hxxp://sparkmaids[.]com

Resubmissions

15/04/2026, 17:39

260415-v8psvaft9m4

15/04/2026, 17:38

260415-v7shcaft8p4

15/04/2026, 17:36

260415-v6j5kshx4w4

15/04/2026, 17:35

260415-v58rjshx3x3

Analysis

max time kernel
149s
max time network
149s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260130-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260130-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
15/04/2026, 17:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://sparkmaids.com
Sample260415-v6j5kshx4w

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 22 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4972_935039475\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4972_626551351\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4972_626551351\regex_patterns.json	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4972_1597695019\keys.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4972_1597695019\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4972_1309852156\deny_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4972_1309852156\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4972_626551351\autofill_bypass_cache_forms.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4972_1597695019\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4972_1309852156\deny_etld1_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4972_234573878\crs.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4972_234573878\ct_config.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4972_626551351\v1FieldTypes.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4972_1597695019\LICENSE	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4972_626551351\edge_autofill_global_block_list.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4972_234573878\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4972_935039475\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4972_1309852156\deny_full_domains.list	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4972_1423135548\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4972_1423135548\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4972_234573878\kp_pinslist.pb	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3620	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134207481832055962"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-262299150-3324607021-1566776428-1000\{70019754-C717-4199-B83F-EF93E8EC62D2}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6052	msedge.exe
6052	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 4 IoCs

pid	Process
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe
4972	msedge.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 4972 wrote to memory of 3096	4972	msedge.exe	84
PID 4972 wrote to memory of 1264	4972	msedge.exe	85
PID 4972 wrote to memory of 3620	4972	msedge.exe	86
PID 4972 wrote to memory of 1264	4972	msedge.exe	85
PID 4972 wrote to memory of 1264	4972	msedge.exe	85
PID 4972 wrote to memory of 5604	4972	msedge.exe	87
PID 4972 wrote to memory of 5604	4972	msedge.exe	87
PID 4972 wrote to memory of 344	4972	msedge.exe	89
PID 4972 wrote to memory of 344	4972	msedge.exe	89
PID 4972 wrote to memory of 344	4972	msedge.exe	89
PID 4972 wrote to memory of 5732	4972	msedge.exe	90
PID 4972 wrote to memory of 5732	4972	msedge.exe	90
PID 4972 wrote to memory of 5732	4972	msedge.exe	90
PID 4972 wrote to memory of 1564	4972	msedge.exe	94
PID 4972 wrote to memory of 1564	4972	msedge.exe	94
PID 4972 wrote to memory of 1564	4972	msedge.exe	94
PID 4972 wrote to memory of 5112	4972	msedge.exe	95
PID 4972 wrote to memory of 5112	4972	msedge.exe	95
PID 4972 wrote to memory of 2860	4972	msedge.exe	96
PID 4972 wrote to memory of 2860	4972	msedge.exe	96
PID 4972 wrote to memory of 5536	4972	msedge.exe	97
PID 4972 wrote to memory of 5536	4972	msedge.exe	97
PID 4972 wrote to memory of 5264	4972	msedge.exe	99
PID 4972 wrote to memory of 4644	4972	msedge.exe	104
PID 4972 wrote to memory of 4616	4972	msedge.exe	105
PID 4972 wrote to memory of 4788	4972	msedge.exe	106
PID 4972 wrote to memory of 2528	4972	msedge.exe	111
PID 4972 wrote to memory of 2528	4972	msedge.exe	111
PID 4972 wrote to memory of 1460	4972	msedge.exe	114
PID 4972 wrote to memory of 1460	4972	msedge.exe	114
PID 4972 wrote to memory of 5804	4972	msedge.exe	115
PID 4972 wrote to memory of 5804	4972	msedge.exe	115
PID 4972 wrote to memory of 1828	4972	msedge.exe	116
PID 4972 wrote to memory of 1828	4972	msedge.exe	116
PID 4972 wrote to memory of 4420	4972	msedge.exe	117
PID 4972 wrote to memory of 4420	4972	msedge.exe	117
PID 4972 wrote to memory of 6052	4972	msedge.exe	118
PID 4972 wrote to memory of 1984	4972	msedge.exe	119
PID 4972 wrote to memory of 1984	4972	msedge.exe	119
PID 4972 wrote to memory of 1624	4972	msedge.exe	120
PID 4972 wrote to memory of 1624	4972	msedge.exe	120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://sparkmaids.com
1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x274,0x7ffe575ec188,0x7ffe575ec194,0x7ffe575ec1a0
  2⤵
  PID:3096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,17782092478744226959,14740997444883659134,262144 --field-trial-handle=2440,i,874433224005609188,10091630303883528378,262144 --variations-seed-version --mojo-platform-channel-handle=2388 /prefetch:2
  2⤵
  PID:1264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1784,i,13904092803741716017,5760882715458526963,524288 --field-trial-handle=2440,i,874433224005609188,10091630303883528378,262144 --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2644,i,16971769474321546885,7211231015973952114,524288 --field-trial-handle=2440,i,874433224005609188,10091630303883528378,262144 --variations-seed-version --mojo-platform-channel-handle=2628 /prefetch:8
  2⤵
  PID:5604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,3402629023875653222,17031526560403460829,2097152 --field-trial-handle=2440,i,874433224005609188,10091630303883528378,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,4414261100027632360,14046170258883050682,2097152 --field-trial-handle=2440,i,874433224005609188,10091630303883528378,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:5732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5032,i,12828064288644657201,8818555985273651091,2097152 --field-trial-handle=2440,i,874433224005609188,10091630303883528378,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5592,i,12612468249621911827,4631149454526234665,524288 --field-trial-handle=2440,i,874433224005609188,10091630303883528378,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:8
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5344,i,9034037668968241209,17965107144752913633,524288 --field-trial-handle=2440,i,874433224005609188,10091630303883528378,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:8
  2⤵
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,15509494344502588631,4401846863365906828,524288 --field-trial-handle=2440,i,874433224005609188,10091630303883528378,262144 --variations-seed-version --mojo-platform-channel-handle=5528 /prefetch:8
  2⤵
  PID:5536
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,8143593018006143766,14520044090582924839,524288 --field-trial-handle=2440,i,874433224005609188,10091630303883528378,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:8
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,8143593018006143766,14520044090582924839,524288 --field-trial-handle=2440,i,874433224005609188,10091630303883528378,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:8
  2⤵
  PID:5264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,8431418558187259319,7336031939861974952,524288 --field-trial-handle=2440,i,874433224005609188,10091630303883528378,262144 --variations-seed-version --mojo-platform-channel-handle=136 /prefetch:8
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6064,i,17765720482863282848,2296975662915837729,524288 --field-trial-handle=2440,i,874433224005609188,10091630303883528378,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:8
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6044,i,15662889894340438439,6552469120774124196,524288 --field-trial-handle=2440,i,874433224005609188,10091630303883528378,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:8
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5704,i,17571980350999447153,3420684962356538689,524288 --field-trial-handle=2440,i,874433224005609188,10091630303883528378,262144 --variations-seed-version --mojo-platform-channel-handle=5808 /prefetch:8
  2⤵
  PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,8214364118175784131,10959180915277590186,524288 --field-trial-handle=2440,i,874433224005609188,10091630303883528378,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:8
  2⤵
  PID:1460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,12421138756849156715,17636685674152010033,524288 --field-trial-handle=2440,i,874433224005609188,10091630303883528378,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:8
  2⤵
  PID:5804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5996,i,14245259378465022650,4910488235282368943,524288 --field-trial-handle=2440,i,874433224005609188,10091630303883528378,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:8
  2⤵
  PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=808,i,1594258020900926338,13635492790647473346,524288 --field-trial-handle=2440,i,874433224005609188,10091630303883528378,262144 --variations-seed-version --mojo-platform-channel-handle=2132 /prefetch:8
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5804,i,14574168131545869481,16106955923711281811,262144 --field-trial-handle=2440,i,874433224005609188,10091630303883528378,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,9962970988525571988,10809118835264793750,524288 --field-trial-handle=2440,i,874433224005609188,10091630303883528378,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:8
  2⤵
  PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4780,i,1591001934190924718,11519352417573931229,524288 --field-trial-handle=2440,i,874433224005609188,10091630303883528378,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  PID:1624

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5476

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0ce3de864fc029de1185f15a333c36ccc857bab064d704c1c9cb74f2d49559c6
MD5 95e4fa06728773c204126766fa6a3f91
SHA1 b2b2ff6dd17d9d1fca4c1aa1d226d00b195749be
SHA512 11564019829fb23fd1b38faa2fb3c3298ba02394920b54be1169d3ca923ae73304fcdfa9ca88adaeddf4fa314022ecd93085a2ea4ef7973e86e12e5d7e562c19
TLSH
T10ED0806C17B17C31E099967015C57B05656DD46B5D474B15A4F2383C2C530409E560C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a0dd682e82aa8cd6159af27b9fe9796b85ae32d8c3b7a54ca83c08e7258a7175
MD5 2ed58da04906706bb0da862e8e7185b5
SHA1 3c5218714f1830b95877032ae59a91505796d0f3
SHA512 c1694efeb33c2b30e89769d925a4ac7923301aa37e527971ebc442ad3c0800bfdbcade111c6abe3c94cf362ebe4febbfe65aa0c3ad7f46f25d381ebed28c5a41
TLSH
T197D0806817B17C31E085967015C57B05767DD46B5D474B15A4F2383C2C530409E560C7
MD5 SHA1 SHA512 TLSH

Submit Download

1e135872-00d0-4e7a-bb8b-583c7382e86d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\1e135872-00d0-4e7a-bb8b-583c7382e86d.tmp
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 fa62411ca3e87e84897e134786618035ec9ced1f425bc0342288bca1e4444b0c
MD5 9a106f3b7aad2a0aa90353396f607da2
SHA1 4e960819d1649a0676d1dcda843b8b51759c6df6
SHA512 de1e0df0e4643d4784487a2bbf6ac84c823244e3329876b66bf561806f82747c9a391b79e0cc5b8ee052312d9887b085dc5a990d2116da4073ea893a5e0bc904
TLSH
T18DE02BAADC25DC3709FD0759A1504746DF61130B2690590F7F3D92094FB163656D5C5C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 00155f35c4a63c24c85dd12ac1c8a5aa4f292090396509573c61a8ad888d4a12
MD5 1f2ff076db88dc06f7408da5ec5dfd13
SHA1 74920203b24e230dd4abf4f2f0d92d66848739ef
SHA512 b4424848b9a723f5bd12bef6be3637ba72f7f59209cd6573972219492b41fce3b527e84d28baa1d493c217ffb92185ca9ba37cf4ef5e0a7bbd64ebf5a2be838a
SSDEEP 96:7FoLtxVASg/lOSrhnTe8nauRUrQppBv1sRt6j6JQovfp/NzxKZ2Wicf+C+UpZSaW:cfkltrh3nRu6fs2SNefBfPJ+
TLSH
T1D8A1E58511AB866DEBD440BCF1DB18C87A73C5E8D8420F5715F57ABC8EA66A36070CB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5862eb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5862eb.TMP
Size 3KB
SHA256 52aadac89bb68e4e8c333ea18757b82da4928bcaf51e7a2b6c8ca113ac37ab9c
MD5 a9ae9f34649e6e72e100f114e6d03604
SHA1 31529c8be3d28fb1372bde0ce40ca95f0b56d6b9
SHA512 e92452b4e8505cc9ba51e1bbb465cfc8c6904baf320ad7b66c6676522f526593ef4f94dd0e3c6089ad3dcc8325c43965d8ea3431215cf46482c614cdc40dd225
TLSH
T1E471B1C8159B86AEE3E041BCF6D710D072B3C5E4C0460F6B21F1BABD8E85A638064C73
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 ccb2ed4834e152a1abb164c5c43e695fef2040b449405bc51084bad0106fa2ac
MD5 0faad1a36938e4157b472414bf3ef1ac
SHA1 678b351aa6bffcb15c099d6e313b9f6bbb38403b
SHA512 95725138b556acc423ce37d7a9d0af0c687b87b580baf47868407887f100ff0ed17e0519e1958f64235bed6edd9dabaaf0c5a9350d62a33dec4efe97c1b9035b
SSDEEP 96:D1tOm3mJC6a2zBZvLBH/hMGZp5Vbqj6FiZNcdxKuwDCLQ:D1Am3mJC6a21ZvdH/hMGZp5pqj6FiZNN
TLSH
T1C8B19DF383E4871ED91251F1AB256D1F8E5E082843687C5784F4EE8B67D2472F28064F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 17KB
SHA256 4c7aa02511ac0568f37c5cb25c38c57211b971670a8882811f6f76d04cbc5603
MD5 7f0dd6c03501e1c1af26e590c0385794
SHA1 e8d7a0c64c73e6b15c3b92b98da5034c21a38181
SHA512 58d81c422748a5a136fdd5b97e434ea3f98d1518a7f4ccd668995c728a0c313e52da22ef9a19bbf54365c1b61d010c9e618c6c20303677b069dbfec9ce053b9d
SSDEEP 384:sxZp5q0A2/fpsFafzUC4OcHbr/evq+3hS:sBg0d/fcacHbTevq+g
TLSH
T1D582D716AA388D778DD7D219F941BBA3D7F5052392904E44AAFC8B0C04E7AEC711382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 235a521f62a487eaebe6cc03eeb7beb050297c6bf2cf7714bf23b5485efc2e16
MD5 8c27b547cdc73728c4a00bab75889e41
SHA1 c9b03257daaa26dd9b748b394f415b0eeb38cfe2
SHA512 3b97ea0ad42a95b9524cdc7ecb795508b95efd224e1cc6cf79931e4ad9e04b02641efb419b4d5963f094f42737c277f87e504ce6d0846cf0e8291333b837c027
SSDEEP 384:sxZp5MA2/fpsxA4fzUC4OcHbr/evq73jE:sBmd/f8HcHbTevq7Q
TLSH
T13B72D6166A388D778DDBD219F945BBA3D7F5052392904E44EAFC8A0C04E7AED711382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 877de3a3c5d4c83d4b07cddc46137b98db214bb4952e3462fa1ee36c55446019
MD5 2745617ab30048dfbbf32af62fc522cc
SHA1 5783c06aaa4804119dddfeb482ec6a0dd401a800
SHA512 583bf295bf0e584ccff54de9b8c21c9522008ef4fa39c71afbaf315ac8c8006ec030aa78a5632de04e33397933b5ea41fedda0e541aec245b3a1c7b6d7897cc0
SSDEEP 768:z0sjWCv7pLuL/OmWvOKPC8F1+UoAYDCx9Tuqh0VfUC9xbog/OV6j+xLlx72BUroY:z0sjWCpE/OmWvOKPCu1javj+xLjyB/KT
TLSH
T175F2FA3B780CCB7F4F805E9CDC2A7E8E6DE8018B9698895447FA884C03C66EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 e67e2c857e86bfb0c8a1a12606fdcd7285295a7f6479381001f076b1cc58fa3c
MD5 0dd418f88a014d4f3cb1b4a7e5dd66e6
SHA1 28abadcbc81e62440ef67bf13447cf20694e7040
SHA512 f3837f208fe28fb1a5129aac02e06c982212df64621305202771494c99b0306071c02f8415956f7f17b8ec7b4b15d55dad38f324c3e2b640542461b805246985
SSDEEP 384:0YzynHlp7hB4zK3G28XOi8eOType6AwnsxksBqy:0YzynHlp7hB4zK3G28XOi8eOType6AwE
TLSH
T189B21410317A42913A7EB9CA95E5B42E52C334737419E82B7BB940A64F67E20CDFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\dcaajljecejllikfgbhjdgeognacjkkp\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 c2fee3c754b80693a11c1863ace903712fb725b134550cd23efa901e4e1c270f
MD5 f0c8bf002b1ef8f5e7253d64384665c6
SHA1 557f6aef4f6cbe3e45c92ede971c3c529e271e9e
SHA512 9e9b3a6bdc3d2ff0a6bd4a4b72ec39ec8f2f045fa9ba3ee4d17df239eb2b8a5c16210bae2623b2e3b685ec9a193e7190f90a9dc67d4c9289bcebad6c3bf44eba
SSDEEP 384:nppiFavqMg3sNC8TUNTUlImkrbPNmucl4feY4LL3Mr6xv3RYV/Vw1mRRCe0yrN1H:pAFayv3lwgDYYQ3MG13RYk1mP/0OH
TLSH
T14AC25B36E894CDABEDE64FC9E7493A07DEE0416BDA8C4AD4D6D81E0D00E719D530BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 011ac7cc108bbcd7344ebe0a9c654174e0f75da09b41b3943786576b90393efb
MD5 605a83d3ab67c24abf85807b7b6136db
SHA1 d66bc8228f76045f0bb79764ebf3418ad56ee08a
SHA512 0e1675ade46bca59c3680930c07d093af6a74fe2c9167c563eef74b08f19b11f71815bcf34482b4364c8847e1b11e4cab03dcae8b5618986701d7468426170b0
SSDEEP 384:nJhiFJjccCs+Bt0S3Fg3sN88TUNTUlI4kdbPNiZJQlZfeY4LL3Mr6xmXil0Dwv/Z:JIFJccQm37wggLYQ3MG4ilXRsiP/
TLSH
T1BCE2B2F194D38976E9AE4B87A33D2D429AFCC153B5885A94F7D81D0CCC861BFC30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 0440a079196349c0d8434c2291c3241fe25b6b31db9da0601e0d2af4c0839486
MD5 27fcf9ca431e6dbb779cb962fdb5a629
SHA1 53e3b4e0e489aa9bc0bca95ef95758ef8eeaeba5
SHA512 895b04919467b60faa3f9699312d720746710405bc2646164f96b147136b00f27485f6ea2d362f7c609feb5bc723b02b0f9720461d0728afc1918421f7a3a8fb
SSDEEP 384:n6piFavqMo3sN88TUNTUlI4k3WbPNMxJQl4feY4LL3Mr6xmXQl0Dwv/RvEurN1ka:6AFay337wgv0YQ3MG4QlXRsiF
TLSH
T18FC25B32E8A4CEABADE64BC5B30A3643EEE041678ACC5AD4DADC1D0D00D71DD534BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 f8af4369c19a3a686a369fb08507d9949da2833fe7033893ef460375f9a5692b
MD5 067ede3e22f264cb54a11b838b4f5692
SHA1 6c8382f650e62d28f913cfba7b36ad4921b1f7a0
SHA512 896f4e2ae8d60f7234291df645a06c31d2d74d85df29abfe71a36f51e811c85a2705b3a6eb5611e182653fba1fee65991da99ce26e472103878c54475042160e
SSDEEP 384:n6piFJjccCs+Bt0S3k3sN88TUNTUlI4kdbPNixJQl4feY4LL3Mr6xmXQl0Dwv/R/:6AFJccQE37wgg0YQ3MG4QlXRsiP/
TLSH
T1ACC24B32E8A4CDABEDE68BD5F34A3643AEE04167868C5AE4D9DC5E0C00971ED434BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 a96e49077b576ba79f04d0cfe05655520fa1c5d7b76c69c8f1c8fe761a547af5
MD5 b07409f47832d1d22abea7481dc2511f
SHA1 dc9b79f11d177faed16c866d47bc71b5ceb8d44a
SHA512 2db23ee98f2811ee5d5eaddd0266162635e9effe45290262b0473678b6c31b4a20bacedcf039a4c166e9167c6cc27cb8db40658498c3c182177644b5220f17b8
SSDEEP 384:nRpiFavqMg3sNo8TUNTUlImkrbPNAu9l4feY4LL3Mr6xmXllRYV/Vw1mRRCe0yrH:RAFayv3LwgD/YQ3MG4llRYk1mP/0OH
TLSH
T1D7C25B36E894CEABEDE64FD5E7493A03DEE0416BCA8C4AD4DAD81E0D00D71AD530BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 af6db5a756a1d9ff7193eb86e4384ae68156e059ad7266b8f57eca459c7571cc
MD5 296818ec58799d6156046ab47666f0e6
SHA1 28e4088feaf46ab87d47649bb92a7d1f44383a8a
SHA512 b13cb16a340ed3f90215a6a130b0b9ed43e49963a8b2fbff283ee91c82c33a40b797f1f28895285f6975129ef95229bb302c258fb72b7dd938a98ddac293590e
SSDEEP 384:nJpiFJjccCs+Bt0S3k3sN88TUNTUlI4kdbPNixJQl4feY4LL3Mr6xmXQl0Dwv/R/:JAFJccQE37wgg0YQ3MG4QlXRsiP/
TLSH
T150C24C32E8A4CDBBEDE68BD5F34A7643AEE04167868C5AE4D9DC5E0C00971ED434BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 dc04af59ec92707c35518d88e9f50dd2056a58e2c614ff1beedc15be61a3e175
MD5 046d07f1f0eb8901d730ed22b647c299
SHA1 072c2bcc0807c953f4d168eadf701f56aff2124a
SHA512 5cd8c7bebcfd07a47253a4668a650f650162d7456f4756ead3b37a25c22d2daa9248280cd005b83ff68bd515b331022836c450066f14d7e17b18f0905dcf455e
TLSH
T13E414FE04C3D26D2E0BD1A7F709B38FC95DCC72AF568347D2828DA98063A51E648443F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 33cf7f83736999b8900c0e00ce45b22544ace1deaa920d58535e32ee6c2b5247
MD5 0c56f8e1ffff2c38624107f174949e95
SHA1 4029373ecba02f8b3bd12f435dfc6ce00fb7f32a
SHA512 6c110112d82420782ad51410c12580525cbb403324cf3066d51853fc9073fe3b3dcf930eea689ad9c33819a3871659c56b810ea95076b1076fb8cfb532ee35cc
TLSH
T1B74160E14C3E2AD2E4BD0A3E749B38FC95CCC72AF5B4307D2824DA88063A04E244443F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 808796e0fc9cb59fe6ae90b16d1eaaeaf87e30ae28de3da6dcda729381dc9abe
MD5 147c15dade0fb52b73b46b9288fe85fd
SHA1 cad0480fc05c023a74bbe9e1c85a9344160b1e2c
SHA512 b22dddf077df9962b26035afc6ecf9aad6407cf09e7aa033ec8176a1d44e79f52b19034855d3e4e3c33e23bc56311bb718ee6e237d8207953a0909e18576f28f
TLSH
T1D1415FE04C3E2AD1E0BD0A7E749B38FC95CCC72AF9A4347D2824DA88063A50E248443F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 b6a602edeeb2e13c5c3bbcc99b41ccdb6fe6f0ef54511470e346d041d1b00173
MD5 6911ca0bf4ad9896f0a06efe17e83a98
SHA1 2ca0558d16c55a43a15e07113ccc0a8b3ba0a080
SHA512 10acd7de65dfdfbd0283d3f80a9a6c355d70c6c1809211b6acaf80356973a0e5c212884fcd7ab0d07c21b45178026f1a2cbbe7a6bc7cfc00356354dfff888e73
TLSH
T158414FE04C3D2AD1E0BD1A7FB49B38FC95DCC72AF9A4347D6824DA98463A11E648443F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 c998bf0788e2493e482a908499bd69f8703b744a8ee4e0c41afb689ed208c469
MD5 7ae072eae478bd80b7bcb9d308757ec4
SHA1 2dcb1eeebdcd7f173458bc75e261af09820bf9ec
SHA512 ecbaa263fc1f8c4ee4fc4d9dad99608da928f10e9febe6b537739f5cd6cb3d98c8a526a026eb4001ba270f7d80e6aeb379e59d97d0bd6315c821745be9a6cf87
TLSH
T16E412A5CA6E91148B7B76E5AABF6A86E487F78772F06D09D10110E4F0A32A40C9B1737
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5264-301-0x000001E571800000-0x000001E57192B000-memory.dmp

Download