hxxps://glewo[.]click/Login/Ecard/

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
user interaction
yes
max time kernel
148s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/11/2026, 16:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://glewo.click/Login/Ecard/
Sample261102-vd4nhsvxft

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2716	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-240542094-4193773837-3211495583-1000\{3097C536-BB08-4074-AD89-9C4B36583FB1}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4732	msedge.exe
4732	msedge.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
660	Process not Found
660	Process not Found
660	Process not Found
660	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe
3236	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 3236 wrote to memory of 4308	3236	msedge.exe	83
PID 3236 wrote to memory of 1644	3236	msedge.exe	84
PID 3236 wrote to memory of 2716	3236	msedge.exe	85
PID 3236 wrote to memory of 1644	3236	msedge.exe	84
PID 3236 wrote to memory of 1644	3236	msedge.exe	84
PID 3236 wrote to memory of 4900	3236	msedge.exe	86
PID 3236 wrote to memory of 4900	3236	msedge.exe	86
PID 3236 wrote to memory of 5060	3236	msedge.exe	88
PID 3236 wrote to memory of 5060	3236	msedge.exe	88
PID 3236 wrote to memory of 5060	3236	msedge.exe	88
PID 3236 wrote to memory of 1836	3236	msedge.exe	89
PID 3236 wrote to memory of 1836	3236	msedge.exe	89
PID 3236 wrote to memory of 1836	3236	msedge.exe	89
PID 3236 wrote to memory of 4620	3236	msedge.exe	90
PID 3236 wrote to memory of 4620	3236	msedge.exe	90
PID 3236 wrote to memory of 4620	3236	msedge.exe	90
PID 3236 wrote to memory of 3768	3236	msedge.exe	91
PID 3236 wrote to memory of 3768	3236	msedge.exe	91
PID 3236 wrote to memory of 3768	3236	msedge.exe	91
PID 3236 wrote to memory of 2792	3236	msedge.exe	95
PID 3236 wrote to memory of 2792	3236	msedge.exe	95
PID 3236 wrote to memory of 2792	3236	msedge.exe	95
PID 3236 wrote to memory of 4788	3236	msedge.exe	96
PID 3236 wrote to memory of 2084	3236	msedge.exe	97
PID 3236 wrote to memory of 4788	3236	msedge.exe	96
PID 3236 wrote to memory of 2084	3236	msedge.exe	97
PID 3236 wrote to memory of 380	3236	msedge.exe	98
PID 3236 wrote to memory of 380	3236	msedge.exe	98
PID 3236 wrote to memory of 380	3236	msedge.exe	98
PID 3236 wrote to memory of 4752	3236	msedge.exe	101
PID 3236 wrote to memory of 4752	3236	msedge.exe	101
PID 3236 wrote to memory of 4752	3236	msedge.exe	101
PID 3236 wrote to memory of 536	3236	msedge.exe	102
PID 3236 wrote to memory of 5116	3236	msedge.exe	107
PID 3236 wrote to memory of 5116	3236	msedge.exe	107
PID 3236 wrote to memory of 5116	3236	msedge.exe	107
PID 3236 wrote to memory of 400	3236	msedge.exe	112
PID 3236 wrote to memory of 3252	3236	msedge.exe	113
PID 3236 wrote to memory of 3784	3236	msedge.exe	114
PID 3236 wrote to memory of 4204	3236	msedge.exe	116
PID 3236 wrote to memory of 4204	3236	msedge.exe	116
PID 3236 wrote to memory of 4732	3236	msedge.exe	117

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://glewo.click/Login/Ecard/
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7fff7caec188,0x7fff7caec194,0x7fff7caec1a0
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1732,i,3665197382452563469,4223743243474533376,262144 --field-trial-handle=2176,i,8120841276467811776,8308079071834827245,262144 --variations-seed-version --mojo-platform-channel-handle=2172 /prefetch:2
  2⤵
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1960,i,6891124497311868858,3067357817572967871,524288 --field-trial-handle=2176,i,8120841276467811776,8308079071834827245,262144 --variations-seed-version --mojo-platform-channel-handle=2188 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2552,i,6266203603329600880,1429649003479029886,524288 --field-trial-handle=2176,i,8120841276467811776,8308079071834827245,262144 --variations-seed-version --mojo-platform-channel-handle=2536 /prefetch:8
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,11684097804665834325,1900391213163185823,2097152 --field-trial-handle=2176,i,8120841276467811776,8308079071834827245,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=2732,i,3352404507471568247,9302726783867526107,2097152 --field-trial-handle=2176,i,8120841276467811776,8308079071834827245,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4176,i,15092330865669390722,8849954315271442255,2097152 --field-trial-handle=2176,i,8120841276467811776,8308079071834827245,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4212,i,4675209339556464401,10350081554021767787,2097152 --field-trial-handle=2176,i,8120841276467811776,8308079071834827245,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:2
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5016,i,7448423261814017944,8731575020418766629,2097152 --field-trial-handle=2176,i,8120841276467811776,8308079071834827245,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,8986603040861262051,8214636326250812692,524288 --field-trial-handle=2176,i,8120841276467811776,8308079071834827245,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:8
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,16980348679329770674,5500786326446902396,524288 --field-trial-handle=2176,i,8120841276467811776,8308079071834827245,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:8
  2⤵
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5864,i,17092809522961007652,2205161539862553864,2097152 --field-trial-handle=2176,i,8120841276467811776,8308079071834827245,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:1
  2⤵
  PID:380
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6164,i,685350908107890301,17356426383815690632,524288 --field-trial-handle=2176,i,8120841276467811776,8308079071834827245,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:8
  2⤵
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4428,i,17949554153155295045,2133425638037866569,2097152 --field-trial-handle=2176,i,8120841276467811776,8308079071834827245,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:1
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6164,i,685350908107890301,17356426383815690632,524288 --field-trial-handle=2176,i,8120841276467811776,8308079071834827245,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:8
  2⤵
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5044,i,12634162598753814280,3549373219123657667,2097152 --field-trial-handle=2176,i,8120841276467811776,8308079071834827245,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:1
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4416,i,11374404441454265409,13702536917648931679,524288 --field-trial-handle=2176,i,8120841276467811776,8308079071834827245,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:8
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3620,i,11962997891490711812,4766040329986771362,524288 --field-trial-handle=2176,i,8120841276467811776,8308079071834827245,262144 --variations-seed-version --mojo-platform-channel-handle=120 /prefetch:8
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4212,i,15746675290736742541,902900603510070373,524288 --field-trial-handle=2176,i,8120841276467811776,8308079071834827245,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:8
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7004,i,8161192508876527916,13345213363570651253,524288 --field-trial-handle=2176,i,8120841276467811776,8308079071834827245,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:8
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6176,i,14742179981814577209,7258229424738994318,262144 --field-trial-handle=2176,i,8120841276467811776,8308079071834827245,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4732

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

395b386c-7bfe-451e-84c2-09718d64f2ab.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\395b386c-7bfe-451e-84c2-09718d64f2ab.tmp
Size 8KB
SHA256 2a703252db68011b039b702e7035c90dc66b6fd549b45d004549efdeac10e3e9
MD5 cb360ff57d316da42295fd1cc3d0f2de
SHA1 12e588fdbcdb58bd1a0261f41e789df1fdd445f3
SHA512 ce49bfa7b5a06836250fe88b9feea2349de227c052fe2874355c44924de16355077c476755c335db8132a7b129535aa94704bc4460f59701d4cc0c5dc2dcee73
SSDEEP 192:rONw6wlD5QmiUy0GB24X58gZYjzorxJjXcveLqXU6:rONw6kX1024X58EA8xJjX3MU6
TLSH
T13A121835F46CBC2B6DE2A445B0873113AFA5412BE7896F90D6EC2A2C01DF2AC534ED13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

65dd90a1-58ce-4629-a359-524380541ce9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\65dd90a1-58ce-4629-a359-524380541ce9.tmp
Size 18KB
SHA256 9b48a8ce6132e8c4f7efb617b848c3ea32a7f25bf9c65c70f36b5221d790b68f
MD5 8ba9f457d6a8db4f2bf575ed45c78977
SHA1 965d54ca396811ea86f3fadd0c1210e21b63a522
SHA512 64d5cd3683cc0e4e02102376e1d14b8d9453400ac6db35e0de49a82f3c95bf7f368451bbaf8c3a7b084a912f919c706f8cfd6569d39380b42edbbf6f085074cd
SSDEEP 384:nmGQkUSv0sNVgtZcOKqHX58EA8xJjXDMYKsjbEK5rlJ:nb0XXKsaqDMYKsj5JlJ
TLSH
T1E0827C36A8786D3B2DE2F111F08A3507EFB4906BD2891FA4D6DD6B2C01CB6D9134B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

68988edd-0fa9-4aaf-aa47-f285b591c42e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\68988edd-0fa9-4aaf-aa47-f285b591c42e.tmp
Size 21KB
SHA256 095228b98cfd4a16c8dcf9037bdea5641250e2b7f2d0065a0088cfd8ca457327
MD5 11a6bc75c61eb5dcffd5671a8802c159
SHA1 7204948326517480b46aee28610e89556eab11cd
SHA512 77031727e3d6b7ff99b36f039cba9f4865e43992eb4f3090333d6503acd0c63605833bec163a8f8659a768e92a66a0ce3f33b162529601c42b658dd4a6b6dcab
SSDEEP 384:/mhiFzQkUSvjSsNv8TUNTUlIlgtZhOKqHX58EA8xJjXqMYKsjbEK5rlJ:/pFdGSwgoCKsaqqMYKsj5JlJ
TLSH
T1BAA27C3398689D3F6EF6EA11F54E3203EFB0506BC6856EA0E7C95A2C018B1DC134BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9b6e1918-8313-4e6f-a026-5a61fbbe33ca.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9b6e1918-8313-4e6f-a026-5a61fbbe33ca.tmp
Size 8KB
SHA256 45eda1f5480437120e35f3bc2e28e9563987a42373126d9a171a2d71fb1db398
MD5 55136062be631a5d4f6601c9d7c848a5
SHA1 8f3cc1a244e93a1bdf993c475568b79a1301e59c
SHA512 8703e817ab38574efc273759949f77146973c56343d4d8311a2c52519cffd2a7ca293fc480ccbf367e53cfaa13bd4501daa8fb01524a3a58f37e2f639dbd8ddb
SSDEEP 192:1ONT6wlDgQmiUyXBW4X58gZYjzorxJiDlr5U6:1ONT6kg+W4X58EA8xJiVU6
TLSH
T115020A34F9787C7B9EF2AE09F58A2713AFE5102BE6552F40CAE81B1D00D769C1306923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 58b461967016818ce2213ba739aa830e079c4747cc98baea5feaffc8b09c915d
MD5 8800a672498272bad98dd79644e30101
SHA1 14a42c33d6271869cc680cadc5ae061e7092e3ae
SHA512 a17f90c73859841f3e0a3211d7f8d1027a7f8ec3a4ef87ddc96b1a39e0b52bc65decb3dd694a7092e22f06f2124864535e2e8632387dd42184abe2d3e22d7e12
TLSH
T135D022F2F32200E8C8C02A3C20030B080208C8000C833220C832C0C23ECCBC0A88F08C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7b81d8521f4289b1259fa60587a7bc7131f06581c3a734224a7de2fe2669bfb7
MD5 46bc1ee7f1b3386bbc305d48ade31614
SHA1 b5e469cf75c16715fb850bd86db01e329da2928e
SHA512 09a97914c725107f4c125aa0ff0826f0410030841011f0bc5c9eed9e023261ab13abc5f59c9c311d02baf1b25e7398de5ea81438c8a8ede3cc60ca3906edfce9
TLSH
T152D022F2B3A208E8CCC02A3C20030B080208C8000C83B320C832C0C22ECEBC0A88F08C
MD5 SHA1 SHA512 TLSH

Submit Download

0d92d125-ff76-4784-959c-35723b137c9f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\0d92d125-ff76-4784-959c-35723b137c9f.tmp
Size 10KB
SHA256 f367a88e93d4616472232c695d41d2a82f61752a6faaa503164aef23b35949ac
MD5 cbc3ab42b39e4adeb3708951bf008e13
SHA1 4f730dae311debf614dec2b6a868990fb1e389c9
SHA512 99e8274b3b3fb0c248a45b9c1000174dbdadf2c28071351d5eb6c747f4b108b37146d32494f76d1ce5f6f256fa8f91fa94a4c4238ea60635457b46feb71b918d
SSDEEP 192:sxZ7RUWn/f0suMjIdpoTYHW6+WNmiZdYryFwPIg5/J:sxZ7tn/f0suM8tHbFdYX
TLSH
T13D32E9526938A93B9CC7E219BB54BF17E6F9103295D11E58EAFC861C05E7BCD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1f87a547-ca4f-44c5-ae2b-bc09905a233f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1f87a547-ca4f-44c5-ae2b-bc09905a233f.tmp
Size 10KB
SHA256 d6d39be1620d2523abaf3455c3427ed32265522fb3ab0b24b5a8b0e9b5bb9932
MD5 4dce305649f8d5dbe530857d25cf224f
SHA1 988b2207325d384fcbf857d3c46b733425bcbfe6
SHA512 6f38fa1921d8ed47ced953018b6d91a02b757001cd098092c9b976a1ef6f2a5725f6e08f12b487dee14a6fc9476c6c4912db009ad55c05a35eb6024912a1e8d1
SSDEEP 192:sxZ7RUWn/f0suMw+IdpaTrHW6+WNmiZdYrdqwPIg5/J:sxZ7tn/f0suMGgHbFdgX
TLSH
T1D532E8526928A93B9CC7E219BB54BF17E6F9103295D11E58EAFC861C05E7BCD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2d041c9c-63ba-41c3-a9fc-72b86c4e3ad3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\2d041c9c-63ba-41c3-a9fc-72b86c4e3ad3.tmp
Size 10KB
SHA256 086b17682b4a8018f778e483ac56b965afeb6c3209b61297b5319d9b06062725
MD5 4e987e7645e12fa26b88a5422887130d
SHA1 dcdfc046a39387e9f48a4c257112102e70da6ebd
SHA512 91e5737d80cd45abaf69d1e3765fea9a734ae5db7e0d147934c87b06e3218841a0e5f13dce676773e1e0fbaec842636a260a3fc1129de75d680495f09237b155
SSDEEP 192:sxZlRUWn/f0su4jIdpdTYHW6+WNmW1ZYrZFwPIg5/J:sxZltn/f0su48uHbNZFX
TLSH
T14822E8526A38A97B9CC7D219BA54BF13E6F9503291D11E58EEFC861C05E7ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

43eed9ac-a77d-4210-a896-b7e9dee86ec2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\43eed9ac-a77d-4210-a896-b7e9dee86ec2.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

66378eb2-06b9-44ea-989d-dad46fb7e6f0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\66378eb2-06b9-44ea-989d-dad46fb7e6f0.tmp
Size 10KB
SHA256 c743c080bdbf4f156552b13f02e99949c9572457cb94bce8cfe804a535cbe759
MD5 b5636809d8d311b23898e809e7fd33df
SHA1 5367f8ec2f144aaf69426bc6195e443c0a0f2c13
SHA512 4b89d4ffa4222f260f94aefe7bc5ae1a42cb484b24c0c50a556a0e23aa58c1fe3b5fe12b53d729318788b0f627720cc91dd80e6361d36eca8fce5b1f8e6cff8a
SSDEEP 192:sxZlRFWn/f0sdWjIdpdTYHW6+WNmWE/YrbPwPIgrJ:sxZlyn/f0sdW8uHbU/v9
TLSH
T11122D8126E38A93B9CC7D21DBA15BF17E6F9503691D41E58EAFC861C04E7ADD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9228cfa3-32c6-4fda-8355-ebe21094bd02.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9228cfa3-32c6-4fda-8355-ebe21094bd02.tmp
Size 10KB
SHA256 1e9b3318b995b076ae23e98d3e1a9055376434f78f91c4b9e5e299a4800712ed
MD5 b2cdae7f01552f27a8c18021695b19f0
SHA1 8c3207d3db3f772cce9dd26c03e1000b921b02ab
SHA512 c2429b8e2a7d8b029d0f6488bccceef7b9ff317b7d4beacc4768b51e0e6f6ea65edda8e69cb29e4e69060d73bb2d7f2ede7aa283083dde77e8108ba664a08200
SSDEEP 192:sxZlRFWn/f0suWjIdpdTYHW6+WNmWE/YrbPwPIg5VJ:sxZlyn/f0suW8uHbU/vx
TLSH
T13722D7126E38A93B9CC7D219BA14BF17E6F9503691D41E58AAFC861C05E7ACD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 6d28f2348597e6a267b6d8d66d3bc39fd45881ae633dd865849e34da2ca898f1
MD5 39ac549a9bc835682ab59037bff57887
SHA1 583322c07e51c9f865069b85b761e4fd14f23d2e
SHA512 de912ac5857d39f487e674ed0691fcf41f91833fa41f3fae11daa02cbf850ce161891c80da41532f8ac9ddaf560f6b6cd6ebf8a2b4ab9f91c7332bb5d888567c
TLSH
T1CE6193C151A1886DFB68E37246F61067B6388C728EE3ED32D444F4FA5C063207264CBE
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 bca0a4d5ced4f33c2e2dc2f93ac6ec2c5dcfcba9671f7e0f9a71764097d05ce9
MD5 d8c7dff6d8961e490adbac8d32472c60
SHA1 aa3997d103a35bccc7dcfb973fd288c177b8cea3
SHA512 a3e4386416887e264f4b462ac6393c53b42ab3fe2996672cabc53d29644bfa7aa0a9efab7420e71e6dbb923514ce42cc26af805a2bc21a77ccd430e5ccda9baa
TLSH
T14E6182C156A1486CFB68E37246F61067B6384C728EE3EE72D455F4F95C023207264CBE
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 38a3b11bd76c0029b68eac4b1f5f4fa34ba3d6774a78ec0e12693b109c83b3be
MD5 b9d6a90422739d64246c78395c90b7ef
SHA1 62bd49ad767519fb5b56e4617495b0f76f8745a9
SHA512 1b0ea7475b4bf7606d3c2af5d9e5e47cd49bff86dd893fce5600262be0a5385c1a8e52a48becd3518a75cda200d96de091e4b0f05883b38df86e839a33d35ce9
TLSH
T1AA6151C152B0486DFB68E37286FA1067B5348C728EE3DD72E454F4F95C06320716487E
MD5 SHA1 SHA512 TLSH

Submit Download

95b860f6-eff5-4c79-aea4-f2884b24ebda.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\95b860f6-eff5-4c79-aea4-f2884b24ebda.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

15522359-d421-4cc2-807b-34cc513884df.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\15522359-d421-4cc2-807b-34cc513884df.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

21d33972-204d-4fce-af26-2953171ae932.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\21d33972-204d-4fce-af26-2953171ae932.tmp
Size 4KB
SHA256 8b0689d0d2bad549904d30a765c7ebbf1cbd8ce8fe92706bb2f844ceca403862
MD5 7d3e5703bc7a89e6ff31166c38e622e9
SHA1 c2121157edb2725123c4b3b52468bdbfc8b4c950
SHA512 d87c0d917d48a6deb298582315accf78ae213b1d86c0b4a7cc9c8237b75cfead4fca7ffe91dfac6884a5f3bd2532b9620d78acfa721e6d53a8ab9708f3e960e2
SSDEEP 96:DkOuVupuruOu8uFuhzoVu5u7usBqVu7uquoXuxw8buoIuICuv5x:DvwC+RZiqEVOGZqVKp1Xqr1I1Cy5x
TLSH
T101A1EAB2C6E4875DE91106F4AB257E2ECE3D095903283D3B89E5AF1BA3E3570E14164F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

99fe28ad-aa4c-4231-8610-8e92d17d4ec6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\99fe28ad-aa4c-4231-8610-8e92d17d4ec6.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

ab798636-82a9-44d0-bf72-8646987525d5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\ab798636-82a9-44d0-bf72-8646987525d5.tmp
Size 4KB
SHA256 3bcb59ed650ead271cd8a5e57c26c7ffcf1f31e9f4febc2c971b3d4f604382da
MD5 1bb197e01717e8bcecf2761a638621c6
SHA1 702a8a1c55f70d001f6df58f6dc1114f609fcb67
SHA512 1851dcca17ae06f719713abaae5c622c31e0345d37f8dfa61bc8f85f8b1bdc2fa56d53bb34eebc3765d3e5901c93c343c0db91c1e05abec2857576292106e956
SSDEEP 96:DkOuVupuruOu8udzCuNVut5Nu7uInuduIuoCuoIusBqwBTub:DvwC+RZ6+kVE5NG1n231C1IZqkTi
TLSH
T18391B9B3C6E4866DE91106F4AB257E2ECE7D095903183D3B89D5AF1BA3E3570E18064E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\FileSystem\t\Paths\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

c29426b1-31f3-470b-92a5-3ef6e2b1000e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c29426b1-31f3-470b-92a5-3ef6e2b1000e.tmp
Size 27KB
SHA256 2341df5c34901a877ebbd52cb62982a0133e58b4c6fdb5b349440138e9efd4b6
MD5 30246c268a0cde4ef36abc2ad8d67547
SHA1 8df03342a2d158eaa4f153c167dcab8650f2c0a4
SHA512 d2f54cf0da88e265522ddfb389f1ebeede7e6a4406199a8baf74b64ccf9f7f03133ede391ef09f9f9fc413b2dadf7ea5f7c1ccc35f0376d8fa8043510bbf7d9c
SSDEEP 768:iHy4J/DWvbtJh8F1+UoAYDCx9Tuqh0VfUC9xbog/OVCiLlc2TbFroRdH:iHy4J/DWvbtJhu1jajiLm0b+/H
TLSH
T1A9C20C3B644CCA7E4FC00A9DED5E6FDB3E9802C796948D504BFA994C02C77EA51264CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8c6713e5-9d4e-47c8-a24c-dd9fedf8df57.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\8c6713e5-9d4e-47c8-a24c-dd9fedf8df57.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

b332c83b-46f9-4bd8-b015-b87d884716c0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b332c83b-46f9-4bd8-b015-b87d884716c0.tmp
Size 18KB
SHA256 10ad86eb8d798bb1e2cb81c8ac67b4b9276fdf370ae469cdfd76c234dc14bcfd
MD5 0136835e720d48818116c571ccbcccc2
SHA1 fa971c88b36506924e577926dd8f250beeffe76f
SHA512 4500f7f20a5e984f1e6320a1fa888fb80d0c7d569d47e63266056d61159c259ab8cc46727a9cc42b5d2587e6a09e32e6e07f5508c48eb14687cb25bd646e690d
SSDEEP 384:amGQkUSv0sNVDtZcOKqHX58EA8xJjXDMYKsjbEK5rlJ:ab0uXKsaqDMYKsj5JlJ
TLSH
T1DB827D36A8786D3B2DE2E111F08A3503EFB4906BD2851FA4D6DD6B2C01CF6D9134B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

97e34f99-84de-4528-a5b2-9b247b16d51c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\97e34f99-84de-4528-a5b2-9b247b16d51c.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 2119664073170588eb8cc9939cea851164108c4c2f27899e29db2dae11113d60
MD5 5b57902f7ea518ad7cabc71f33a033a7
SHA1 ec6c591ac89fc6de1ce1a8af4a5d55f953776f9c
SHA512 4135647df06e44b20440f4284be7b341165971d5a1fae88b2d145f51b0f860265e217d05f9acb8d329d0ba0a2837b96e5ae412ac35fea4f0236c42f715674d53
TLSH
T128412658B6E91148B3B72F5BABF6686D487FBD772B0AD45D10010E4E0A66B40C871B37
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download