740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

83f026f1-7cae-429a-b0bb-a23916677156.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\83f026f1-7cae-429a-b0bb-a23916677156.tmp
Size 10KB
SHA256 1570e31b000b82e604dd4f0a5be7b36fc2ee6c52c3c6322875010a3b79150bfd
MD5 ea5b7dd8e4bcce791ba48749191c1495
SHA1 7551bf6dc1c66e5b5fc8b4d9e60d5f4e2256c8ea
SHA512 b611e838fb7c1646c1a0934243ccecf8548364a5f5328801e218451ba93e907ceccd95cda4711f30f232b2c6c6e362785c64a9ebe5c7c5103069d8c005005294
SSDEEP 192:sxZGRFWx/fcs1IIdpUKHW6+WNaEmb/Y36LDPn/Ig55J:sxZGax/fcs153Hb9q/XL75
TLSH
T1A122D8126E38A93B8CC7D219BA15BF57E6FA503291D41E48AAFD861C05F76CD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8d11e727-adfe-46eb-ab57-d91c9d1ead97.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8d11e727-adfe-46eb-ab57-d91c9d1ead97.tmp
Size 27KB
SHA256 e27967396c8778a8b492d230af06dba9fbcbefbaef59419d891e6db502f411cf
MD5 89918e94419c1e2b1f09492e60f5efcb
SHA1 d903f2edeca0246775395bc946973c21053b5182
SHA512 3840afb988b221c9d59386c4a304ffd36373c805b39ade2681f29db3658f14ee78a61866458aac7c2c9a553eb6bb03fdc62db83e37774d189f2ddd6aeb57e306
SSDEEP 768:TzKlm7QWvUYe08F1+UoAYDCx9Tuqh0VfUC9xbog/OVh/LlpPs/wroVa:TzKlm7QWvUYe0u1ja8/L/E/bVa
TLSH
T126C20B3B640CCB7E4FC04A9DDC5A6F9B7EA802C7A6588D4047FA994C02C77EA51264DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 331B
SHA256 3bc9edb862c7fd65dc48e40fe56fc48ece145bedfbb979880989e8b0be0f1e05
MD5 c1145c47e77af863d37016486370bae7
SHA1 d5291cf207bc1cf86ae6a1ad7597d2b5a04b9256
SHA512 e6aec6331186cd1d8ed5898907cd893855db048516d221a41d41095e0920eb44010a6b5e228273399bbd9639fc1e2d6486439feb1d2f22bece8b9d2b23e2054b
TLSH
T183E07D8978CECA2EA64864D751F8572CD3C03A5FD3C8690E7740CDC97003040B2C66A1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 11cde47277ba19887a35bfb6890111579abdb387207e79755512d89e085f6444
MD5 b4b21d57d55e482585d0f1bf900488a0
SHA1 0379cb11a1fdff9fc61d3fd5d6124dcde8221aa4
SHA512 a11c79ab363a38cbd99988b9231278c05c31079b1865f6e2364fa949b2f989029e493a371e3bdc4a5505f10044c6df6d7656d36721592333d0a020ccb5201186
TLSH
T108E0208A04CDC21D5114B4C701949B0CC2D23A5F97C0AD1D3700C9867C0149066D9562
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 4e95fe9ae72825a7f385b4dc3007612aa2c0e5323aff12207f68b27ee99d187d
MD5 37df4c72bb2d278a3cc0a0953d1cc1e0
SHA1 ab10a473406a6b731d4c8ebc39498eb6b46f5d89
SHA512 f11bca5154d66be0221152a656d1fe34a8fae56b5206b767084b507d06967fdd0fe91b34f1c04376267b8967895c28ee8a48d854735cecd8d24b637729f5d2a6
TLSH
T1DCE0209A05C5C31E520C648701B85B1C81C53A1B93C06F1D2700CE48B80254073DB564
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 4ae117c03987547965423ad52235072565b4349d1f48861120e13b51df9ccc63
MD5 0d8b44a062e7e9db87ff0c8f96140761
SHA1 3c094cb22804d32a0e2cf5f1782788ecdd56149f
SHA512 1629dfeab846fb9ab0e783dfb105c10d0dfbeb5d1757b722c0acd71368cc407a60a545b4681543718ec76e14dd73966dfaf8ce56198f778ebe8e5b9fec83f819
TLSH
T11651C7825FE303E5FFD688F68FE428EB373E45C081836E71C598C6B8C9477548090048
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 14f682c766b30696341254aa9b1c5b0bffd861481cf2d7d9c63c036f709a43bf
MD5 f59b9fd8bef79fe2862cf49a51101e33
SHA1 fee828fdc1c46be21fc349e456b1757860a8dc10
SHA512 c92e2577895578f2cbea5a8c75513eb1c27ac303c3dd1fec56f504df13273f652848de5ab551982b83f4b6f3eda4f05ebefb92d6025728e66d3a63060f067964
TLSH
T1925185829FE303A5FFDA88F68FE429EB373E85C191835E72C598C6B8C9467548095048
MD5 SHA1 SHA512 TLSH

Submit Download

bbbcef46-8ee3-47fa-872e-9f622a9f9c18.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\bbbcef46-8ee3-47fa-872e-9f622a9f9c18.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

43ea4f54-0c87-4338-9875-8aaed1379bc5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\43ea4f54-0c87-4338-9875-8aaed1379bc5.tmp
Size 1KB
SHA256 82c4d7de5ea51926c0423e6689afb525f4c90ebdae6b83175e5c929eb9fb2921
MD5 60a542b90eea3c4231c8f3b6b25da716
SHA1 e569a6382487bc379c3ba63114f972f4451341eb
SHA512 a4dda226739b3b3cc8590b764cafb319e92239f9a51e22e4bc262a839e5dd50cd1211c5c12a088742304f6119aa9565910569ec4f395bf0fa071299eabd5cdd3
TLSH
T1D031ACB383E5C95EC8251AF09B24AE2BCE1C0A15832C3D69C9D4FF6797E3471E10258B
MD5 SHA1 SHA512 TLSH

Submit Download

4b236596-eda3-4c51-b4e6-bdbf4fa5668d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\4b236596-eda3-4c51-b4e6-bdbf4fa5668d.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

51ce0b87-c1db-45af-9c7d-b814a7deb323.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\51ce0b87-c1db-45af-9c7d-b814a7deb323.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

dd253ba6-d068-48bd-ae2a-6dd4890c7314.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\dd253ba6-d068-48bd-ae2a-6dd4890c7314.tmp
Size 10KB
SHA256 dbcaa9c360cec76f0eecdc9271b18a25ab22c6ae7adc4fa62f4bb7e3477669e6
MD5 e961a4738e14e5229d3578dcf1467588
SHA1 d31bacdd255d4ebc3491779d3f600cd5b89eb283
SHA512 7d50b4c43ff510bbc44d60828e16e4464468fcb74e5872730e9ac39c3ae0df3e8a43b5bb3e40e621d0328ed6da25ace1fc130f7c3912a4ccab557b87c0b7bff9
SSDEEP 192:sxZGRFWx/fcsx6IdpSzHW6+WNaP8XY36L8n/Ig5jJ:sxZGax/fcsxTsHbFXXEP
TLSH
T11522C6526E38A93B8CC7E219BA65BF57E6F9503291901F48AAFD861C05F76CD230740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f6e4ea8f-22a2-4dee-aefe-91b9e114310a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f6e4ea8f-22a2-4dee-aefe-91b9e114310a.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6f3179b8-56b3-4d8e-8219-bbfe300c1b53.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\6f3179b8-56b3-4d8e-8219-bbfe300c1b53.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 aaff137ce079814229691db84bf1217130daa2db23c47bc660d68505f61c4327
MD5 5bfefdc139559325cd85576e9b6aef85
SHA1 713e11e2ff05d988ad1b898cdfa4e3b918f122a2
SHA512 50460756e730d2e42a338c7eea9588a539e3f239e0adf9740bf17e9e3b038eee53c0d16debeeb4ebaf12a60eb30bd88ee015d64aa19567431dd23bde439674df
MD5 SHA1 SHA512

Submit Download

ba9cabb8-4133-4f0b-9a60-92c2eb8d9083.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ba9cabb8-4133-4f0b-9a60-92c2eb8d9083.tmp
Size 8KB
SHA256 e76df1e37980a84bc97d3b0c16ccad0280c584620c71e5b03d0b382da20c7d2a
MD5 7acb5f7cd20b29ae7254710a3009d072
SHA1 fafde44b656b5860bc7d0ea903c978422f6a2fb4
SHA512 3c2370f85654a78784ccb50cfd8999ac054ec3fa7efb13067830672c6d173799accc3462b90d626aa7f255dcb4d090809b53a8ba274bcccc4f83ab80713c6b14
SSDEEP 192:BONO6JUm0QmiUy9yso//OywtvCxBCN2U6:BONO6+mE3so//at6WsU6
TLSH
T1D302B739BC68BC7B8EE2AE45B44777239FA4106B9A911F84DAD92E1D01D755C1302C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

dc78b647-9d01-48e6-b64b-5afe2bc124e8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\dc78b647-9d01-48e6-b64b-5afe2bc124e8.tmp
Size 18KB
SHA256 3d0e5232da9f17176c717444276a07bcc9094727d62482b93f8642e3014bbc7a
MD5 ef3065677535a53bfb0acbd62c4bc042
SHA1 616c708ad98b6c12223ed3e8292e512213b06dcd
SHA512 bc23ef23d903078234d75056a71bbd930962721f712085d65fbeeb92131b0ebaef941a31cb0758991ad84cfa2d68658a685deac5592a260b8753814088fe8f6c
SSDEEP 384:BQkUSv0sNWaIbObNwh//at67HnH7vBENuIIlT:z02M/bnH75EwL5
TLSH
T18A829D71B878AC3B0EE3A620F0063617EE749067D6D91F50DADEAB2C01DA1D8234BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

13e65415-753d-4768-9b43-d4acef386e43.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\13e65415-753d-4768-9b43-d4acef386e43.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 800fafedfd9026dae1c5d993b4f1a4ce46b31139a65cfaec99bdefe31068d7c3
MD5 908f9fc739b0b68d65982a406a9fc9ef
SHA1 1246ac2bebdd4573c7575dfb8e4abf1ec914b7e5
SHA512 4ace5a6482b4deea46083f56ef566e6807e1196b8b180219141cb1ee352755049299195f57fe7b505ae751b4abbdc40f9d9f35c24fe8c1a9d12afe253a649943
TLSH
T191415A68A6E91148B3B37F0A9BF6A86E487B7D372E06D45D00010E4E4A63B40CCB1737
MD5 SHA1 SHA512 TLSH

Submit Download