hxxps://accounts[.]aai[.]aero[.]in/realms/mgmtalpha/login-actions/authenticate?execution=37252a1b-604e-47dc-af35-6925693a796a&client_id=aim-react&tab_id=IY1YlJXQDsE

Analysis

user interaction
yes
max time kernel
899s
max time network
731s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/11/2026, 03:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://accounts.aai.aero.in/realms/mgmtalpha/login-actions/authenticate?execution=37252a1b-604e-47dc-af35-6925693a796a&client_id=aim-react&tab_id=IY1YlJXQDsE
Sample261110-eajk6scf97

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5064	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2101206053-1414382737-268919432-1000\{F9073A62-A8A9-4A1D-91DE-0CA52F5CCFDE}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2101206053-1414382737-268919432-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1828	msedge.exe
1828	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe
1276	msedge.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 1276 wrote to memory of 1480	1276	msedge.exe	83
PID 1276 wrote to memory of 5064	1276	msedge.exe	84
PID 1276 wrote to memory of 5048	1276	msedge.exe	85
PID 1276 wrote to memory of 5048	1276	msedge.exe	85
PID 1276 wrote to memory of 5048	1276	msedge.exe	85
PID 1276 wrote to memory of 3352	1276	msedge.exe	86
PID 1276 wrote to memory of 3352	1276	msedge.exe	86
PID 1276 wrote to memory of 4452	1276	msedge.exe	88
PID 1276 wrote to memory of 4452	1276	msedge.exe	88
PID 1276 wrote to memory of 4452	1276	msedge.exe	88
PID 1276 wrote to memory of 1912	1276	msedge.exe	89
PID 1276 wrote to memory of 1912	1276	msedge.exe	89
PID 1276 wrote to memory of 1912	1276	msedge.exe	89
PID 1276 wrote to memory of 4860	1276	msedge.exe	90
PID 1276 wrote to memory of 4860	1276	msedge.exe	90
PID 1276 wrote to memory of 4860	1276	msedge.exe	90
PID 1276 wrote to memory of 2072	1276	msedge.exe	91
PID 1276 wrote to memory of 2072	1276	msedge.exe	91
PID 1276 wrote to memory of 2072	1276	msedge.exe	91
PID 1276 wrote to memory of 972	1276	msedge.exe	95
PID 1276 wrote to memory of 3448	1276	msedge.exe	96
PID 1276 wrote to memory of 972	1276	msedge.exe	95
PID 1276 wrote to memory of 3448	1276	msedge.exe	96
PID 1276 wrote to memory of 4236	1276	msedge.exe	101
PID 1276 wrote to memory of 1888	1276	msedge.exe	108
PID 1276 wrote to memory of 1416	1276	msedge.exe	109
PID 1276 wrote to memory of 3188	1276	msedge.exe	110
PID 1276 wrote to memory of 412	1276	msedge.exe	112
PID 1276 wrote to memory of 412	1276	msedge.exe	112
PID 1276 wrote to memory of 1828	1276	msedge.exe	113
PID 1276 wrote to memory of 3384	1276	msedge.exe	114
PID 1276 wrote to memory of 3384	1276	msedge.exe	114
PID 1276 wrote to memory of 2412	1276	msedge.exe	115
PID 1276 wrote to memory of 2412	1276	msedge.exe	115
PID 1276 wrote to memory of 4380	1276	msedge.exe	116
PID 1276 wrote to memory of 4380	1276	msedge.exe	116
PID 1276 wrote to memory of 4920	1276	msedge.exe	117
PID 1276 wrote to memory of 4920	1276	msedge.exe	117
PID 1276 wrote to memory of 4396	1276	msedge.exe	120
PID 1276 wrote to memory of 4396	1276	msedge.exe	120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://accounts.aai.aero.in/realms/mgmtalpha/login-actions/authenticate?execution=37252a1b-604e-47dc-af35-6925693a796a&client_id=aim-react&tab_id=IY1YlJXQDsE
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffa66e4c188,0x7ffa66e4c194,0x7ffa66e4c1a0
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2000,i,12773607868337277555,3085530493433281540,524288 --field-trial-handle=2124,i,14023043406062273291,4603641161169175413,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1744,i,12327239355878026308,220632343330512860,262144 --field-trial-handle=2124,i,14023043406062273291,4603641161169175413,262144 --variations-seed-version --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2572,i,4674354275161575695,5643131360862781907,524288 --field-trial-handle=2124,i,14023043406062273291,4603641161169175413,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:8
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,15120192209846375413,8726340886643258565,2097152 --field-trial-handle=2124,i,14023043406062273291,4603641161169175413,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3572,i,7198928628884279861,16867088192197386977,2097152 --field-trial-handle=2124,i,14023043406062273291,4603641161169175413,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4256,i,2269054237958364909,13553515538255536404,2097152 --field-trial-handle=2124,i,14023043406062273291,4603641161169175413,262144 --variations-seed-version --mojo-platform-channel-handle=4140 /prefetch:1
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4396,i,7333199586416364176,16321786312220380833,2097152 --field-trial-handle=2124,i,14023043406062273291,4603641161169175413,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:2
  2⤵
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3416,i,2035509435830903414,16381674001083484856,524288 --field-trial-handle=2124,i,14023043406062273291,4603641161169175413,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3560,i,14299000963267998392,17716402787955142894,524288 --field-trial-handle=2124,i,14023043406062273291,4603641161169175413,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,9363492332096504532,12101103077240614557,524288 --field-trial-handle=2124,i,14023043406062273291,4603641161169175413,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,9363492332096504532,12101103077240614557,524288 --field-trial-handle=2124,i,14023043406062273291,4603641161169175413,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4476,i,806811336025574817,1896425571137665865,524288 --field-trial-handle=2124,i,14023043406062273291,4603641161169175413,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:8
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4504,i,11611529899945354835,11945106261008049999,524288 --field-trial-handle=2124,i,14023043406062273291,4603641161169175413,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:8
  2⤵
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4500,i,11230628526968411065,18139580599284371562,524288 --field-trial-handle=2124,i,14023043406062273291,4603641161169175413,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:8
  2⤵
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,14152707072793798377,14403967550553944183,524288 --field-trial-handle=2124,i,14023043406062273291,4603641161169175413,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:8
  2⤵
  PID:412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6464,i,5675374411555231345,2467749242007809762,262144 --field-trial-handle=2124,i,14023043406062273291,4603641161169175413,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3760,i,16580371905408889182,10742020460963364573,524288 --field-trial-handle=2124,i,14023043406062273291,4603641161169175413,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:8
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,5362662224709133737,3732373294715098903,524288 --field-trial-handle=2124,i,14023043406062273291,4603641161169175413,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:8
  2⤵
  PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,15592644272706837737,6228973492156550121,524288 --field-trial-handle=2124,i,14023043406062273291,4603641161169175413,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:8
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5040,i,7371703483944407943,3374446034876451509,524288 --field-trial-handle=2124,i,14023043406062273291,4603641161169175413,262144 --variations-seed-version --mojo-platform-channel-handle=6476 /prefetch:8
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,12449787408361324259,11996237485750860962,524288 --field-trial-handle=2124,i,14023043406062273291,4603641161169175413,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:8
  2⤵
  PID:4396

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3972

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

021e82b6-9067-4f08-9ec7-9c8689bb6826.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\021e82b6-9067-4f08-9ec7-9c8689bb6826.tmp
Size 26KB
SHA256 d04edfe76e1783cf6fcdb403aa081e30ef0207242590382edf233139adb1f969
MD5 31a37c25788a86345c248c1c63aa1d1c
SHA1 352a46b5b161c43550a7b6a43aa342b052d86e32
SHA512 d493646fc9fb4e5faef7ac80486b516da488a5409c4135f7d0247b6c1c1b2e724f8998a7c5ec47770efdb2f02f86a12fb959b40abd931c2248b2fa4ea4302717
SSDEEP 384:giFzQkUSvVzsNV8TUNTUlIl2aiA+SRp5u8idaObgvaTZcnbtLIIlF:7FdtUwg/Dtkd/gvaTZchLLn
TLSH
T1CBC218F248D7983ADAAE5B13A77D3E038EBCC167F5805A50B789951CCC9A0BFD306911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7479e27a-1643-479d-8bf2-40fd6887daee.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\7479e27a-1643-479d-8bf2-40fd6887daee.tmp
Size 18KB
SHA256 81b0148059ea9dac55766f446b98c64f5c02c66f41af379d2bf10eaa7387acef
MD5 3ed8250f8e25e97af3dd5dba150ba7ff
SHA1 599477e34de1cc20806ef15a8e36bcbbfdef57b2
SHA512 c22ec71fac5abee2f2bfd9cfa3469572e3dceb6f7f6eef39e0ff2af4eaa0ac1bbeb9dcc87d9a42d0b3aa6bd4e55d2315d0a5cb38f93ece5e89d3dcbc65ab2d71
SSDEEP 384:KQkUSv0sNLTaiA+URp5u8idaOEgvaTZcnbtLIIlF:y0rBtkdYgvaTZchLLn
TLSH
T123826C32A878BC7B5EA39561F98E3603CEB48167D7C41F94D5DDAB2C01DA1C9230B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 61a97be736e0441d45644d31b38bd9bef6c1bd260fa1ecbb5d099fa493fee6b4
MD5 99bbd8400adc948f85ebd87cb24b3fcb
SHA1 c8fb9564ede7ecb06cef446bdb527025127a796e
SHA512 75b3ee70eca487cbbfb3d5b4b25bae158ff99188ab36d55f391e9f80c51ce9fa433897d79a0ae37ad64698bc3eb5aa9a10a49116fb8f7f35ed0a6e98aa8321b7
TLSH
T109D022C8F2A0300CE00C3233A02BCE022B88CEA8F0032BCA000E8C80E8800C80CF2C8E
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 87a6b56b3a47cfd9f58f49b21d0040033c8cfd80b50e49b434794cefa7e29583
MD5 74ef2da89fa243ea7d0030317efca192
SHA1 ceb38f6fe8b62f80d617114db8b4617467417ae3
SHA512 285847f78095225db6f446ab877593c3e8e9c642b3beec1b15e7b1eec59d6b2f61ada0e2fb96cf36a3046dbd5102c274473cea5f978ee83b010039a4dc00d05d
TLSH
T10DD024C471D0340CD40C31335015CD011744CD54F00317C7000D4C40C4400C40CF1C4D
MD5 SHA1 SHA512 TLSH

Submit Download

1dee3ecd-ddae-489e-95d6-15d8bb96b070.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1dee3ecd-ddae-489e-95d6-15d8bb96b070.tmp
Size 27KB
SHA256 fd2cbaa0a1454238869db1bd103c40074741693e7a602f0314bd3fbe88b83b90
MD5 03e244544627f7b9dd0cd24ff7ef4ed3
SHA1 e2b8a212a5c0b142b111b77a0090f46fa962825f
SHA512 ebcb6dbf2b1f5311b73f5ae22f4928178b6090c0b22b70b913b8951bbd7e3afea48893ddd916088304ee88039312dbf3d77d4627e1fe81d3073d9d47f100add7
SSDEEP 768:/syQRbrWvvlpZ8F1+UoAYDCx9Tuqh0VfUC9xbog/OVaKLlRXH3Iro3Z7w:/syQRbrWvvlpZu1jaXKLf33z3Z7w
TLSH
T17FC2FA3B640CCB7E5FC01E9DDC6A6F976EA802C766588D4047FA984C02C77EE512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4db50863-bc81-49c1-a5d7-fca66481448d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\4db50863-bc81-49c1-a5d7-fca66481448d.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

67594247-6e84-4ca2-810b-2449cb1d4366.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\67594247-6e84-4ca2-810b-2449cb1d4366.tmp
Size 10KB
SHA256 ca1b7a8049aff94d535e04c6f210fd793442fea8d2c264cc96f8d7984ec20d0f
MD5 a2205fefb76da040c1f011dd216ff6dd
SHA1 e72711721b5f1f1f312ebbdd88f281ad5ab0ea70
SHA512 ac5a4ac6d9f1baf4bf1faa68ae221b16e0cd44f392669abf0345ef80532265bb011be745b5382ca00795acf990b73cc88eaf7986c49b28e8eeb9e24cc0e472c6
SSDEEP 192:sxZCRlWw/f1XstCeVIdpBoHW6+WND8r/YaOVrIIg5YJ:sxZCSw/ftstCemuHbo/Fm
TLSH
T10B22D8116E28B97B8DC7D20DBE55BF53E6F9503291D01E48A6FC8A1C05E7BCE224780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

73b4dbd7-89cd-49cf-859f-3448ca0dccf5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\73b4dbd7-89cd-49cf-859f-3448ca0dccf5.tmp
Size 10KB
SHA256 c78d31f21690801100f75aa7a4a5e42dda7695d23adbe04fd6c43ae71d95966d
MD5 d8a277b23ca2299642dc0c51f879551f
SHA1 3beec91a42bc7d2345f3e38e87b12ff8e5127b3e
SHA512 a0b5e9a929b3cb60fc3f00a539b6a69775417ad58f36dd16655b83658aea992c7854e8786e153e081c459e2561ce931c32405dfe2141b01e971b30b8714dbd3a
SSDEEP 192:sxZCRlWw/f1XsxCeVIdpBoHW6+WND8r/Yad/rIIg5yJ:sxZCSw/ftsxCemuHbo/Gs
TLSH
T17E22C812AE28B97B8CC7D209BE55BF53E6F9503191D41E58A6FC9A1C04E76CE224780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 331B
SHA256 01bb5e6aa69cb2a88122b169bdaf30f224da118ab5eafb33e194dbac94f44284
MD5 7eae4403e0d987ba9393fb32865e60b0
SHA1 c8e2d4ea6da2bc88548a51fa3ac40c065fa32876
SHA512 074a32f538fe6dd03ca3c5dfeb8820decabf53891e01100e5ca1d566c205a28f20ebace7d40f1f38db74d47435dc1b1db4d965e92096134b595b709b794164be
TLSH
T1CEE0DFE42AC8C22EE208B49702A8431CC2C0369B93C8AD8E6B4CC4C97402040A3E2690
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 331B
SHA256 252d3a924f3056e6cf522078d937f1d3603c1084627ce4fdaa8c9f895e31bdff
MD5 01def95ba0d9d6902790cd4222747732
SHA1 a7a3f408bfd5b0df244bf0857a02ebbdbceb6692
SHA512 0da4c5b38925ad6d3efa496f33a62358c7f35ef5058b5c870956b7ef9898beb005c242a7d8ff0d1367523c93a063da61d236048cb661f8e6b774390248e12f85
TLSH
T168E026F82AC8C23FF308A44742A8832CCAE0365B93C8FD0E7744C8C97802440E2A6690
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 5f4783d7a4b3045f69f54ea3d6b60543337025c239dcd8e3b0a1174b65488070
MD5 936ebba726e8b30abf9dbf097840efa6
SHA1 fb6caea2712d218a7e28a9e3f4f23efe7b154e94
SHA512 4885bd597c6d8ce4c3a4fb3f2a16dee3d6272495d799d14bc680a246e6ca4690403326d6489d03f6b69d9417ee1025960296ed41e643205ecbde1b018a8c79e3
TLSH
T125E07DA837E8C22EE33C749703F8630C82C1365AD3C8ED1E3744C4C9740A940F6E2691
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 b583eca8acfcf9387250729594dfff864f8c3564de7a44a3d0250ccbe2ab4298
MD5 64f0ca31577236fe4c4ea3b555ea757e
SHA1 3db29d2bcaf20cd90f36317d3fbb77a58392610e
SHA512 4776ff4d6564d5406c87a1067049423e244fbace53a4c72185225fd51b9e5cd04072ed209b7242d643577a75f71e75df9b66d142c8cccf3ea760f9edf08ea51b
TLSH
T1DF61B38061974C08FB9C647DA3DF39C735348F7189776D410AC6DC78AB26F4F500A2A8
MD5 SHA1 SHA512 TLSH

Submit Download

dbb59cc7-fc1e-440c-bcb3-b0486d21e0eb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\dbb59cc7-fc1e-440c-bcb3-b0486d21e0eb.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

6f9b8a19-0031-488d-b0ff-f9797ea64e52.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\6f9b8a19-0031-488d-b0ff-f9797ea64e52.tmp
Size 949B
SHA256 68eff50095d8bdd12086cfd33b1f2bf27925a1979f25df2a8c82d7cb4980f601
MD5 665505198a58a9d9b314696a83473049
SHA1 846c62c3419c1c08c434401c23f033ddd7f2f858
SHA512 a8934f40c612312d8408bb752a45d4843a4026d98fdc2c415101cf30db5a6e89a2b625d7a9ff7f50b5f7638b88c73f7cd833d3ade3fa52478ce738ca5ff601b8
TLSH
T139117AF3C7E585AE8A1516F05A24AE2BDE2D0606831C7C1989D4EF2BD3E3075E00299F
MD5 SHA1 SHA512 TLSH

Submit Download

c3ad6bdd-a432-40e5-98f2-6ec3496ce7f4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\c3ad6bdd-a432-40e5-98f2-6ec3496ce7f4.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

e08f20b3-5d44-4c37-bdf8-774a4453db49.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e08f20b3-5d44-4c37-bdf8-774a4453db49.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

fa3329c5-b9b0-49ea-b3b9-0820ec87e5b9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\fa3329c5-b9b0-49ea-b3b9-0820ec87e5b9.tmp
Size 966B
SHA256 25892399abe4500daee55f1d0914a540bf9d9406090994f51204380c2e7145bd
MD5 3bf5e29afe593dc85e00e77a93f7e479
SHA1 1f1029cd6091b050f227e2de2ede9a72e66ac10b
SHA512 de7dafd882b5eaeb3cb55dd83f8faead8b5def06299579a227f31ee8a5c3b00493d995cbe91dd4229786ccacdef51ead7d2cd8172cce6e389d3fbd8f9b49ccf3
TLSH
T1E8115BF387E585AEC91516F05A28EE2BDE2D0506821C7C2985D4EF27D3E3075E002AAB
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 1460635e5f909871ed5ac5bc7b148115ee29c2e65de448eace423b7afd5b5319
MD5 251557b035bcc2b8334d5d40e6542d87
SHA1 fa239e1a884dc2714fd55db7e61b818127f84260
SHA512 d12f04bc8a72864bd77f09a075d44dce0aa8eee1d1efa0c675d513329a668a48fcdf57eb932e3b690e60f177f46013eb0219ea5f25ce4bc598a1083a551fab65
SSDEEP 192:sxZCRlWw/f1XswCeVIdpBoHW6+WND8r/Yad/rIIgrJ:sxZCSw/ftswCemuHbo/G9
TLSH
T13622C7126E28B57B8CC7D209BE55BF53D6F9103291D41E58A6FD8A1C04E7ACE224780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1adacc9b-26d6-441f-8c91-36a9b595a034\index-dir\temp-index
Size 960B
SHA256 549017edff0656860630e97eeb5660a83dd19be18b8816116dbe8b8c8ec5c79a
MD5 c7cbc768c0e3f6ce54326548ef02ac61
SHA1 6604ead32649636251ced09e9cc78ad9b7326112
SHA512 588dab4a9f75304f3f726c14ad86afaed3961b45d0ff05082485aac1656c1a88fbb40a98f82d89e909996a71103dbf8641bfe6826540643e5e4b05f7be63fb1d
TLSH
T10F1144C91C035ADBFDA00379207D9C59677111DC13457B4F21BEF1168C67B007E82AB0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\1adacc9b-26d6-441f-8c91-36a9b595a034\index-dir\the-real-index
Size 960B
SHA256 84d8d39d2d611775cc9ac71c98694bb47a10a27e7792ad9dee572f5fd911141e
MD5 344effead2b62428de794f2a8c2b907f
SHA1 c3c29455d014be44091e47b9a3b067c169c7023b
SHA512 8e7113f7c4862ef2c8a6f7ca5c663a7af8f2df05f585d26eae47879cefd91d6f156c2e73896ba5888172ae6dbe93584fdd17a734986e5eb391f38102265fcd71
TLSH
T1D71123A501534B56EC4403B55AACAD4662A680085348774FA3E7E126CC92B846DC3FF0
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 371B
SHA256 fc3a9cbb967c21fdee9aa8c371f813a055022449a9c858509a0d4766081ed0b8
MD5 ea3436d091ab3c845b5f697c9bee99ed
SHA1 80a03cdea38a6fb5b4128552b69a96ef14dc6ea6
SHA512 a1a0530cfcb5ad909517a918ccb79ee9b7762ec8c547daea95aaf5b37840e3bcf6efdcf7b145a60e0336b2baa7b0c508b97d8371517f6df7f7fed4fe49656fd4
TLSH
T1B6E06FBB3EE72800ACBF83E2083140A50006B80489AAED4E502A82C700A13823872CB2
MD5 SHA1 SHA512 TLSH

Submit Download

c748995e-e0df-4f8b-828a-8da8839ee9c5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c748995e-e0df-4f8b-828a-8da8839ee9c5.tmp
Size 10KB
SHA256 33e181d143e7bea65f529401c0a83e3016cd794cb41fe243e9f8ddb211186f55
MD5 23a683eb3c60836ffae8487c8e1750c2
SHA1 96b0422a5ef0d7b19cb180109470de4971dcbc79
SHA512 c6103ef13e254b43a7cbaed52df7613893f961c6e76611d5fbd31a1f84648d5c3fb3203f2713c20fd46a90e67766177fbb2529cf5fae9a8be43c440f71b534ac
SSDEEP 192:sxZCRlWw/f1XstCeVIdp/oHW6+WND8r/YaxirIIg5YJ:sxZCSw/ftstCemAHbo/lm
TLSH
T1F722D9526E28B97B8DC7D20DBE55BF53E6F9503191901E48A6FC8A1C05E7BCE224780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

31769af5-2d73-4edd-907d-ff97d2c72814.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\31769af5-2d73-4edd-907d-ff97d2c72814.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e6f88e6e-35e8-4ee7-9ffa-701a077e5e03.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e6f88e6e-35e8-4ee7-9ffa-701a077e5e03.tmp
Size 8KB
SHA256 62fffaa83c32fc5e0dabe29d6534cd70ecdbf043dd5b7730870c4848e3be417a
MD5 ff15eaad0ecf6db028a49ca7793d1b32
SHA1 27d00f5eceb9385150e34314e0f84ccb4dc074e4
SHA512 78b1187cf38d85de16a668b8d8bf98b627903ac4e13383a229607e1a304f0b50ac7e0f75318e811a823e560266c3731e507f5dc0086dbefb2f8a519ce09dffa0
SSDEEP 192:SONw6iDCQmiUydnHq5u88PdPCvGSqMQ+U6:SONw6/kHq5u8ida2qU6
TLSH
T1D102F9386C287CBB9DE3AD15B58B7B179FE4112FE7952B84C9E81A1C01D768C1703922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2908118a-b08a-4d89-9914-7fea0d3fbd7f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\2908118a-b08a-4d89-9914-7fea0d3fbd7f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

f07bbe3e-ab12-4d34-8c5b-599cc1e3a1f0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\f07bbe3e-ab12-4d34-8c5b-599cc1e3a1f0.tmp
Size 8KB
SHA256 7be96f187ade8a7cc3e795e005567e3a6ab6a48d20b96c7c6fe1447f23a4092b
MD5 633496c3f1cbcf98bdcf530c57160746
SHA1 701396ffb18187f46c4e77aac1d7a797fc97b6c4
SHA512 1082af7589793887e40e46eedf1c075b1d10f80b71657eafc458d149431e6dd1ac985ef56df9f5ae0107242e2ab1e4b0f3f272e3cbfd8523ee8977a2872fc9e9
SSDEEP 192:AONG6iDjQmiUywnjq5u88PdPCvGUet3uZ8qWU6:AONG6Yzjq5u8idaOAgU6
TLSH
T1AD122B35A878BC7BAEE36851F48B36139EB5426BD7886F80D5DC261C01EF59C170B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fc371a33-2a77-4b5d-a871-cd43480529d0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\fc371a33-2a77-4b5d-a871-cd43480529d0.tmp
Size 18KB
SHA256 965bc2ed9988cb4292b2a2e44d3c26bf258ba444dfa740ca4631c742ebff9a8d
MD5 e2905cb0bdbbc0dfab715b3090cf6b98
SHA1 72803349bca156655a4a8a329709d2ce5fd3e686
SHA512 eceb4aa05b1a55983e43f5833f096c3787b00b93b8aaba7a059e130221eb454802cbad714e32db3701f9860ac85e59a7ab666e12f600cd0c9f3a74dfae5cd5b3
SSDEEP 384:zQkUSv0sNL2aiA+URp5u8idaOEgvaTZcnbtLIIlF:d0UBtkdYgvaTZchLLn
TLSH
T1EE827C32A878BC3B5EE3A550F98A3603CEB48167D7C41F94D5DDAB2D01DA189230B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 e0083c082cd52acbe47a814a9d0c19b680f05c8ffcd6aabdb407c3dc08c778bf
MD5 4bfcddcddee57a9388c424376846b0a0
SHA1 9de60a49409eeb85eab51505b2743b9b03a4ac78
SHA512 c4788bbd6d483f6444670e756a90c25db2dc15e68e6892fa9c8fa8f67950c0e6e1bf240fe67a4215fdc3489db74b686a8022ca650c6f93e34f6d781412c56a24
TLSH
T144412A4CBAED1148B3B77E5AAFF6A86D483EB9332F4AD15E10110D4E4A66B40C871737
MD5 SHA1 SHA512 TLSH

Submit Download