cdf01f5bd4aef0a82ba9bd34867c981d882de893425896eb294b8549a96c95da

Analysis

max time kernel
58s
max time network
62s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/11/2026, 19:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
cdf01f5bd4aef0a82ba9bd34867c981d882de893425896eb294b8549a96c95da.exe
Size 59KB
Sample261113-ync54afz9w
SHA256 cdf01f5bd4aef0a82ba9bd34867c981d882de893425896eb294b8549a96c95da
MD5 986b44a01d7e8d4ea4c08a1f0be811f4
SHA1 728f2d6548104578746c0145f71cdbf9654d16b3
SHA512 1fc2db045688a126ce3492e54948a99527e14ab57d2c97e3b5200e9accc5073b63b99529db52083db8e325df15a755d2d66a0fdf52fe71ad2519e97bb59b8029
SSDEEP 1536:PKdTPGdX7Lg3bzXSmxrVmV1kejNUHLi/v2E:CdaX7Lg3bzxrVmfkINX/v2E
TLSH
T148434C043BE89227F27E4B78A9F2114586BAF2737603D69D2CC411DB5613BC5CE826ED
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cdf01f5bd4aef0a82ba9bd34867c981d882de893425896eb294b8549a96c95da.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4580	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-240542094-4193773837-3211495583-1000\{6484908A-16F2-43E0-BDF7-DF0B781AE6FC}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
204	msedge.exe
204	msedge.exe
204	msedge.exe
204	msedge.exe
204	msedge.exe
204	msedge.exe
204	msedge.exe

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
204	msedge.exe
204	msedge.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 2828 wrote to memory of 204	2828	cdf01f5bd4aef0a82ba9bd34867c981d882de893425896eb294b8549a96c95da.exe	93
PID 204 wrote to memory of 4576	204	msedge.exe	94
PID 204 wrote to memory of 4580	204	msedge.exe	95
PID 204 wrote to memory of 1708	204	msedge.exe	96
PID 204 wrote to memory of 1708	204	msedge.exe	96
PID 204 wrote to memory of 1708	204	msedge.exe	96
PID 204 wrote to memory of 3356	204	msedge.exe	97
PID 204 wrote to memory of 3356	204	msedge.exe	97
PID 204 wrote to memory of 4796	204	msedge.exe	98
PID 204 wrote to memory of 2068	204	msedge.exe	99
PID 204 wrote to memory of 4796	204	msedge.exe	98
PID 204 wrote to memory of 4796	204	msedge.exe	98
PID 204 wrote to memory of 2068	204	msedge.exe	99
PID 204 wrote to memory of 2068	204	msedge.exe	99
PID 204 wrote to memory of 4816	204	msedge.exe	101
PID 204 wrote to memory of 4816	204	msedge.exe	101
PID 204 wrote to memory of 4816	204	msedge.exe	101
PID 204 wrote to memory of 2064	204	msedge.exe	102
PID 204 wrote to memory of 2064	204	msedge.exe	102
PID 204 wrote to memory of 2064	204	msedge.exe	102
PID 204 wrote to memory of 4752	204	msedge.exe	104
PID 204 wrote to memory of 4752	204	msedge.exe	104
PID 204 wrote to memory of 2768	204	msedge.exe	107
PID 204 wrote to memory of 2768	204	msedge.exe	107
PID 204 wrote to memory of 3864	204	msedge.exe	110
PID 204 wrote to memory of 3864	204	msedge.exe	110
PID 204 wrote to memory of 3864	204	msedge.exe	110
PID 204 wrote to memory of 912	204	msedge.exe	111
PID 204 wrote to memory of 912	204	msedge.exe	111
PID 204 wrote to memory of 2172	204	msedge.exe	112
PID 204 wrote to memory of 2172	204	msedge.exe	112
PID 204 wrote to memory of 4056	204	msedge.exe	114
PID 204 wrote to memory of 5028	204	msedge.exe	115
PID 204 wrote to memory of 2044	204	msedge.exe	116
PID 204 wrote to memory of 5028	204	msedge.exe	115
PID 204 wrote to memory of 2044	204	msedge.exe	116
PID 204 wrote to memory of 1364	204	msedge.exe	117
PID 204 wrote to memory of 2504	204	msedge.exe	118
PID 204 wrote to memory of 1364	204	msedge.exe	117
PID 204 wrote to memory of 2504	204	msedge.exe	118
PID 204 wrote to memory of 4128	204	msedge.exe	119
PID 204 wrote to memory of 4128	204	msedge.exe	119
PID 2828 wrote to memory of 3948	2828	cdf01f5bd4aef0a82ba9bd34867c981d882de893425896eb294b8549a96c95da.exe	120
PID 204 wrote to memory of 1904	204	msedge.exe	121
PID 204 wrote to memory of 1904	204	msedge.exe	121
PID 204 wrote to memory of 1904	204	msedge.exe	121
PID 204 wrote to memory of 1120	204	msedge.exe	122
PID 204 wrote to memory of 1120	204	msedge.exe	122
PID 204 wrote to memory of 1120	204	msedge.exe	122
PID 204 wrote to memory of 1720	204	msedge.exe	127
PID 204 wrote to memory of 1364	204	msedge.exe	128
PID 204 wrote to memory of 620	204	msedge.exe	129
PID 204 wrote to memory of 972	204	msedge.exe	130
PID 204 wrote to memory of 972	204	msedge.exe	130

C:\Users\Admin\AppData\Local\Temp\cdf01f5bd4aef0a82ba9bd34867c981d882de893425896eb294b8549a96c95da.exe
"C:\Users\Admin\AppData\Local\Temp\cdf01f5bd4aef0a82ba9bd34867c981d882de893425896eb294b8549a96c95da.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=cdf01f5bd4aef0a82ba9bd34867c981d882de893425896eb294b8549a96c95da.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:204
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x2c4,0x2c8,0x2cc,0x2c0,0x2ec,0x7ffe9aa2c188,0x7ffe9aa2c194,0x7ffe9aa2c1a0
    3⤵
    PID:4576
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,3354089428616408931,1398368115387973105,524288 --field-trial-handle=2328,i,2723169763941932388,17956907032739419816,262144 --variations-seed-version --mojo-platform-channel-handle=2364 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4580
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1696,i,14797035056096980351,1572891430017370133,262144 --field-trial-handle=2328,i,2723169763941932388,17956907032739419816,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:2
    3⤵
    PID:1708
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2628,i,6252370332166803434,14910605821885369381,524288 --field-trial-handle=2328,i,2723169763941932388,17956907032739419816,262144 --variations-seed-version --mojo-platform-channel-handle=2764 /prefetch:8
    3⤵
    PID:3356
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,5656590097554714905,6860711905977589561,2097152 --field-trial-handle=2328,i,2723169763941932388,17956907032739419816,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
    3⤵
    PID:4796
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,8869567697269628278,18438904345701736568,2097152 --field-trial-handle=2328,i,2723169763941932388,17956907032739419816,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
    3⤵
    PID:2068
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4236,i,81991046890409350,3867877028683108554,2097152 --field-trial-handle=2328,i,2723169763941932388,17956907032739419816,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:1
    3⤵
    PID:4816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,9880174353167600043,12399186813870847535,2097152 --field-trial-handle=2328,i,2723169763941932388,17956907032739419816,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:2
    3⤵
    PID:2064
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,817659096121465996,17813644299676630014,524288 --field-trial-handle=2328,i,2723169763941932388,17956907032739419816,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:8
    3⤵
    PID:4752
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,15918532223938025564,1938070823621382136,524288 --field-trial-handle=2328,i,2723169763941932388,17956907032739419816,262144 --variations-seed-version --mojo-platform-channel-handle=4628 /prefetch:8
    3⤵
    PID:2768
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5360,i,5011770467607953104,6456457797933180673,2097152 --field-trial-handle=2328,i,2723169763941932388,17956907032739419816,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:1
    3⤵
    PID:3864
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3604,i,18414572126677957833,4332599719091795474,524288 --field-trial-handle=2328,i,2723169763941932388,17956907032739419816,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:8
    3⤵
    PID:912
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3684,i,12266399215801810472,16046359650181781419,524288 --field-trial-handle=2328,i,2723169763941932388,17956907032739419816,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:8
    3⤵
    PID:2172
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,1221688337851367801,1770794124614260956,524288 --field-trial-handle=2328,i,2723169763941932388,17956907032739419816,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:8
    3⤵
    PID:620
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,1221688337851367801,1770794124614260956,524288 --field-trial-handle=2328,i,2723169763941932388,17956907032739419816,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:8
    3⤵
    PID:4056
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,1787781039378919804,3618262255172873533,524288 --field-trial-handle=2328,i,2723169763941932388,17956907032739419816,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:8
    3⤵
    PID:5028
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6216,i,18060234492324969927,18151151075854789084,524288 --field-trial-handle=2328,i,2723169763941932388,17956907032739419816,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:8
    3⤵
    PID:2044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6612,i,15939179067459067021,5078177949176717921,524288 --field-trial-handle=2328,i,2723169763941932388,17956907032739419816,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:8
    3⤵
    PID:1364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6636,i,7588618016119249824,6997033422011242754,524288 --field-trial-handle=2328,i,2723169763941932388,17956907032739419816,262144 --variations-seed-version --mojo-platform-channel-handle=6640 /prefetch:8
    3⤵
    PID:2504
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6472,i,15048577797515602554,358457259204850769,524288 --field-trial-handle=2328,i,2723169763941932388,17956907032739419816,262144 --variations-seed-version --mojo-platform-channel-handle=6408 /prefetch:8
    3⤵
    PID:4128
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6540,i,12628649910375622782,3321442980497511953,2097152 --field-trial-handle=2328,i,2723169763941932388,17956907032739419816,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:1
    3⤵
    PID:1904
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6432,i,4260341799275873196,2719753125034541674,2097152 --field-trial-handle=2328,i,2723169763941932388,17956907032739419816,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:1
    3⤵
    PID:1120
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6364,i,2568714782157204030,10731991482544202468,524288 --field-trial-handle=2328,i,2723169763941932388,17956907032739419816,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:8
    3⤵
    PID:1720
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6508,i,4384684158456313403,123853935806744958,524288 --field-trial-handle=2328,i,2723169763941932388,17956907032739419816,262144 --variations-seed-version --mojo-platform-channel-handle=124 /prefetch:8
    3⤵
    PID:1364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3716,i,17417095287451474243,16339755580769016610,524288 --field-trial-handle=2328,i,2723169763941932388,17956907032739419816,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:8
    3⤵
    PID:620
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3044,i,16131156847873287810,961774965247926354,524288 --field-trial-handle=2328,i,2723169763941932388,17956907032739419816,262144 --variations-seed-version --mojo-platform-channel-handle=4620 /prefetch:8
    3⤵
    PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --single-argument http://go.microsoft.com/fwlink/?prd=11324&pver=4.5&sbp=AppLaunch2&plcid=0x409&o1=SHIM_NOVERSION_FOUND&version=(null)&processName=cdf01f5bd4aef0a82ba9bd34867c981d882de893425896eb294b8549a96c95da.exe&platform=0009&osver=7&isServer=0&shimver=4.0.30319.0
  2⤵
  PID:3948

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:456

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

321bcf09-d7ea-4cf5-aaea-490f0205a1a5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\321bcf09-d7ea-4cf5-aaea-490f0205a1a5.tmp
Size 18KB
SHA256 977cd6d87547d3f95a4d39a4384236f1ff407aea06fe4507ffd4bf0c4040a300
MD5 3b811253d042bfb4c8bc9a2c5646e1dc
SHA1 ca6d813ec764c2118fc3288d1d1570b87d3fb289
SHA512 7393498161e0eb73e44b8874aebc91988e1045bae1df7065885c02efaa1b50b002546e2ddf86f5bfc217356f1af11f8ddfd55c459add6b3421de1c54624aa3e4
SSDEEP 384:n8QkUSv0sNovzbJZE2gHX58EDOJbAWWaV0NH7vBEKc5IIlV:8071l+a4OdN0NH75EX5Lj
TLSH
T180828D70E878AE371AF7A215F14A3B539FF46067E8851F84E5D89B1C00CA39C234BD12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9bd77d0a-d095-42b0-818a-9556dbb8fb49.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9bd77d0a-d095-42b0-818a-9556dbb8fb49.tmp
Size 18KB
SHA256 e542ffebdcf2924f6d0b105c077fb5fa3b7f0525173f71dcd268baab9de7d510
MD5 9486aa621181b50650f0ba67cfa0c157
SHA1 902b9fc8d400c764ec0b1e0f8d621074e648d134
SHA512 48629fab4de6e24029309e7cdebda9bc758b100366b7ae62646b2d6a8d9d4469a27e292934fa641e86a4e686adf90c565d1de6fb2342212f1c8e480fa4ad98ab
SSDEEP 384:n6QkUSv0sNoqzbJZEZR2HX58EDOJbAWWaV0NH7vBEKc5IIlV:i0m1CRQa4OdN0NH75EX5Lj
TLSH
T1EA828D70E868AE371AF7A215F14A3B539FB4606BE8851F84E5D89F1D00C679C334BD12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 58b461967016818ce2213ba739aa830e079c4747cc98baea5feaffc8b09c915d
MD5 8800a672498272bad98dd79644e30101
SHA1 14a42c33d6271869cc680cadc5ae061e7092e3ae
SHA512 a17f90c73859841f3e0a3211d7f8d1027a7f8ec3a4ef87ddc96b1a39e0b52bc65decb3dd694a7092e22f06f2124864535e2e8632387dd42184abe2d3e22d7e12
TLSH
T135D022F2F32200E8C8C02A3C20030B080208C8000C833220C832C0C23ECCBC0A88F08C
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7b81d8521f4289b1259fa60587a7bc7131f06581c3a734224a7de2fe2669bfb7
MD5 46bc1ee7f1b3386bbc305d48ade31614
SHA1 b5e469cf75c16715fb850bd86db01e329da2928e
SHA512 09a97914c725107f4c125aa0ff0826f0410030841011f0bc5c9eed9e023261ab13abc5f59c9c311d02baf1b25e7398de5ea81438c8a8ede3cc60ca3906edfce9
TLSH
T152D022F2B3A208E8CCC02A3C20030B080208C8000C83B320C832C0C22ECEBC0A88F08C
MD5 SHA1 SHA512 TLSH

Submit Download

5e53f8e9-f8e3-4271-afd7-aaae05242b6c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5e53f8e9-f8e3-4271-afd7-aaae05242b6c.tmp
Size 10KB
SHA256 0115ba68356605e91c3ce5b656adea8b6fafe80ba56a49349d311d71c9313b18
MD5 b79bb597ac0c2c013a004361f5ab0219
SHA1 fbbc959a784b39c8a17c669a829809a86a3942e6
SHA512 12766e1439a06f687aac11264f155209ec492b12112c06d084e8f745fbdfb4409b834aea09a94abec42315a5d1b15e51b201629fb5a5f21842ba3af8e9bda47b
SSDEEP 192:sxZpR4sC/fXsVm2xIdpwLHW6+WNHGw/AcrroltIg4J:sxZp/C/fXsVmWHbf/Oc
TLSH
T16522D756AE24A93B8CC7E319BA15BF53D6F91032A5D41E48EAFC891C04E77DD220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8547b91a-5ab3-4139-80fc-59914f96b70f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\8547b91a-5ab3-4139-80fc-59914f96b70f.tmp
Size 11KB
SHA256 c07b5c0d6eb30e52453f893350c4aae41bc0960ce90ed39dddabffd4ca2acd07
MD5 b30d234db3bf5bd78c7c2fac69b8257f
SHA1 f0665bd8d444b50a188c05365f6494ef7dd67170
SHA512 c6fb7f14b53652f890e3716ef480d8c51a471993badaf6cd194197c65c3a1ed6ab2444580f05f26f92890fccb661062994e7a9f4517b2c0d9f82312924db1908
SSDEEP 192:sxZpR4sC/fXsxm2iIdpwxHW6+WNHvFfA7fNZkltIg5TJ:sxZp/C/fXsxnAHbNf1L
TLSH
T16B32E956AE24AA7B9CC7E219BB14BF13E6F5503264D40E44EAFCCA1C05E77DD220741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 8a0d4194cc47a117f33f5173e330638cc09bac72811b5548bb1c5ec3a05153d4
MD5 2b90b894f7e67937a3ece70d8bda6723
SHA1 584b2cc1bbdbd18d99060557b145ab2ab7727df4
SHA512 91d11f84b3094fafd6ced0178d3feec74549e367d82291e8b0ce8a2addafe2e3e72e3dd2fb69e78c819d7a6ea231219a30d0fafec2e44077c0d25332288aedb8
TLSH
T105E080D419C5D65E7305754B019C574CD190765AA7C4694D2725C9C871825C877917D0
MD5 SHA1 SHA512 TLSH

Submit Download

f_000065

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000065
Size 52KB
SHA256 4e0e3943029556e2e696cf6ce4654da71b1d1271a8320d2cbabf5ed110607dbd
MD5 4880b9466f5433f562be07f12854eec2
SHA1 129e61b6ebbd26fd42403fe7b39e70e6b8435255
SHA512 373a050cfff34cb3d37f3d071e4346adf9ccfea1c63ecea6374c8dc41aaed4e9072b5123a66ad5d5be74494efb26e9b4396bb0dd5d057f0f189d4f567f571f82
SSDEEP 1536:aMZ7cHOX4nZ+g4ceLllA4P48V1xga4S/c:aM8
TLSH
T15C33A6A2A20D2E3F433351DFE540AB44B1EFAD36C57520DAF9BF826625E7C40B50A51B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000066

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000066
Size 70KB
SHA256 cb73666d6d56f77a7d1dd1d676625aa38441546b295b7570080e71d5b9aab272
MD5 52936fbc46a42da39256f4b1f89b4acd
SHA1 d64ba18c9b50530f5acab7afab5f400c79876949
SHA512 0c7b707d2d5951e4537c77462dd6d3e6dec341f20d9e0bd6a18c33973d1e49483f972d55cabc58e9b6fc5ef5fb78d4f3f3a6652fc4c5fbd810ff9c759c775111
SSDEEP 1536:tBnYGunpvat4aeKMeO8SB/jLpB15FM6d214DXgciiPH3jM:7YlnY4aeKMeOJLpB15F2liPH3jM
TLSH
T1096302E958828CF121967ED52D79948CF97CDC286006814A8CFF3AD20ED9741759CFEA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000067

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000067
Size 34KB
SHA256 983c35607c4fb0b529ca732be42115d3fcaac947cee9c9632f7cacdbdecaf5a7
MD5 522037f008e03c9448ae0aaaf09e93cb
SHA1 8a32997eab79246beed5a37db0c92fbfb006bef2
SHA512 643ec613b2e7bdbb2f61e1799c189b0e3392ea5ae10845eb0b1f1542a03569e886f4b54d5b38af10e78db49c71357108c94589474b181f6a4573b86cf2d6f0d8
SSDEEP 768:aHBEr/QXnbCgWotMq4AZZivq2/Qu0cEv1FjHBep6U0Z/68R:ahWqbTWiM7ACvdIdldhep4rR
TLSH
T171F2E1E4D0D77EC862C701CD6D1946F3F123C9D19180E52BAFC97B1FA621B1BB06A5A2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000068

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000068
Size 31KB
SHA256 fdde29c3088304098038531aa3cfc38deceda7d8e6af8a09439aa45109a80aaa
MD5 3141fc21987caa861582466db947b39b
SHA1 c364a3bad69e08efa650215c124780281a6fae4e
SHA512 8be3a64bdceeb11ba06830de4359b0570f85ca04a4f3712841cd889a9542e76fbadd5899ff840b3782ddce0cdca5143a70541d9cad57b7569020c0edabdcbf31
SSDEEP 768:SA6rnpz0H6nZn01OZAaTKO6XCzpHOMTIsfec4H:SA6rnh5iOVTgUHTIJtH
TLSH
T173E2E1F1B446759AD32C817BB60DAF3EB91813419C96062704C232957BF5A3D43FA877
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000069

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000069
Size 17KB
SHA256 030272ce6ba1beca700ec83fded9dbdc89296fbde0633a7f5943ef5831876c07
MD5 240c4cc15d9fd65405bb642ab81be615
SHA1 5a66783fe5dd932082f40811ae0769526874bfd3
SHA512 267fe31bc25944dd7b6071c2c2c271ccc188ae1f6a0d7e587dcf9198b81598da6b058d1b413f228df0cb37c8304329e808089388359651e81b5f3dec566d0ee0
SSDEEP 384:4qqZYz7CAda2Qmd6VWWNg9h8XvdkRbdi2nki:1qZYz7Cma2hYNMh8XvdObdi2nX
TLSH
T1E2826EA10F9BEF77C10CBA722C3AA51B7B64EB412F1C3D5B560A1B73CDA6A006CD6111
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006a

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006a
Size 74KB
SHA256 b02775557615ea708e5d495a0172dc8d03d269409f22ee596ff5b59d48832ba6
MD5 70ba37a658246e93348df70f52e81915
SHA1 a30bcd010756e4c12c1ac4fab4887ece0be99d0d
SHA512 730aced05e2191c0bb85aa1ac063d40deebff2b551b9488c8a5e48644f93e4222f39875ab04f70080a10edec329353ebaa9a454c683e6202ce63db1eb56200b0
SSDEEP 1536:Cuf+LvE0BFOKw/UzDGkzoJd2rIUDYHkmJVkEYggbX5p5qVZ7Kc4tc6DN8:CumLvNPSUPRoJgwJqET8VqVVl3qO
TLSH
T1CB7312868797465FC045983240960BBCBB7CFDE4AB3047752EBB4B046E2F3ABA53511B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006b
Size 540KB
SHA256 8e48fc674437bb92bbad84b3884db1e0689c5520c704addae7cac42f0239bc29
MD5 2bc1ea24689907a8f2eaf82a1ec2cdd0
SHA1 a52d2714cbe41b15d985c2e3df3169aa7fd39121
SHA512 98e7614cf5f92d74f6cf57d3836a33e819adc3c67558fc043841e3907238ee6420b060f0c7a5373af423d3943479d897ff8119cbadf712ee4741d3f09224c1c4
SSDEEP 12288:7Iai8JsTxFRfej32YSOqDoGa2Mv/6gJm5klByBREGl:7vVqD2jvnJSKBy7EGl
TLSH
T164C4232E0FD2EC049C675E8FAE859F4613C8862B801190D76E1ADED2B9F11A7458CDDB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006c

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006c
Size 276KB
SHA256 80793fd062e283e91a5081859fbeffcf92714111236d6712ebb162e20c0699d7
MD5 7cf91be8566a2576a6e9688193b5ab9b
SHA1 8abcbe03d6f0d2619a340641f032c3a01f3f52bc
SHA512 0759b83c86ee1d5fdbad9e954c7672194efaaef343723f518533d834712418886b4b0677477204f37cdf0e0b5400c8f48c437e67d1039efc9797fa474bd424d8
SSDEEP 6144:0V9lPvtEIJuopV9WzgP80d77NjIZ3IZt0wS+1TF8IZKF+QP:0V9lPeIJuAG0d77NjIZ3IZt0Zce3F+m
TLSH
T1B3546DBFF7C4306D02071347B945B739B62D0639B2A1D5C6A888E53E11D1FE5C42ABBA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006d
Size 25KB
SHA256 6afb1c5d4885626ea97710131071c056e29fe90f3e364aecae369c5c82add50c
MD5 7be6c50c762edc4fd5e225f40bf7401c
SHA1 910358afc23996a7df8e8c47773ac74fb62299b4
SHA512 4c1cc93ed3c266fc2ccbe17848cae67089dc78949f08494cdcdf7125b36f8b331a961ff1d740c14fc428455b2a36ab9a12ca2ffd35f7233ff5f8ea207d6a3f2e
SSDEEP 768:UFRPcuVboa2yo9tk9Z+CDYbVQxB+2ioVAy9YgO:29b5Pr3cbWxBliuAy2
TLSH
T1E1C2E1338614D6C85F9704767C32BE4AFB20CD99D0EA286C6DD6B53B239C697E073468
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006e
Size 259KB
SHA256 59e014bf44a1166dc5d6000ea8b5849c73d9faf802741ae60950f5b092ce2628
MD5 9a92e39f96405574eb374c8698c53b5c
SHA1 09ac9b51482867633a36860bcc9ba3ccf3fcdc9c
SHA512 81ff124cbb70c80ce8ff755cd79db979daaa9e4b244e0a94b02d3290d0926e8899b60682e6eb04d977ec2086925bcca834e6c7a0d2c43fa45ac9cb18f3c5cbea
SSDEEP 6144:imXLhIXSf1AwuU0VtSDf0Zmsq49PDdIfB92UQg:i0LhIXJTU0V2fURkqg
TLSH
T1C64423731709A2029FCFEBEE1618F0779C9D3D018AB81EA70F1D524F0654AC6AD75A35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_00006f

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00006f
Size 207KB
SHA256 129734e8ff192f3482c4a572ef40457af560761ac68bf3851d259063e3beb183
MD5 818bc256c203dba2a417e1a309e9d1a4
SHA1 b1e54aaaa5b075e30d933dbf355480e5d8a10108
SHA512 0f2b11a74e55cc7b68a9b274824be3a4d34ac70d344b995084451a1857aa6b232a37239f3ea8e64bf426c8b1ed765e6c2850e2d93485b8d4098c4622955fd181
SSDEEP 6144:yCn/Vwd6XNbiVOeWh5kPbBsHkZHFOyJjJ:ndwd2bYODhejB6md
TLSH
T19C2423B65B3C0187086B869A1819BCB6D1DB9337143DA33D73EA67E54CE87B250C76D0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000070

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000070
Size 221KB
SHA256 07a2de3892b933f0e4b871ccdc4ac81d6c47e2fcac83455ff7c4b9a1ad654b3c
MD5 6f3ba254b854b19cecfcb87b2c080ce5
SHA1 91f0755c26e340c6679a5106e26f64c2d416c5ba
SHA512 1da6ca6e1cf34149f263f1ffe663a20f1a4707d43ede9c5e1d8dc63c74d6ad8f19962dee290b81ac96b738a7ed67aba757c01c68a2c8f4327b29e0991a057ce0
SSDEEP 6144:KyUWd13gRNcV59XTtvl30HjCSA2CmtU+NOAhxdl:ZUW8u5tFxM+SA2ciOAxH
TLSH
T1542413C1FADC7AC485618A77B62FED4F5360AF013A0065E403A9E4C6719B538DADD31B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000071

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000071
Size 84KB
SHA256 92b1a66ca055af665a5123eb46f5d736bd430b681c70ece9aa367f2ad42fe3a7
MD5 5c34f4b85326344916dd72fc772458e3
SHA1 050ce9d0767df9fb7eb7afcd65913b0e196a77c9
SHA512 1a2f13ac629ee571c9e1702a4663251520168f8ad734bb39cf5053609f7333582840d4594ddac4ff186922e8360e9ab6c50f40caf86d2c96c51d75164b348758
SSDEEP 1536:OjktOKUOyLlyIF2uywftcfOEsnNgOqTWdExzTPeras+OjoInq4RRZ1h:OcOK0J2uywlcf7rHSsKas+O1q4t1h
TLSH
T1D7830273B26B2AC0B315F49E512B3669D93133F5B97DA8123A3B98C1A430C3CEA4D614
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 3efb032b09c6ff5519fc35812d4cebedf1adbc5d06773da9735febe6993349d5
MD5 26a459b183a1d47f31ced567a4ad3942
SHA1 aff5bca02ad35c8aa37601e6d6a2b401fb815d75
SHA512 b3155c1ab49d67173612d83cf0b2556021e24d218c099f097a3d607bd5eca2506a018d5e37b8b101505a2fe0c15de23573af46c2559ddec67c24dce317b58035
TLSH
T1096182BE865A48D4FF1850F1DED9888B3DB8697D55C38E0A37B4DCB6A8027793404C80
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 0289c023bac26867ace68b51a84f2387d8b57e65880c68bd0b6fb1adaf1155f3
MD5 3669b722be100ccfccf06553edf3bd89
SHA1 0aba66dc1352abafc65bac4fe654e49f0a08239e
SHA512 0e20c1b3b8d9bb529a8e4875e9b4ce38738af43cbce7d3f888c42a1324269a93655cc98cfcd291b7e0e55cbed9ecca2dfc4a6993b2aad53b6ccd2622e0a864c6
TLSH
T16E514FBA454A48D0FF5850F0EEE985873DB8A97D55C3DE0A37B4DCB6B9427797804C80
MD5 SHA1 SHA512 TLSH

Submit Download

b25324dd-0b6d-4e80-8372-c23ce2f5381c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\b25324dd-0b6d-4e80-8372-c23ce2f5381c.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

dasherSettingSchema.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.112.1_0\dasherSettingSchema.json
Size 854B
SHA256 6c69ce0fe6fab14f1990a320d704fee362c175c00eb6c9224aa6f41108918ca6
MD5 4ec1df2da46182103d2ffc3b92d20ca5
SHA1 fb9d1ba3710cf31a87165317c6edc110e98994ce
SHA512 939d81e6a82b10ff73a35c931052d8d53d42d915e526665079eeb4820df4d70f1c6aebab70b59519a0014a48514833fefd687d5a3ed1b06482223a168292105d
TLSH
T1B1014C25C354799B04C7627ABCA95001E630818B027665707DDE4D7C6F2E8A700BF37E
MD5 SHA1 SHA512 TLSH

Submit Download

7565b15e-96e0-4d69-b0a5-0cf55da9da1d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\7565b15e-96e0-4d69-b0a5-0cf55da9da1d.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

85c724f8-904a-4c1e-952b-f7bfc3849b00.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\85c724f8-904a-4c1e-952b-f7bfc3849b00.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

b21997b6-ab2a-4b9d-86bb-6c86cbb51271.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\b21997b6-ab2a-4b9d-86bb-6c86cbb51271.tmp
Size 10KB
SHA256 390ce69adcae3422b094ec1335e501fa86d73ffefe78722983f66efc10fb670e
MD5 7fee8e243b8c46f410d9d1bba02c15fc
SHA1 e9099e8558bab9fe75643c5c9cc4e01ac14d63bd
SHA512 9d5ebdf8962674515253a38cbc8041a12577c11d093ff172a89eb9d96a1d652ae6c1f864e94690c9960fa04b0f875ff81dafad10da814a247fed93267597c2d6
SSDEEP 192:sxZpR4sC/fXscm2iIdpwxHW6+WNHvFfA7fNuoltIg5lJ:sxZp/C/fXscnAHbNfwp
TLSH
T15E32EA56AE34AA7B8CC7E229BB14BF13D6F9103265D41E48EAFC891C04E77DD220741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

caae30e5-3fde-470e-9dba-577a5658f569.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\caae30e5-3fde-470e-9dba-577a5658f569.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ff446be5-cdbc-41d4-97e9-75192cbccbff.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\ff446be5-cdbc-41d4-97e9-75192cbccbff.tmp
Size 32KB
SHA256 51b27ff39367ac153de477e5ef79ab7772b513a035fc0ff41f0926788bd0ab63
MD5 f28f80b9e52536c9b25c1958e5ced331
SHA1 e972e87380a25754faa52504a957838777d673d7
SHA512 9bfd8d59ba6ecb2ffb0bc5df41d730a528adca49bf5df596f5065968a774dc7f5bd9b8818f086472f1fe9799f67efae500f143bbd3693ddb990fa0d322173b7a
SSDEEP 768:8hy4JPm7pLuLn/DWvbtBh8F1+UoAYDCx9Tuqh0VfUC9xbog/OVnHjiLlc2TbbroF:8hy4JPGEn/DWvbtBhu1ja2HjiLm0bovt
TLSH
T1DDE2EA3B780CCA7E4F800A9DED1E7F9F6EA8028B96D8C95047F9945C02D77EA51160DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

da5fd06f-db69-4280-ba8b-2c5a69ae4dc7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\da5fd06f-db69-4280-ba8b-2c5a69ae4dc7.tmp
Size 8KB
SHA256 86ef7cdfe4227c3ff6f6ff71b01526fa2cd6bfabe1a9c410883d82c9ff942a28
MD5 75f7d6605b42b7fed2c13a3515756876
SHA1 9668a9c67c8a53a49ccbeab7c1b5904af33b9fe6
SHA512 501ff0167567b46f6660f8b25149340424f70b3e6a2d5e08e90bdf24063fab1e2dbf36d70420d5b15fd7ef98e44dadd2b3f3073de94ff78a82ef2e4ca1b50e3a
SSDEEP 192:wON56wlDJQmiUyBrA4X58gZDOKaFbAWWarve0qqJvU6:wON56knIA4X58EDOJbAWWaa0NU6
TLSH
T19F120674F478EC372EE6A549F48736539FA520B7E945AF84E6D81A1C00DA79C270BC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e3eb8a46-2cde-41d6-9b42-f14a0905665c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\e3eb8a46-2cde-41d6-9b42-f14a0905665c.tmp
Size 8KB
SHA256 436654947362a9f933c45346571a5139f405854ae80eeceb29b6bdfc45ef2f30
MD5 4b92b88190af32ed39533229bc3261c4
SHA1 7704d154d21a5a3ac5e808b9c2e09012e46d11ed
SHA512 3aa340bea664b583e941d8fd6babe727dd4d15ba42bfaf202208bf7d7c2e5c8198fbf8447e946aea32c7b5204c7f470bb48a14930b002c59ec0cc9a07fa59d83
SSDEEP 192:1ON46wlDgQmiUyZrW4X58gZDOKaFbAIDl0RQUU6:1ON46kg6W4X58EDOJbAs0xU6
TLSH
T13302E835F9787C7B9EF2AE09F58B36139FA4102BE6512F80D6E81A2C00D775C2307922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

62d43009-b597-46f3-b133-4796ed18d4bc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\62d43009-b597-46f3-b133-4796ed18d4bc.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 80edc6b61d7612f3168e5cc273ae545de5c2ffb3d704749eff1bffbabda23f8e
MD5 db51e87537b056c9e151dfbe0487f0e8
SHA1 844044fdd23dbec82c3cceba8b377a8b6700e183
SHA512 ff9328a527fbea91acebd2ffebf0d1278a98654d34232011e232fc561c1f36b46d37cac5f93928f4f72e7c8bb4de008e5f757c479432686c5c0b70ec14d8c430
TLSH
T16B41D468B6EA110CB3B76E5A9BF6A46D887BBC772E06D55D00110E4F0A22B40C971B37
MD5 SHA1 SHA512 TLSH

Submit Download

6f19d6c5-3701-48b4-83b8-2fcab23f5312.tmp

Path C:\Users\Admin\AppData\Local\Temp\6f19d6c5-3701-48b4-83b8-2fcab23f5312.tmp
Size 158KB
SHA256 b9ed630048f4db4b385c1444bc4a83584b89ac02ab5f29b78674000c5220d1f3
MD5 6a456888824db6975276ead91bd8288b
SHA1 64e7a42a1ba47415fdecebcf2db8cf825bd1007b
SHA512 fb1896cfa053053d813a58288e3a19f2529a065fdd7d1d722106927ae0fe01bff7e4973377e86b0774f8b4a11a74ed3786c42c6f06f7f2381896cc1d28d23419
SSDEEP 3072:XlHXFZeHV2ufj0SiBwPl2nUncuaukvdqt+gr0pxStpp3N4HI:V36Hksj0Siylg4cznvdqvr3uHI
TLSH
T18BF3D02C69EAC956C51BA07F7A54F1C7D80A5F0BC20E744F6E8E88144DA470D07B7AEE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aaa7e532-3a1f-457b-8eed-da2ae44b7d32.tmp

Path C:\Users\Admin\AppData\Local\Temp\aaa7e532-3a1f-457b-8eed-da2ae44b7d32.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

365cfaae-d27f-46b8-9283-491862444ce4.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir204_1135189435\365cfaae-d27f-46b8-9283-491862444ce4.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir204_1135189435\CRX_INSTALL\content.js
Size 9KB
SHA256 0d40a5153cb66b5bde64906ca3ae750494098f68ad0b4d091256939eea243643
MD5 3d20584f7f6c8eac79e17cca4207fb79
SHA1 3c16dcc27ae52431c8cdd92fbaab0341524d3092
SHA512 315d1b4cc2e70c72d7eb7d51e0f304f6e64ac13ae301fd2e46d585243a6c936b2ad35a0964745d291ae9b317c316a29760b9b9782c88cc6a68599db531f87d59
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3zEScQZBMX:+ThBVq3npozftROQIyVfjRZGB365Ey97
TLSH
T16212B58DA568ED7D1980C952E10EA62E5D342435E6E7A303108B8D88026CFBAD955FFE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

messages.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir204_1173063895\CRX_INSTALL\_locales\en_CA\messages.json
Size 711B
SHA256 2445cad863be47bb1c15b57a4960b7b0d01864e63cdfde6395f3b2689dc1444b
MD5 558659936250e03cc14b60ebf648aa09
SHA1 32f1ce0361bbfdff11e2ffd53d3ae88a8b81a825
SHA512 1632f5a3cd71887774bf3cb8a4d8b787ea6278271657b0f1d113dbe1a7fd42c4daa717cc449f157ce8972037572b882dc946a7dc2c0e549d71982dcdee89f727
TLSH
T1460197136240AF18470BF05BB9023442A0B44AC62384E0B775EC982C6656DAFB20B3B0
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads