hxxps://cdn[.]discordapp[.]com/attachments/1483963349392953467/1567234427594219661/3DSeriesGG116[.]1[.]0Setup_1[.]rar?ex=6aec190d&is=6aeac78d&hm=4622be4f31c719d85fe0c6bae88a304fbeaa44e5128aae353b5b735ac4406aaf&

Analysis

user interaction
yes
max time kernel
150s
max time network
134s
platform
windows11-21h2_x64
resource
win11-20260911-en
resource tags

arch:x64arch:x86image:win11-20260911-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/11/2026, 16:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cdn.discordapp.com/attachments/1483963349392953467/1567234427594219661/3DSeriesGG116.1.0Setup_1.rar?ex=6aec190d&is=6aeac78d&hm=4622be4f31c719d85fe0c6bae88a304fbeaa44e5128aae353b5b735ac4406aaf&
Sample261104-vbftnsbx2s

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3444	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 5 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1494457106-2582563566-1599095290-1000\{0C1F641A-E3C9-47A7-81E5-9E4E618B5D9B}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\USER\S-1-5-21-1494457106-2582563566-1599095290-1000_Classes\Local Settings	OpenWith.exe

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\Downloads\3DSeriesGG116.1.0Setup (1).rar:Zone.Identifier	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4180	msedge.exe
4180	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe
2176	msedge.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
4552	OpenWith.exe
4552	OpenWith.exe
4552	OpenWith.exe
2444	OpenWith.exe
2444	OpenWith.exe
2444	OpenWith.exe
2444	OpenWith.exe
2444	OpenWith.exe
2688	OpenWith.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 2176 wrote to memory of 3832	2176	msedge.exe	81
PID 2176 wrote to memory of 3444	2176	msedge.exe	82
PID 2176 wrote to memory of 4348	2176	msedge.exe	83
PID 2176 wrote to memory of 4348	2176	msedge.exe	83
PID 2176 wrote to memory of 4348	2176	msedge.exe	83
PID 2176 wrote to memory of 4472	2176	msedge.exe	84
PID 2176 wrote to memory of 4472	2176	msedge.exe	84
PID 2176 wrote to memory of 432	2176	msedge.exe	86
PID 2176 wrote to memory of 4408	2176	msedge.exe	87
PID 2176 wrote to memory of 432	2176	msedge.exe	86
PID 2176 wrote to memory of 432	2176	msedge.exe	86
PID 2176 wrote to memory of 4408	2176	msedge.exe	87
PID 2176 wrote to memory of 4408	2176	msedge.exe	87
PID 2176 wrote to memory of 2728	2176	msedge.exe	88
PID 2176 wrote to memory of 2728	2176	msedge.exe	88
PID 2176 wrote to memory of 2728	2176	msedge.exe	88
PID 2176 wrote to memory of 1612	2176	msedge.exe	90
PID 2176 wrote to memory of 1068	2176	msedge.exe	91
PID 2176 wrote to memory of 1612	2176	msedge.exe	90
PID 2176 wrote to memory of 1612	2176	msedge.exe	90
PID 2176 wrote to memory of 1068	2176	msedge.exe	91
PID 2176 wrote to memory of 1068	2176	msedge.exe	91
PID 2176 wrote to memory of 2068	2176	msedge.exe	89
PID 2176 wrote to memory of 2068	2176	msedge.exe	89
PID 2176 wrote to memory of 2068	2176	msedge.exe	89
PID 2176 wrote to memory of 2396	2176	msedge.exe	93
PID 2176 wrote to memory of 5044	2176	msedge.exe	94
PID 2176 wrote to memory of 2396	2176	msedge.exe	93
PID 2176 wrote to memory of 5044	2176	msedge.exe	94
PID 2176 wrote to memory of 4844	2176	msedge.exe	95
PID 2176 wrote to memory of 4844	2176	msedge.exe	95
PID 2176 wrote to memory of 2676	2176	msedge.exe	96
PID 2176 wrote to memory of 2676	2176	msedge.exe	96
PID 2176 wrote to memory of 2676	2176	msedge.exe	96
PID 2176 wrote to memory of 3800	2176	msedge.exe	98
PID 2176 wrote to memory of 4692	2176	msedge.exe	100
PID 3800 wrote to memory of 4688	3800	msedge.exe	101
PID 2176 wrote to memory of 4888	2176	msedge.exe	102
PID 2176 wrote to memory of 3796	2176	msedge.exe	103
PID 2176 wrote to memory of 8	2176	msedge.exe	104
PID 2176 wrote to memory of 1968	2176	msedge.exe	106
PID 2176 wrote to memory of 4808	2176	msedge.exe	107
PID 2176 wrote to memory of 4808	2176	msedge.exe	107
PID 2176 wrote to memory of 4808	2176	msedge.exe	107
PID 2176 wrote to memory of 1032	2176	msedge.exe	108
PID 2176 wrote to memory of 1032	2176	msedge.exe	108
PID 2176 wrote to memory of 1032	2176	msedge.exe	108
PID 2176 wrote to memory of 4876	2176	msedge.exe	109
PID 2176 wrote to memory of 2224	2176	msedge.exe	111
PID 2176 wrote to memory of 2224	2176	msedge.exe	111
PID 2176 wrote to memory of 4180	2176	msedge.exe	117

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1483963349392953467/1567234427594219661/3DSeriesGG116.1.0Setup_1.rar?ex=6aec190d&is=6aeac78d&hm=4622be4f31c719d85fe0c6bae88a304fbeaa44e5128aae353b5b735ac4406aaf&
1⤵
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x24c,0x7ffae30dc188,0x7ffae30dc194,0x7ffae30dc1a0
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1740,i,12403969222048432873,10402389036578122400,524288 --field-trial-handle=2140,i,6418677422133882827,10641717060242460268,262144 --variations-seed-version --mojo-platform-channel-handle=2168 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1588,i,18035545162472205977,2874210084088425005,262144 --field-trial-handle=2140,i,6418677422133882827,10641717060242460268,262144 --variations-seed-version --mojo-platform-channel-handle=2136 /prefetch:2
  2⤵
  PID:4348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2532,i,17394853348758550737,6376709915917722433,524288 --field-trial-handle=2140,i,6418677422133882827,10641717060242460268,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:13
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,15989492218589751679,13326715223833478271,2097152 --field-trial-handle=2140,i,6418677422133882827,10641717060242460268,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,11855166464167146551,12171216277155827308,2097152 --field-trial-handle=2140,i,6418677422133882827,10641717060242460268,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4208,i,2375629860816308775,12675599247030674465,2097152 --field-trial-handle=2140,i,6418677422133882827,10641717060242460268,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:1
  2⤵
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4220,i,4504811256376969823,3743722708073775662,2097152 --field-trial-handle=2140,i,6418677422133882827,10641717060242460268,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:9
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4248,i,2572459149011807048,1195320991823491,2097152 --field-trial-handle=2140,i,6418677422133882827,10641717060242460268,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:1
  2⤵
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4284,i,10878246690272072366,7459313557225956944,2097152 --field-trial-handle=2140,i,6418677422133882827,10641717060242460268,262144 --variations-seed-version --mojo-platform-channel-handle=4688 /prefetch:9
  2⤵
  PID:1068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4784,i,4505223421768783941,2276114120571575642,524288 --field-trial-handle=2140,i,6418677422133882827,10641717060242460268,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:14
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3636,i,17296231210092997237,11158175847416888730,524288 --field-trial-handle=2140,i,6418677422133882827,10641717060242460268,262144 --variations-seed-version --mojo-platform-channel-handle=4764 /prefetch:14
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5796,i,13314258503899489553,1256335653577069645,524288 --field-trial-handle=2140,i,6418677422133882827,10641717060242460268,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:14
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5824,i,709507829550299006,12034705016781646630,2097152 --field-trial-handle=2140,i,6418677422133882827,10641717060242460268,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6636,i,13281180957748017193,5086326643442688053,524288 --field-trial-handle=2140,i,6418677422133882827,10641717060242460268,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3800
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1140
    3⤵
    PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6612,i,4075977968933604590,789415972659673293,524288 --field-trial-handle=2140,i,6418677422133882827,10641717060242460268,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:14
  2⤵
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6612,i,4075977968933604590,789415972659673293,524288 --field-trial-handle=2140,i,6418677422133882827,10641717060242460268,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:14
  2⤵
  PID:4692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4696,i,13540258942888713082,5921521483678744957,524288 --field-trial-handle=2140,i,6418677422133882827,10641717060242460268,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:14
  2⤵
  PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4720,i,13307491055082945096,12649963209126327976,524288 --field-trial-handle=2140,i,6418677422133882827,10641717060242460268,262144 --variations-seed-version --mojo-platform-channel-handle=4844 /prefetch:14
  2⤵
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4712,i,7191922551419320539,783495897822791014,524288 --field-trial-handle=2140,i,6418677422133882827,10641717060242460268,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:14
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5568,i,7260718915380034977,15753668986321632703,524288 --field-trial-handle=2140,i,6418677422133882827,10641717060242460268,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:14
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5568,i,7260718915380034977,15753668986321632703,524288 --field-trial-handle=2140,i,6418677422133882827,10641717060242460268,262144 --variations-seed-version --mojo-platform-channel-handle=5648 /prefetch:14
  2⤵
  PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5732,i,16234440796050310867,278196485172489311,2097152 --field-trial-handle=2140,i,6418677422133882827,10641717060242460268,262144 --variations-seed-version --mojo-platform-channel-handle=5604 /prefetch:1
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=4912,i,9546413757966704829,5227333690250200979,2097152 --field-trial-handle=2140,i,6418677422133882827,10641717060242460268,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:1
  2⤵
  PID:1032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6012,i,12179446662097603920,9259036264019528675,524288 --field-trial-handle=2140,i,6418677422133882827,10641717060242460268,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:14
  2⤵
  - NTFS ADS
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,9792341083459821244,9393483939320698841,524288 --field-trial-handle=2140,i,6418677422133882827,10641717060242460268,262144 --variations-seed-version --mojo-platform-channel-handle=5976 /prefetch:14
  2⤵
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6888,i,852534894781158884,6033123730967550437,262144 --field-trial-handle=2140,i,6418677422133882827,10641717060242460268,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4180

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1912

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2100

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:4552

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2444

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:2688

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

108b9c28-0002-406d-ab4e-d59ba7687750.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\108b9c28-0002-406d-ab4e-d59ba7687750.tmp
Size 8KB
SHA256 f1e78a1aef5a3b3e4e277cd9ed5b81904ef1c5e4f53ab6fc93fdb225c822e61d
MD5 77079f8b2331182790d43d96b679a5cf
SHA1 ba93d06b0fbe7a3b2025148464b9e4b60758d6dc
SHA512 62d5c3661135fb02a3b5260275e8ae7d7ce19776cd6f368872cd40294d5ac94c3956e46d1920af3a4e700e1dcd56bc432bb19bbe5f9385c482a0f3be9bf2cbb1
SSDEEP 192:DGNc6KsE7uHQmiUyfaNxuNojzorewN4fX42L626RqCgU6:DGNc6LEqphNxuNw8ewN4fX42JogU6
TLSH
T13112FB366C78AC6B5EE3A595F4473523DEA4812BEEC47F40D6DC2B1C01EF19C134A866
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2cba8643-ca38-4b4b-b33e-25094c96665a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\2cba8643-ca38-4b4b-b33e-25094c96665a.tmp
Size 8KB
SHA256 1975939fefaa9e61d9308282e9902481773a7c724796132004aec098aaac7f3a
MD5 fb7efe99fdd6b1182bd3a77b0c153758
SHA1 f8e39eb896cf9a34442bfde37c3c4a1f0fdf8825
SHA512 1193a0f147fecec9b8bfd9249363f35ff159803c65aa358f3f1db65d02c9cd5897a81a6633d2033213b4548af31af7595ee9286b6b7336dc30208a2467c8adc7
SSDEEP 192:DGN+6KsE7uxQmiUyEUagxuNojzorewNuu96nA6U6:DGN+6LEqP/RgxuNw8ewNZT6U6
TLSH
T13B02E735AC786CBB8FF3AD55F48766239FA4112BEA952F44DAE81B1C40D728C1346827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3d7d5fe6-85ed-4cc6-be18-f011cf7f1863.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\3d7d5fe6-85ed-4cc6-be18-f011cf7f1863.tmp
Size 18KB
SHA256 61a0e753ec9f7c29132908ac2cded9240fd4e679784498f5eb799e9adb49d721
MD5 90d7ce3f499b6a0f1a019e38b89c9637
SHA1 e7b4b5a5784698be70504439cf7ff0d7c772bf52
SHA512 8e9596cc2bdbc9aeb353e8e597edf2bb1c487a6ad8814ca7567e5daa62b901aaadb1ed2fc2c8eeb5af56729628512b39ad93a374f11ffcf67045b056bb87e242
SSDEEP 384:+QkUSv08NRuEEqehlPGuNw8ewN4fX429ogH7vBEIxIIlD:u0lqOesd4flTH75EIxLt
TLSH
T1B4827C72A874AD6B0AF3A650F14A3613EEB4C12BDAD45F80D9DC5B1C00CE2DC234BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

56da3fab-ed01-455b-b0fa-7ee48a7972bb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\56da3fab-ed01-455b-b0fa-7ee48a7972bb.tmp
Size 18KB
SHA256 e2715bf353b7f9ccdfee4cc504850e34e887646d5b7d05bc680632871dc6bb6e
MD5 1fd437e342e48516cf78d5da420a399a
SHA1 2c2b8c0476e040348b8dab7990a3ab474662a5fa
SHA512 43821fa933e2f0ac91c186f22c94dc82c02a53f67b1c5d9e35f16aaef3e6bb49b7fc1eaa4743e76289bd12ecf8e6e5a26db51bd6434dbc557cea11cad2e0626c
SSDEEP 384:+QkUSvs8NRuEEqeMlPGuNw8ewN4fX429ogH7vBEIxIIlD:uslqtesd4flTH75EIxLt
TLSH
T197826B72A8746D6B0AF3A650F5493653EEB4C16BDAD45F90D9DC5B1C00CE2DC234BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7dbcf15f-bb38-4bcb-a7d4-feaf98bcea56.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7dbcf15f-bb38-4bcb-a7d4-feaf98bcea56.tmp
Size 18KB
SHA256 0ddf517b08d418609c619b8f7afc2ec81801564d3a4569322844c5fec048dc6c
MD5 df01fa49a91f0d2850a1aa5cfb81d404
SHA1 0a5b3cda8917f429975bb0ad4ff39acd0e55953f
SHA512 5d81960b2240b9b377a578550abff3d1174b1c797a463bad3ffed31329b282972e443ec5cb5fa3203d52ae9461daef6311fd7b0c3d2f5cd32ea7f00cbcf5bf2a
SSDEEP 384:ZQkUSv08NRrEEqehlPGuNw8ewN4fX429ogH7vBEIxIIlD:70eqOesd4flTH75EIxLt
TLSH
T183827B72AC746D6B0AF3A650E54A3613DEB4C16BDAD46B80D9DC6B1C00CE2DC234BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 83a1e607d50fc1ea413ea3d46f361ac900a5f1b4d5dd4102b2959cbdb2c4cd70
MD5 d57c7e44d35c9cdb36ed14dfab0dfab0
SHA1 8b9d00e4fc1ace8371328737a28deb3bfb8ed61a
SHA512 00b1b35765c219cf319043400cea5573885f0ec520a41bbd3dbea4d771ffe15fb3bc1f53440e052b4e9c0fedc69b2f606d82e0faabbe997cf35324282c5dcc03
TLSH
T11ED02280FBA80230E0323833C3E2C323220AE0E000802EC808E382CE3F22208000FCEC
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 798df09e54df6f20104c3db421e9c171028a1a3e0e66d5471b3e5f70d71b3aab
MD5 a8d604277fa08c1ca035a64d150e5c89
SHA1 0f21b4b451362031a3bad7986a28d45ecaf37f33
SHA512 511b21bc43d186ed2da4a7845c0b0553e5f98ab9d99a323e62613b5d11cf8975342569def41fa657cf266f300f402868edef6111697d02a19b2e4a26ae2a709a
TLSH
T18BD01240B7940520D431243382D082121105909000405A850492418D2E12104000A898
MD5 SHA1 SHA512 TLSH

Submit Download

705f98d4-545c-4798-a1a9-84f91e6b4a56.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\705f98d4-545c-4798-a1a9-84f91e6b4a56.tmp
Size 28KB
SHA256 249d2bb95ec8aee318ee8240df4846549f79cd2c5ed8131253df7fd8b63ff0fe
MD5 447955153f74cae71c042cf1de358159
SHA1 62f02352e7153bc6d05a5410cb8d1f87d57493f1
SHA512 d4b532d5bf4bb95578d523cec41087cc9915c2cc2a4fc58bb4b08867d1afae44f885c9dc83e0f27d355d3393303db977fe987581cb9407745b89abcde31cebb6
SSDEEP 768:/rnh588N24sWRmUUQ6I8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3CrLl/Ii0988roer:/rnh588N24sWRmUUQ6Iu1jaKCrLpI795
TLSH
T1B9D21B3B244CCB7E4FC01E9DDD566F976E9802C766688D4047FA894C02C77EE912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

96c25e17-de03-4875-a97a-a3c6472b3dbf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\96c25e17-de03-4875-a97a-a3c6472b3dbf.tmp
Size 9KB
SHA256 134cc51b557e1489993bfa2e753c994f8b8087a8f3fcdfc6c31d6f694cd082f7
MD5 6e078abadcd2c54a3a05f90d2b710cbe
SHA1 2f37b11c0ac399f4ced8011a951f243a4f1174fd
SHA512 1618c153ab72b1d43ba7a612b707775630a2a038ab652192d873cbcd4d22636e9892e7377d3d4b2c33aac15a37247b2f9e622e6cebaa56476c34fbfb585409b6
SSDEEP 192:sxZfRIOj/fLsoO14fIdpM/W6+WNGY0g6j7XIgrJ:sxZfhj/fLsNhM/bG5D9
TLSH
T1E712B6126E28A93B8CC7E21DFB25BF53D6F9503295D51E48E6FC861C05E66DE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 40a9993551dd29b09951835dd659fd4c9cdf1807efed6e89844a38c2a8d9715e
MD5 fe58ec063c9e3334e253392dbe2065c8
SHA1 e995bffe95c27f123253fa8594debfe68ecd2c7e
SHA512 5cfcfc73828ac7dba2d149b7a265c75965dd5bf5e1ee7fcddf78531e2f0b65a0eb7d32dace1680b5cf3441f83790b15666b52f1b593f417db8c65981d66b328f
TLSH
T141512E61D658B091D7AB71F0FBED128732F6C8A073937F421F56F4B758663909184078
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 487f88238d713da72a17c44c63dba12c6b2cca69594ac7cb3e2f884df88be909
MD5 e1867f7ce88c1e93297062a8a850fe94
SHA1 8add36f1025ee11b86a7bb3191bfb39a1e6a2d9f
SHA512 6a7383bee4cf9e2773ee676a3a96c051f1d356737544c920e4b78ef900b104a5f314e48668e4f09abfb03a78df20592391897f89b31df5327ce2b4837505cf64
TLSH
T14F510C61D658B091D7ABB0F0FBED128B32F6D8A073937F421F56F4BB58663A09185078
MD5 SHA1 SHA512 TLSH

Submit Download

f9df7b56-0c3f-4387-b166-e6da323cdfd4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\f9df7b56-0c3f-4387-b166-e6da323cdfd4.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

e5ac6e80-8ddd-4e56-a2f7-cac8c94af49c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e5ac6e80-8ddd-4e56-a2f7-cac8c94af49c.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

f4a97252-169b-4ead-8d97-7da32852bf12.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f4a97252-169b-4ead-8d97-7da32852bf12.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

f6ce39f1-e08e-4c16-86e9-96a734686013.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\f6ce39f1-e08e-4c16-86e9-96a734686013.tmp
Size 1KB
SHA256 e4f9e03924453a510d703f4eedbbd75231092c82822bb7474f5efcff972d6ad0
MD5 c9360e0e58014b04134f8668b28e55e6
SHA1 1914c87ad6e5bfa04525d60bb49d5eea21c98a49
SHA512 539cb07c24a2602d2e495909e1fb35e95b1ce7ae37c5295ea9ff33e9f3d9844af4f79fdb22e99e72289b3ac2114f8b1a0ca9b2eab6e4ba2d12c759ee9ba9e878
TLSH
T1A921AAF3C3D5866EC90516F06A24BE1FCE2D055542283C1A89D4EF6BE7E3076E14194F
MD5 SHA1 SHA512 TLSH

Submit Download

b61817a3-9349-4c37-b4b4-20dc1772fc8e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b61817a3-9349-4c37-b4b4-20dc1772fc8e.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c2eff73c-1cd4-4e94-aff1-be5718d6bd97.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c2eff73c-1cd4-4e94-aff1-be5718d6bd97.tmp
Size 9KB
SHA256 8390c20b2854bf6c7f90298f3d6bcb4b39cfee572d12d070fcff90b232b2ebed
MD5 4166071852fe1679a5a396c206555daa
SHA1 f7d597cfbe85c18e1cf7385fb5219449c86e8e31
SHA512 8bfad69043fb336a6e9fa20c70aaad2e036c0ff99a2241e00016244d4ca0cf5729863d884f13f5a4d6dffb69f1d8999a5c36566e55845d27fe29499162507501
SSDEEP 192:sxZfRIOj/fLsFOC4fIdpM/W6+WNGY0gUT7XIg5zJ:sxZfhj/fLsJhM/bG51P
TLSH
T16E22B6126E28697B9CC7E21DFB15BF43E6F9503291D51E48E6FC861C05E66CE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e4225edc-d948-47dd-8e41-55de8b6d575b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e4225edc-d948-47dd-8e41-55de8b6d575b.tmp
Size 9KB
SHA256 11f94ac418d52bece248d3eb73262891a06cce0bbfe35f8cc9fd5a438489b0ca
MD5 fb25958f1d1db2fc87cc0c978f0384ea
SHA1 27c705bcbdab01807f1d452aa7d91890ab8351e3
SHA512 2e1576e70852b0fccb53f0cf60ae91cdcbeec5bf76220b77fc1639aed6153333247b4ba2b039d93ea27f753a0914cef30a9b0618daebd5e1135c96b77f383635
SSDEEP 192:sxZfRIOj/fLsFO14fIdpM/W6+WNGY0g6j7XIg5JJ:sxZfhj/fLsuhM/bG5D5
TLSH
T14B22A6126E28697B8CCBD21DFB25BF53D6F9503291D51E48E6FC861C05E66DE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f6b14c16-bf6e-4768-931d-dbb5df5d61bd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\f6b14c16-bf6e-4768-931d-dbb5df5d61bd.tmp
Size 10KB
SHA256 a040757c7111cc0c4501ad354c72d6c96ac16eb2ebd1ebdccc2739cf193f85f5
MD5 5402cec5449c1ca3298d24635be79c52
SHA1 19584418e9dbe0e25b812405ce70473df3fac681
SHA512 dab45c6508b3941585532d21172eb0e7656fd24c6b917d18132c9e13c68a6e1a06f46b39986449e05a239e7d688b8437151900f544c42c3277f0d8f483d103d1
SSDEEP 192:sxZfRIOj/fLsFOC4fIdpW/W6+WNGY0gIja7XIg5zJ:sxZfhj/fLsJhW/bG5QP
TLSH
T1CD22D7526E28693B9CC7E21DFA25BF53E6F9503251E01E48E6FC861C05E76DE220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

96626fc2-04c9-421a-ac05-2047661fd54d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\96626fc2-04c9-421a-ac05-2047661fd54d.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

088ac289-78c2-4d87-b41e-5a559c579b0b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\088ac289-78c2-4d87-b41e-5a559c579b0b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

f7c5cce1-1fd9-4269-939f-385a5f6d6532.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f7c5cce1-1fd9-4269-939f-385a5f6d6532.tmp
Size 21KB
SHA256 d1c5a54c51ca5164af24b864cdb4b185911716d38a55076d16d03d7bde14d499
MD5 c923d87849d31ac9c0701b06948483d1
SHA1 38c0b7984f29d46f411fc1ae9671ac845f6d6d8a
SHA512 6e785b1e7ef18bfdc073293d937d3e46fe3b9a3eeeaea73fc411b3f51ce82852cc0b0368c737780c4611be2fe464c65a9932903e0abe41ec7b6658c2938c4950
SSDEEP 384:wiFtQkUSvk8Nj8TUNTUlIlyEEqeMlPGuNw8ewN4fX42oogH7vBEIxIIlD:LFXkywg8qtesd4fgTH75EIxLt
TLSH
T1EDA24A7398A49D7F5EB39A90F6493217DEB0816BD9D4AB90EACC5A1C00DF1DC234BC61
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3DSeriesGG116.1.0Setup (1).rar:Zone.Identifier

Path C:\Users\Admin\Downloads\3DSeriesGG116.1.0Setup (1).rar:Zone.Identifier
Size 26B
SHA256 eacd09517ce90d34ba562171d15ac40d302f0e691b439f91be1b6406e25f5913
MD5 fbccf14d504b7b2dbcb5a5bda75bd93b
SHA1 d59fc84cdd5217c6cf74785703655f78da6b582b
SHA512 aa1d2b1ea3c9de3ccadb319d4e3e3276a2f27dd1a5244fe72de2b6f94083dddc762480482c5c2e53f803cd9e3973ddefc68966f974e124307b5043e654443b98
MD5 SHA1 SHA512

Submit Download

3DSeriesGG116.1.0Setup (1).rar:Zone.Identifier

Path C:\Users\Admin\Downloads\3DSeriesGG116.1.0Setup (1).rar:Zone.Identifier
Size 236B
SHA256 e690524f3346ec9880071e6c8560aa3379e936f4efb705252f071c41b5fc506b
MD5 a015457e2090c53b6db27af932fb8e96
SHA1 37cae561718a9dd2e3711dd11e74e549333ef244
SHA512 9efe39f63d880fa31b1ceb88678f758b7c08251b4e1671cfeb09be57bb6685cc66d815c72b804237958dc3a87881329db0b14574a28d4cd78ace3ed98bd5fd1e
TLSH
T1DDD02303A104C0E81A133C843B6CC0AD724F9C708F44164A3440C461AC7223ED7BCCCF
MD5 SHA1 SHA512 TLSH

Submit Download

e2fdef81-54aa-4c22-ac33-bbef85b34767.tmp

Path C:\Users\Admin\Downloads\e2fdef81-54aa-4c22-ac33-bbef85b34767.tmp
Size 17KB
SHA256 194c1a865e49d389422592325402e1bf789ff25265df79427055364f18c29f51
MD5 a093bd3f6bd1e66656c6f7dcde6cc9bf
SHA1 b57bd7f96db8a0e6afc946f91fdf32f801485db0
SHA512 1361d410253343d2637e068f3a46380e9cd545408252043aa64d94590dabb1862c53e20f7a5c2992018fbf2e2f74ba8f26fd971459fcecdc07f0a0bb70f1fb89
SSDEEP 384:j0b6AduvtFLHAqjHpBWlMu5HiUN6/JejnZ/x9LxUp8vo+h6Vy:S6AdYZAyHpBW95HrhzZL2oo+h6Vy
TLSH
T15982E1E26ADB4DFED48A280F253DDA077F9C37E510C717582D4264A056F1AD1BAB7130
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download