hxxps://email[.]sg[.]on24event[.]com/ls/click?upn=u001[.]7kf5QUY4LGF7Fzt7LGE4bbbVijomlGJQ3qvHKTMPKLmR1BM-2FccBez26wXBqVIouXVbv2_9r2n-2BG5CN-2BoXh0AeOmRNe2TXPRBhPBjPQ4CrrVTwW8gVmedFW9R9QIvlz0zUZ-2BNy43mBjAP0p2vo0MCasrHRaVBfC-2FccRg8Yd4jObhXGUI93hRuuUAy8A8hNiL-2BIiAAbvvHlFB03bu3I7jFoPS8zo-2BFIPMkUiT3ewhZj-2B0hCnpO1tNoSuzFQ-2BX-2BiGEKw7j0tCeoHR7hvvCmjad1yaWBFdTO0sUQ-2FNiQgdsgGC4zXHbsiHEjaI6dIVVEaNE7BpQwdiuhalnoLaQ8K8U08BJQIY-2FZ9cJxRbPKm-2F8ObDBCmgDHj56sJCi2E6oeDIYtKNnKwdPokYWBMUScT-2Fo3-2Busj9NQ-3D-3D

Analysis

user interaction
yes
max time kernel
694s
max time network
651s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/11/2026, 10:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://email.sg.on24event.com/ls/click?upn=u001.7kf5QUY4LGF7Fzt7LGE4bbbVijomlGJQ3qvHKTMPKLmR1BM-2FccBez26wXBqVIouXVbv2_9r2n-2BG5CN-2BoXh0AeOmRNe2TXPRBhPBjPQ4CrrVTwW8gVmedFW9R9QIvlz0zUZ-2BNy43mBjAP0p2vo0MCasrHRaVBfC-2FccRg8Yd4jObhXGUI93hRuuUAy8A8hNiL-2BIiAAbvvHlFB03bu3I7jFoPS8zo-2BFIPMkUiT3ewhZj-2B0hCnpO1tNoSuzFQ-2BX-2BiGEKw7j0tCeoHR7hvvCmjad1yaWBFdTO0sUQ-2FNiQgdsgGC4zXHbsiHEjaI6dIVVEaNE7BpQwdiuhalnoLaQ8K8U08BJQIY-2FZ9cJxRbPKm-2F8ObDBCmgDHj56sJCi2E6oeDIYtKNnKwdPokYWBMUScT-2Fo3-2Busj9NQ-3D-3D
Sample261110-mrrl4ssset

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
216	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1846164713-4096795028-774071693-1000\{FAFDA060-2A7B-47EF-8973-B9C455E765DA}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1846164713-4096795028-774071693-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3724	msedge.exe
3724	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe
2980	msedge.exe

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 1388	2980	msedge.exe	87
PID 2980 wrote to memory of 216	2980	msedge.exe	88
PID 2980 wrote to memory of 208	2980	msedge.exe	89
PID 2980 wrote to memory of 3008	2980	msedge.exe	90
PID 2980 wrote to memory of 208	2980	msedge.exe	89
PID 2980 wrote to memory of 3008	2980	msedge.exe	90
PID 2980 wrote to memory of 3008	2980	msedge.exe	90
PID 2980 wrote to memory of 4768	2980	msedge.exe	92
PID 2980 wrote to memory of 4768	2980	msedge.exe	92
PID 2980 wrote to memory of 4768	2980	msedge.exe	92
PID 2980 wrote to memory of 3612	2980	msedge.exe	93
PID 2980 wrote to memory of 3612	2980	msedge.exe	93
PID 2980 wrote to memory of 3612	2980	msedge.exe	93
PID 2980 wrote to memory of 1548	2980	msedge.exe	94
PID 2980 wrote to memory of 4332	2980	msedge.exe	95
PID 2980 wrote to memory of 1548	2980	msedge.exe	94
PID 2980 wrote to memory of 1548	2980	msedge.exe	94
PID 2980 wrote to memory of 4332	2980	msedge.exe	95
PID 2980 wrote to memory of 4332	2980	msedge.exe	95
PID 2980 wrote to memory of 1860	2980	msedge.exe	99
PID 2980 wrote to memory of 1860	2980	msedge.exe	99
PID 2980 wrote to memory of 3152	2980	msedge.exe	100
PID 2980 wrote to memory of 3152	2980	msedge.exe	100
PID 2980 wrote to memory of 3068	2980	msedge.exe	102
PID 2980 wrote to memory of 2224	2980	msedge.exe	110
PID 2980 wrote to memory of 2224	2980	msedge.exe	110
PID 2980 wrote to memory of 2224	2980	msedge.exe	110
PID 2980 wrote to memory of 2164	2980	msedge.exe	111
PID 2980 wrote to memory of 2164	2980	msedge.exe	111
PID 2980 wrote to memory of 2164	2980	msedge.exe	111
PID 2980 wrote to memory of 1164	2980	msedge.exe	113
PID 2980 wrote to memory of 1164	2980	msedge.exe	113
PID 2980 wrote to memory of 1164	2980	msedge.exe	113
PID 2980 wrote to memory of 2512	2980	msedge.exe	114
PID 2980 wrote to memory of 2128	2980	msedge.exe	115
PID 2980 wrote to memory of 3808	2980	msedge.exe	116
PID 2980 wrote to memory of 1804	2980	msedge.exe	118
PID 2980 wrote to memory of 1804	2980	msedge.exe	118
PID 2980 wrote to memory of 2628	2980	msedge.exe	119
PID 2980 wrote to memory of 2628	2980	msedge.exe	119
PID 2980 wrote to memory of 2628	2980	msedge.exe	119
PID 2980 wrote to memory of 3724	2980	msedge.exe	120
PID 2980 wrote to memory of 1048	2980	msedge.exe	121
PID 2980 wrote to memory of 1048	2980	msedge.exe	121
PID 2980 wrote to memory of 1048	2980	msedge.exe	121
PID 2980 wrote to memory of 4812	2980	msedge.exe	122
PID 2980 wrote to memory of 4812	2980	msedge.exe	122
PID 2980 wrote to memory of 3536	2980	msedge.exe	123
PID 2980 wrote to memory of 3536	2980	msedge.exe	123
PID 2980 wrote to memory of 2176	2980	msedge.exe	124
PID 2980 wrote to memory of 2176	2980	msedge.exe	124
PID 2980 wrote to memory of 3508	2980	msedge.exe	125
PID 2980 wrote to memory of 3508	2980	msedge.exe	125
PID 2980 wrote to memory of 4776	2980	msedge.exe	126
PID 2980 wrote to memory of 4776	2980	msedge.exe	126
PID 2980 wrote to memory of 4776	2980	msedge.exe	126
PID 2980 wrote to memory of 2224	2980	msedge.exe	127
PID 2980 wrote to memory of 2224	2980	msedge.exe	127

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://email.sg.on24event.com/ls/click?upn=u001.7kf5QUY4LGF7Fzt7LGE4bbbVijomlGJQ3qvHKTMPKLmR1BM-2FccBez26wXBqVIouXVbv2_9r2n-2BG5CN-2BoXh0AeOmRNe2TXPRBhPBjPQ4CrrVTwW8gVmedFW9R9QIvlz0zUZ-2BNy43mBjAP0p2vo0MCasrHRaVBfC-2FccRg8Yd4jObhXGUI93hRuuUAy8A8hNiL-2BIiAAbvvHlFB03bu3I7jFoPS8zo-2BFIPMkUiT3ewhZj-2B0hCnpO1tNoSuzFQ-2BX-2BiGEKw7j0tCeoHR7hvvCmjad1yaWBFdTO0sUQ-2FNiQgdsgGC4zXHbsiHEjaI6dIVVEaNE7BpQwdiuhalnoLaQ8K8U08BJQIY-2FZ9cJxRbPKm-2F8ObDBCmgDHj56sJCi2E6oeDIYtKNnKwdPokYWBMUScT-2Fo3-2Busj9NQ-3D-3D
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b0,0x7ffe3612c188,0x7ffe3612c194,0x7ffe3612c1a0
  2⤵
  PID:1388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,621121366219962495,1180806341531172097,524288 --field-trial-handle=2464,i,1383345431206935609,8862677539742494432,262144 --variations-seed-version --mojo-platform-channel-handle=2500 /prefetch:3
  2⤵
  - System Time Discovery
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2292,i,4856471433452355230,12006307543444989464,524288 --field-trial-handle=2464,i,1383345431206935609,8862677539742494432,262144 --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:8
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,6746078127258374379,8758927822561989781,262144 --field-trial-handle=2464,i,1383345431206935609,8862677539742494432,262144 --variations-seed-version --mojo-platform-channel-handle=2460 /prefetch:2
  2⤵
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3504,i,13122598199503593451,7721624431389226834,2097152 --field-trial-handle=2464,i,1383345431206935609,8862677539742494432,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3508,i,11865340972012650554,11363874629949041463,2097152 --field-trial-handle=2464,i,1383345431206935609,8862677539742494432,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4256,i,4301187628492080290,6911614884993078902,2097152 --field-trial-handle=2464,i,1383345431206935609,8862677539742494432,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:1
  2⤵
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4316,i,8245839810772203750,69540881776693649,2097152 --field-trial-handle=2464,i,1383345431206935609,8862677539742494432,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:2
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3640,i,3115871949407148388,17916935639902760038,524288 --field-trial-handle=2464,i,1383345431206935609,8862677539742494432,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,3849810955474851668,12591710387253471775,524288 --field-trial-handle=2464,i,1383345431206935609,8862677539742494432,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,6877828529586905824,9379984622042418419,524288 --field-trial-handle=2464,i,1383345431206935609,8862677539742494432,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,6877828529586905824,9379984622042418419,524288 --field-trial-handle=2464,i,1383345431206935609,8862677539742494432,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6224,i,660514420405885980,16418384895608630564,2097152 --field-trial-handle=2464,i,1383345431206935609,8862677539742494432,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:1
  2⤵
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3588,i,6981581868599501419,1210014475630710823,2097152 --field-trial-handle=2464,i,1383345431206935609,8862677539742494432,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:1
  2⤵
  PID:2164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3704,i,13718265060285282569,9378297130279540864,2097152 --field-trial-handle=2464,i,1383345431206935609,8862677539742494432,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:1
  2⤵
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4272,i,3947322059297654545,7694909029689721445,524288 --field-trial-handle=2464,i,1383345431206935609,8862677539742494432,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:8
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4344,i,6200217222911136723,11589600375606441553,524288 --field-trial-handle=2464,i,1383345431206935609,8862677539742494432,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:8
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4496,i,12474583752238974370,4576073163003441453,524288 --field-trial-handle=2464,i,1383345431206935609,8862677539742494432,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:8
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4440,i,2064925400854409932,17696373884947882942,524288 --field-trial-handle=2464,i,1383345431206935609,8862677539742494432,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:8
  2⤵
  PID:1804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5952,i,12059664427520115081,7451263640469883795,2097152 --field-trial-handle=2464,i,1383345431206935609,8862677539742494432,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:1
  2⤵
  PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=760,i,2304690055403068085,5586533912162399996,262144 --field-trial-handle=2464,i,1383345431206935609,8862677539742494432,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6168,i,15996175224583750952,6008216316390810750,2097152 --field-trial-handle=2464,i,1383345431206935609,8862677539742494432,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:1
  2⤵
  PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4480,i,13189669496731979326,8777951675876977620,524288 --field-trial-handle=2464,i,1383345431206935609,8862677539742494432,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:8
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2692,i,9815778695428731283,3513683525317001304,524288 --field-trial-handle=2464,i,1383345431206935609,8862677539742494432,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:8
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,11014872954073820386,4188884698540243253,524288 --field-trial-handle=2464,i,1383345431206935609,8862677539742494432,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:8
  2⤵
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5576,i,1854396627894960241,9946859550509876923,524288 --field-trial-handle=2464,i,1383345431206935609,8862677539742494432,262144 --variations-seed-version --mojo-platform-channel-handle=5480 /prefetch:8
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=1520,i,6959183040457001025,13074518863441080990,2097152 --field-trial-handle=2464,i,1383345431206935609,8862677539742494432,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:1
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5480,i,16331591403423968955,8539346186826417869,524288 --field-trial-handle=2464,i,1383345431206935609,8862677539742494432,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:8
  2⤵
  PID:2224

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2064

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

03d32dbd-84e5-4cb8-9049-7e341a9ea726.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\03d32dbd-84e5-4cb8-9049-7e341a9ea726.tmp
Size 18KB
SHA256 60dd0192c831ec7bb1b22a75be9978b604eba35d5b7559a4cc88fea57044efe7
MD5 0f18935b295917f541c2d17787ed8364
SHA1 aa51fd142d292a277f21e4e606f1782aa6894db6
SHA512 24b543b1fb30db1edd07c294be27d964fd25439008fb72dcc4212fd4a2e6fa421aadcc41e1f2801cc0836f21c1ba8fa217efc40a18acb546a8d29ff8865f9543
SSDEEP 384:fQkUSv0sNtbXiB2XQX5+DtwO01gLJrAlWvaTZcDH7IIlt:h0ShQkDmOfLhAlWvaTZcDH7Lb
TLSH
T1E9827D32A8A9AC374EA79690F48B3247DEB09123D5C86FD0D5DD6F2C01DE79C234AD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0f4a7d31-9476-449a-92f2-e40f47e809a6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0f4a7d31-9476-449a-92f2-e40f47e809a6.tmp
Size 18KB
SHA256 9751cc304f30853e4193ca4b987e8a26f81757b47f3d117a67f6103c11feaf4d
MD5 daf9b98f1c72815caa380a8241724355
SHA1 a490d32f671ffc9dae3d9a0b00ce0d44a96d1534
SHA512 0432c73e503449f2aed16b5929fce097097df0968a7824717acd93e1c15fe67c7e89bc7396a89ef6fd4902c526a171379e5f7a8cbca54ff996734b08b1a138f5
SSDEEP 384:sQkUSv0sNtKXiB2XQX5+DtwO01gLJrAlWvaTZcDH7IIlt:s0phQkDmOfLhAlWvaTZcDH7Lb
TLSH
T180828D31A8A9AC374EA79690F58B3247DEB09123D5C86FC0D5DD6F2C01DE79C234AD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6d589943-7cf7-4a9d-95b4-ec64bb1cf1d3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6d589943-7cf7-4a9d-95b4-ec64bb1cf1d3.tmp
Size 8KB
SHA256 5203077d78ddd467be42554b7fdd4fef80c66655570cf817d3cfb989af759deb
MD5 f6adc6abc194529e0ca269dd77c682ec
SHA1 64f1b317fb8f45f7fcb941d84722dd2a8c56138f
SHA512 f2235130cdde7839ba01f3ada810e3cf6d101ff73c3da3e87c60a186c37b4f8a3eef107188705121c7d6f0f29339d0bc0f8f47acac76f801619f934a42b032bd
SSDEEP 192:EONk6nnHGQmiUyQ8QYcX5hQDP1wO01KMcO7U6:EONk6nCUQNX5+DtwO01yoU6
TLSH
T1B702EB34BD787C7B8EF39E45B48737176F952127E5946BC0D6E81E1C00DB65C230A922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 d11bd63a3c8c3641d5bd4407fbf20115daee67c3050695788e54c8df9585c700
MD5 7aa846396cdcfea376b8811e8e19c8ac
SHA1 ec25e76211c784e758c9892460a28903222a2b23
SHA512 4816b3d9d1883ae78008726282d2a4c42f9b30d81ff004d60af22873868f3ccc332adb8973ee5a1ed3fdec5d56a832c2ead1cfe30616125d07466daec4eaf02f
TLSH
T17DD02203FF038A2CC8C00CB2002EC22C0F8AF8000A00B2C08030328BCC28B00B02EC88
MD5 SHA1 SHA512 TLSH

Submit Download

091b58c8-4187-4a17-a396-824f7a486b23.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\091b58c8-4187-4a17-a396-824f7a486b23.tmp
Size 9KB
SHA256 7f8425ea46463f7b9e9ae0bf400d674dda84b0125c37a8a66d8e15ee1b1c0e22
MD5 121adf9d0735a5ebd7f8b436c7c0c291
SHA1 ad0c9f1bab7a116ebddb2397c5f0d9a63d7219f7
SHA512 68bd94cb6355098c1cabb45d620bee12b0306ca4a005beaddc7b7bfcdeee3357c53fce744602711086ecad0296cb0f09e73f401e38a24a705790c28dcacca448
SSDEEP 192:sxZxRFWT/fgsbqIdpJHW6+WNGYYBX8VUIgrJ:sxZxmT/fgsbjJHbGf/9
TLSH
T1B512A6116E28B97B8CCBE209BB15BF43D6F95032A5D41E58EAFC961C05E7ACD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

25672f35-9af4-4cb7-8f64-ce685da2356f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\25672f35-9af4-4cb7-8f64-ce685da2356f.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

614e86cb-d786-4765-9ea1-515e9066b53d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\614e86cb-d786-4765-9ea1-515e9066b53d.tmp
Size 10KB
SHA256 844e1787631544d89e4215409183a6e4419d54c326228b7bf29b9be9758153d0
MD5 a081d139dfd081a574a4eefc73770053
SHA1 c5305e08b83fca8bd6bdc5d5a3d3b49523c63fc2
SHA512 b431b97f0d36bfa454475f295083e32fa13015d433ad90e02cfef1ccfaa4796a8c8502e742de14cae2d44f453642545fef73f30ce95e8e08ae780baed53a8514
SSDEEP 192:sxZxRFWT/fgsXnIdpgAHW6+WNGYYBeeVUIg57J:sxZxmT/fgsXo1HbGfGL
TLSH
T14822B7526E28797B8CCBE209BB15BF53E6F9503291941E48AAFCC61C05E7BCD124780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9b7754ae-fdd8-49db-8b12-74dbd40224b2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\9b7754ae-fdd8-49db-8b12-74dbd40224b2.tmp
Size 9KB
SHA256 0d5c7720c28e1549023d6bb6bf01ac35de12c1011f78c19e671799049032b4f0
MD5 88cab186faee126bec6f92dae1528c7d
SHA1 f522e52c5d35708d85667c42794f32655759ebe2
SHA512 e4a655519096834bcb68ea84bc7fd27f9b632da8516f530af528443c474b32c7376dc5db327dda90e52b70812c42d04b5a9b1d1036d5c7e122f83f36bf4b6da1
SSDEEP 192:sxZxRFWT/fgs5nIdpgAHW6+WNGYYB18VUIg5BJ:sxZxmT/fgs5o1HbGftl
TLSH
T1D622A6526E28797B8CCBE209BB55BF53D6F95032A1941E48AAFC961C05E77CD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 4c1283b97df23bc05bb069ac7b050e3535546070b8331ad67f9f77f15ffde34b
MD5 e8e36dc8ff9daa68d8079b0737b6c7b2
SHA1 0735e50a1a55f0b00b875f002030aa840ca83565
SHA512 f386e6383f2c7dded51195c2ae9995ab60dd95f96e3911426d9abb4c32599fb4b489d59fb458670c00eb142ae25750e9d066317959671aad944a0e88483b420f
TLSH
T14EE0208C66D5C31ED30865470394B34CD690269FD3C4A90E2F04C8C5710194467B16EC
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 ccc9d70ef027a179c4204da271f0b0d97aab8f4bd9d4304b3e85e9a1ca1385f5
MD5 afedc6fbb54e68f6416f10884c5b558a
SHA1 303e72252cca331d264907201bfb7c7a56c4c206
SHA512 1c28c2b0fc535290a525893b2aa176da197fc364ba21b9a7645355e8b09988858f81503e8799f815744801c31cb25043dc83402bf75dbfc3071e2f70f12a5104
TLSH
T1BEE0268434C8C22EE31866C742E8535CDBC52A5BA3C0698F2704CCC77085A40F3A6790
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 b601e09402aa76fcf99d796fd560562bf5de2ff5d17b2102c7672924394ab7b3
MD5 b00c3a2c249095a3a668b84c6abc8a8f
SHA1 385fbbd1b61893a67d7eebce13e5b9d7d6d285dd
SHA512 a2dca71f86561cb9de9170ad7718b14b591d2a398403d0d4075b649d4fd71e307cac9205d1b51704c7566411fc3f4e6f5be33c3e68ae09a3043e56bfc3c56bc8
TLSH
T150E026D535C8C22EE748668B03EC930C9B88261FA3C0AD8F3700D8C97681A40A2A6692
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 1KB
SHA256 cf1b4ecc5d97111360ed356b1cd0a9a5f96be1e087042e682d926c67ed6d9e46
MD5 7b41f49964cf532a86f206fb72574a9f
SHA1 a993fbc802ddc6d2852bdf8eb3d480817956cc3f
SHA512 a4b137fa71c6e06a3a68b490a30e01b8b072f17fcb8087d621c471ba1a029994b19cb0a123e3cc1e6bd98be1131102bb95b423e74f924ec7d58d50793ad65c8e
TLSH
T16B41CC00DE907355FBE40675AEC41EC37AB69EAC91431F013EB8C1BA6A8FB5B7140C54
MD5 SHA1 SHA512 TLSH

Submit Download

8852b539-44ed-40f4-b3cf-b782bb3e9202.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\8852b539-44ed-40f4-b3cf-b782bb3e9202.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

02c2c6bd-207e-46f3-b6d2-fc8e013b155c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\02c2c6bd-207e-46f3-b6d2-fc8e013b155c.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

15159f5d-1454-4c8f-94cc-93534ff754c4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\15159f5d-1454-4c8f-94cc-93534ff754c4.tmp
Size 949B
SHA256 d68692a665d45683aec50c7025d1eeee165f937611b8868b05f5718d53945a18
MD5 2d221301766ceb3c7b6ef945b1685475
SHA1 679ee6fa33608984ddae31774dce41d9a140b359
SHA512 ba6f9b412bf4af427089214357d08133aad52da0cabad220ff09da43036cbce1e36d4e1bf643d960fa4ea3ec5270e765f95910d1567e7579ef7d24712dbffba2
TLSH
T1A8117DF3C3D5956EC90556F05A24AE1BDE2D0505421C7C15C5D4EF2B93F3075E00195B
MD5 SHA1 SHA512 TLSH

Submit Download

6f7ca8c3-77fa-4a7a-a424-451908db0eda.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\6f7ca8c3-77fa-4a7a-a424-451908db0eda.tmp
Size 966B
SHA256 9521254620ab164c33b21a724759502586fa940c41de39b63a7900cca0c3c0a4
MD5 069262fc5c9c24aa188f1a7c5d5e252d
SHA1 2692b2a4f1f557869914703cc50f4685bf0b3f63
SHA512 29a1f3371b9d2da88f3df85ba7d4222ec0775773e015879f27900ccf801932ef2ae45e7c57220d547732dc645e662c0a2da96b4897295f84bfe6d542fd9297a7
TLSH
T1BB11BDF383E1865EC91116F05A28EE2BDE2D0506821C7C2989D4EF6BC3E3035E102A9B
MD5 SHA1 SHA512 TLSH

Submit Download

d8ed8c57-8e09-47f3-927d-e4b3333f6421.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d8ed8c57-8e09-47f3-927d-e4b3333f6421.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 f0da69856c7f95072eaca62158cc5cfd2278e66e18af72f2769bd03981b080bf
MD5 bb8ee6f50016a304ab76278511d76e85
SHA1 d352a42d6e1730399e429f7c41a5cd903f19aec6
SHA512 f88679353610bbb2ff14d36cfca5a2a81a9fc655849454098bccdc42a3f2590344c26da67dedd534d638f24769b21bcba445d7eef0c81eb138968e73715608c2
SSDEEP 48:KglEZVnTHIbbcLq2EGqTba5iISuTK9K1oTxMDYBSqwyLdcRtfLPwbD2jISlwK9lW:Kg5T2KIUCyOgKv6MUAKd2e
TLSH
T1DD91F146306B124039FE258D41B5AA5A42513273301DE9FFBFBD48A65E2FE440DFE8E9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b268287d-6998-4dc2-92c2-000077e2d834.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b268287d-6998-4dc2-92c2-000077e2d834.tmp
Size 10KB
SHA256 ee279cce4a9df8f8fa9bd7b88c24a4e30788d31d37576bd3d66a7153fc963e3a
MD5 50d1bb1118d4d91903891e300e703d8c
SHA1 7061805eb60dae1cdb43bd2a8a1ad703274b549d
SHA512 8df0f5d3d87398d010e13de4c29e16746aba6fd07e8e54e5141d1c0238b9aa8b06aa12970b2a69c892d04dbf29d2134b0599d3c272e00657b3de4f69de0caae1
SSDEEP 192:sxZxRFWT/fgsXnIdpuAHW6+WNGYYB+NMUIg57J:sxZxmT/fgsXo3HbGfGL
TLSH
T16A22B6526E28797B8CC7E20DBF15BF53E6F9503291941E48AAFC861C05E7BCE124780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e1594389-44ae-408d-a80a-84dc06c22941.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\e1594389-44ae-408d-a80a-84dc06c22941.tmp
Size 27KB
SHA256 676b89594043457dfb4821124fa7cab9078402f1225113089703ac6f4375ab62
MD5 9e29d0f3ac9bd1db7f09d5bc3132b943
SHA1 807f72ec50094aca071591cd5fcf3efc2b7ee6cd
SHA512 4510460f1671b275a049ab322e4d5ef7733d5d7906d49b3a7e6a36b338c6c57af3145432093b8bc62c891d23ed36476a64568a2d4b78187d7071ae6a8f6f69bf
SSDEEP 768:bUyYR7jWv3NpB8F1+UoAYDCx9Tuqh0VfUC9xbog/OViCLlGcvXIropTxp:bUyYR7jWv3NpBu1ja/CL8OXzx
TLSH
T143C2E93B640DCB7E4FC01A9DDC5AAF9B7E9802C796548D4047FA944C02C77EEA12A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fdf04697-5800-4c7d-8f0e-5f2dcc202c9a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fdf04697-5800-4c7d-8f0e-5f2dcc202c9a.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

a7d30af2-9972-4b31-bf0d-1ea163e6487d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\a7d30af2-9972-4b31-bf0d-1ea163e6487d.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

be05793f-c033-493f-b207-0493b74b7249.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\be05793f-c033-493f-b207-0493b74b7249.tmp
Size 21KB
SHA256 f69b292037951078af00d69724e27c35edaadc959e9fd815b63b7e17b497385d
MD5 26364a9a583cddea7fe168101661b62a
SHA1 17c52f14ca4413cabd310274eddd050b06a13980
SHA512 cbf571f30620f7d6f5ba619d8e4e7bdc05650778dc52fb8de20426779b962d809ffb45c67b2b9407f14d432cd263631aa55bc9de43ae19f1916b32338237e9e6
SSDEEP 384:SiFzQkUSvezsN38TUNTUlIlKXiB2XQX5+DtwO01gLJrElWvaTZcDH7IIlt:ZFd++wg8hQkDmOfLhElWvaTZcDH7Lb
TLSH
T14AA26C339898DD3B9EA79B90F54B3207DEB15163C9C4AAD0E7C99E2C01DB2DC234AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d026d27a-326c-4417-af4d-a6bbfc75e95f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d026d27a-326c-4417-af4d-a6bbfc75e95f.tmp
Size 8KB
SHA256 46f9b5e21ed72208343df0f7853a7822abe05e2060d80c9d7d0829f05f0886b0
MD5 ec97fc0d2386b6c8ee78b11188e29520
SHA1 fc600cf2bd7a368d1c351e71f152f9505ab716ce
SHA512 f0d1937ed6e1739e698aabc9ec85102108d707e8ec1aee79e12391940b4d718072ce4f9b00d7b982ffcc048f6e65ed087788b18e0bcc45aeec5ef4a3fb43e06f
SSDEEP 192:hONg6nnHpQmiUy58lYcX5hQDP1wO01g8SJrNg3uq5WU6:hONg6nn/lNX5+DtwO01gLJrSlWU6
TLSH
T136120B35A9A8AC3B5ED29595B08731179EA55227D6897FC0D5DC2E1C01EF7AC230DC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

08f8010e-bd8b-42ce-8bec-1ddd7194702f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\08f8010e-bd8b-42ce-8bec-1ddd7194702f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 50e40cfa03961cafaa00314c33cb6b3482ff60bc5638d375d386459403519076
MD5 5750c1b42dcc410cb2b9b98d8b9f9f30
SHA1 837c39900fecc0c6794c6d7dcd93f73a7856c56f
SHA512 44d18b522c542e6fc0aaf74a05b6f39ca7f6e900239703caff99f7fb99d215f052b1d935aa31e51bf42cb0fc66363db8fdce6d120728770c95aa317819e50693
TLSH
T1CC410748B6FD1108B3B76E465BFAA9AE587BB8372F46C45E00110E4F0626A40C961B37
MD5 SHA1 SHA512 TLSH

Submit Download