hxxp://url7254[.]govtas[.]com/ls/click?upn=u001[.]ZCx8SEvFUnsHCsy3GeLa6OWh1n9PP9qPjEn9YIWHLtAti3bIkAJ4bRgamZug0GOtGjU9yk7bn7eHcPX8LCLhl0MuVNXnnsJ0eynNwUvDtgzL3-2BhjPI7HNhhvIirON-2F8I8bLQdj5sgCIU7naTx-2B2QnSfHMQfiuuujdLUQ5N8p1zYW2zuJ4Eil2m1unMF7ZDrNuYf6HMVN7yErQAMOjHYADQ-3D-3DSxb1_Gf1RLxiMob-2BgeEUSavBEncRXkilSWxIFLG0V5LGeBVmdVUZ-2BL-2Bz7MwQ6-2Bj0Sc2gP5gZ74-2F4mLG25tuf2BPjYV0M2884yPwlPZNC6jq-2BaAyEAOZHXz3gs8H02IBLbHaLLCI7D6tEbVaOQ5mvBqJWSXE5tLXLDpStJcEeT1NcVVCPIzTKwJMgbmZIWM8r0fDPPi-2Fxg8BdrSYIPhn2MOoAkcXUxo9VxqMD-2FEWXcJL6HdRzUFgb2oDxTxbK2GoxPTz5guC-2FIBPuT6vT4bgyzOpTg1VuA-2Bsc0dE5q891oUeLABFpl5kvuKQhzRkhzBCkIxY5q5gZY-2BiesOC-2BBF7tul8kzPIwP7imDl0FCyRPi-2BwZcK9No15Cjojt-2F5aDLJdc-2F9aIyFjfPPRQTtR7AyxIqEtXOdQ-3D-3D

Analysis

max time kernel
148s
max time network
148s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
25/05/2026, 04:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://url7254.govtas.com/ls/click?upn=u001.ZCx8SEvFUnsHCsy3GeLa6OWh1n9PP9qPjEn9YIWHLtAti3bIkAJ4bRgamZug0GOtGjU9yk7bn7eHcPX8LCLhl0MuVNXnnsJ0eynNwUvDtgzL3-2BhjPI7HNhhvIirON-2F8I8bLQdj5sgCIU7naTx-2B2QnSfHMQfiuuujdLUQ5N8p1zYW2zuJ4Eil2m1unMF7ZDrNuYf6HMVN7yErQAMOjHYADQ-3D-3DSxb1_Gf1RLxiMob-2BgeEUSavBEncRXkilSWxIFLG0V5LGeBVmdVUZ-2BL-2Bz7MwQ6-2Bj0Sc2gP5gZ74-2F4mLG25tuf2BPjYV0M2884yPwlPZNC6jq-2BaAyEAOZHXz3gs8H02IBLbHaLLCI7D6tEbVaOQ5mvBqJWSXE5tLXLDpStJcEeT1NcVVCPIzTKwJMgbmZIWM8r0fDPPi-2Fxg8BdrSYIPhn2MOoAkcXUxo9VxqMD-2FEWXcJL6HdRzUFgb2oDxTxbK2GoxPTz5guC-2FIBPuT6vT4bgyzOpTg1VuA-2Bsc0dE5q891oUeLABFpl5kvuKQhzRkhzBCkIxY5q5gZY-2BiesOC-2BBF7tul8kzPIwP7imDl0FCyRPi-2BwZcK9No15Cjojt-2F5aDLJdc-2F9aIyFjfPPRQTtR7AyxIqEtXOdQ-3D-3D
Sample260525-e5c2waev2w

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 7 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2312_1976940072\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2312_1976940072\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2312_775307761\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2312_775307761\Microsoft.CognitiveServices.Speech.core.dll	msedge.exe
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2312_1347351472\data.txt	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping2312_1347351472\manifest.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2096	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134241570819911783"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-101591186-421676486-4137282292-1000\{55E19F3E-EA8C-454C-BAB9-8FFD1D9929B7}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-101591186-421676486-4137282292-1000\{543D790B-C438-4F8B-80FA-6911A0EDF44C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3588	msedge.exe
3588	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe
2312	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 2312 wrote to memory of 3860	2312	msedge.exe	82
PID 2312 wrote to memory of 5808	2312	msedge.exe	83
PID 2312 wrote to memory of 2096	2312	msedge.exe	84
PID 2312 wrote to memory of 5808	2312	msedge.exe	83
PID 2312 wrote to memory of 5808	2312	msedge.exe	83
PID 2312 wrote to memory of 1492	2312	msedge.exe	85
PID 2312 wrote to memory of 1492	2312	msedge.exe	85
PID 2312 wrote to memory of 5960	2312	msedge.exe	86
PID 2312 wrote to memory of 5960	2312	msedge.exe	86
PID 2312 wrote to memory of 5960	2312	msedge.exe	86
PID 2312 wrote to memory of 1912	2312	msedge.exe	87
PID 2312 wrote to memory of 1912	2312	msedge.exe	87
PID 2312 wrote to memory of 1912	2312	msedge.exe	87
PID 2312 wrote to memory of 3228	2312	msedge.exe	95
PID 2312 wrote to memory of 3228	2312	msedge.exe	95
PID 2312 wrote to memory of 3228	2312	msedge.exe	95
PID 2312 wrote to memory of 5152	2312	msedge.exe	96
PID 2312 wrote to memory of 5152	2312	msedge.exe	96
PID 2312 wrote to memory of 5152	2312	msedge.exe	96
PID 2312 wrote to memory of 416	2312	msedge.exe	97
PID 2312 wrote to memory of 416	2312	msedge.exe	97
PID 2312 wrote to memory of 416	2312	msedge.exe	97
PID 2312 wrote to memory of 2708	2312	msedge.exe	99
PID 2312 wrote to memory of 400	2312	msedge.exe	100
PID 2312 wrote to memory of 400	2312	msedge.exe	100
PID 2312 wrote to memory of 4388	2312	msedge.exe	102
PID 2312 wrote to memory of 4388	2312	msedge.exe	102
PID 2312 wrote to memory of 3668	2312	msedge.exe	103
PID 2312 wrote to memory of 3668	2312	msedge.exe	103
PID 2312 wrote to memory of 4308	2312	msedge.exe	105
PID 2312 wrote to memory of 1328	2312	msedge.exe	110
PID 2312 wrote to memory of 2988	2312	msedge.exe	111
PID 2312 wrote to memory of 4252	2312	msedge.exe	112
PID 2312 wrote to memory of 1824	2312	msedge.exe	113
PID 2312 wrote to memory of 1824	2312	msedge.exe	113
PID 2312 wrote to memory of 4968	2312	msedge.exe	115
PID 2312 wrote to memory of 4968	2312	msedge.exe	115
PID 2312 wrote to memory of 1396	2312	msedge.exe	116
PID 2312 wrote to memory of 1396	2312	msedge.exe	116
PID 2312 wrote to memory of 3588	2312	msedge.exe	117
PID 2312 wrote to memory of 5968	2312	msedge.exe	118
PID 2312 wrote to memory of 5968	2312	msedge.exe	118

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://url7254.govtas.com/ls/click?upn=u001.ZCx8SEvFUnsHCsy3GeLa6OWh1n9PP9qPjEn9YIWHLtAti3bIkAJ4bRgamZug0GOtGjU9yk7bn7eHcPX8LCLhl0MuVNXnnsJ0eynNwUvDtgzL3-2BhjPI7HNhhvIirON-2F8I8bLQdj5sgCIU7naTx-2B2QnSfHMQfiuuujdLUQ5N8p1zYW2zuJ4Eil2m1unMF7ZDrNuYf6HMVN7yErQAMOjHYADQ-3D-3DSxb1_Gf1RLxiMob-2BgeEUSavBEncRXkilSWxIFLG0V5LGeBVmdVUZ-2BL-2Bz7MwQ6-2Bj0Sc2gP5gZ74-2F4mLG25tuf2BPjYV0M2884yPwlPZNC6jq-2BaAyEAOZHXz3gs8H02IBLbHaLLCI7D6tEbVaOQ5mvBqJWSXE5tLXLDpStJcEeT1NcVVCPIzTKwJMgbmZIWM8r0fDPPi-2Fxg8BdrSYIPhn2MOoAkcXUxo9VxqMD-2FEWXcJL6HdRzUFgb2oDxTxbK2GoxPTz5guC-2FIBPuT6vT4bgyzOpTg1VuA-2Bsc0dE5q891oUeLABFpl5kvuKQhzRkhzBCkIxY5q5gZY-2BiesOC-2BBF7tul8kzPIwP7imDl0FCyRPi-2BwZcK9No15Cjojt-2F5aDLJdc-2F9aIyFjfPPRQTtR7AyxIqEtXOdQ-3D-3D
1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffdb1abc188,0x7ffdb1abc194,0x7ffdb1abc1a0
  2⤵
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1712,i,7421401114363882413,10109367592345721192,262144 --field-trial-handle=2332,i,18219068694360107511,3631561982244502174,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:2
  2⤵
  PID:5808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1912,i,142849454026422836,16452571694714442359,524288 --field-trial-handle=2332,i,18219068694360107511,3631561982244502174,262144 --variations-seed-version --mojo-platform-channel-handle=2508 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2300,i,8560971030472432203,3110627263163900903,524288 --field-trial-handle=2332,i,18219068694360107511,3631561982244502174,262144 --variations-seed-version --mojo-platform-channel-handle=2636 /prefetch:8
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,12772869260271103941,8436011797030988312,2097152 --field-trial-handle=2332,i,18219068694360107511,3631561982244502174,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:5960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,10621386561451917310,17002661428253599185,2097152 --field-trial-handle=2332,i,18219068694360107511,3631561982244502174,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5000,i,1731695672076888192,1303953854394564588,2097152 --field-trial-handle=2332,i,18219068694360107511,3631561982244502174,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:1
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3724,i,7672633004167444755,13715115592355199234,2097152 --field-trial-handle=2332,i,18219068694360107511,3631561982244502174,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:1
  2⤵
  PID:5152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5248,i,3571040859736585694,4898298506474900286,2097152 --field-trial-handle=2332,i,18219068694360107511,3631561982244502174,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:1
  2⤵
  PID:416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5468,i,11105538831501373654,10799360971445959493,524288 --field-trial-handle=2332,i,18219068694360107511,3631561982244502174,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:8
  2⤵
  - Modifies registry class
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,16594107655297329403,4875028228465310474,524288 --field-trial-handle=2332,i,18219068694360107511,3631561982244502174,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:8
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5796,i,6246306213300750553,10440344274538479350,524288 --field-trial-handle=2332,i,18219068694360107511,3631561982244502174,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:8
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5800,i,3551291272106527963,1593332362871110957,524288 --field-trial-handle=2332,i,18219068694360107511,3631561982244502174,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6484,i,4510054168182497873,3194881369937258298,524288 --field-trial-handle=2332,i,18219068694360107511,3631561982244502174,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:8
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6484,i,4510054168182497873,3194881369937258298,524288 --field-trial-handle=2332,i,18219068694360107511,3631561982244502174,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:8
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6536,i,9284173473182485790,11336065129333183727,524288 --field-trial-handle=2332,i,18219068694360107511,3631561982244502174,262144 --variations-seed-version --mojo-platform-channel-handle=6864 /prefetch:8
  2⤵
  PID:1328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6532,i,3015566840034265197,14091957837695617050,524288 --field-trial-handle=2332,i,18219068694360107511,3631561982244502174,262144 --variations-seed-version --mojo-platform-channel-handle=6888 /prefetch:8
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6464,i,14853974944822224052,8157759311606530997,524288 --field-trial-handle=2332,i,18219068694360107511,3631561982244502174,262144 --variations-seed-version --mojo-platform-channel-handle=6840 /prefetch:8
  2⤵
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2156,i,4901770093891646207,585375353233551949,524288 --field-trial-handle=2332,i,18219068694360107511,3631561982244502174,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:8
  2⤵
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6372,i,5627834222452425402,6725505423817409518,524288 --field-trial-handle=2332,i,18219068694360107511,3631561982244502174,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:8
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6952,i,12434255131060548747,15938222564541650997,524288 --field-trial-handle=2332,i,18219068694360107511,3631561982244502174,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:8
  2⤵
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=784,i,6044314183014907352,16967579178726065353,262144 --field-trial-handle=2332,i,18219068694360107511,3631561982244502174,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7016,i,10381332165738410519,6967337552946460675,524288 --field-trial-handle=2332,i,18219068694360107511,3631561982244502174,262144 --variations-seed-version --mojo-platform-channel-handle=6996 /prefetch:8
  2⤵
  PID:5968

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3020

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2304

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 35cc5409a0e92c7b1f173401d1114c9d5fdc977752a8e45ce9068d8101c9a651
MD5 4177a98ec95c7b8511089a1be66e9e7b
SHA1 523d632928047252508b7d45169327ef4523179e
SHA512 d9e67625f1cfcaf9b90149a3ed0ce8899f43e93e14c729f7cf114adedf8a6a345c93240cebfa58351038924578a437d9d7144c7dcd826b1b8892dc523920e947
TLSH
T17AD08077670FF411E36D5131D503C75117AE547179625723F118C40D99741D693C51C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9e9b606cfbfc7b0fcbfab1ff9a90d94ddcf0c4033903cc47f13cbcd8bcac95cc
MD5 66bd1dbef8b4df50e7a09a2d2848fb79
SHA1 69983a576369225e69f3c4e38eef011e7e436249
SHA512 7f8546014287d3ced2b59766b273c8d8981aee3ef643630332615e594a89f92a95f1ce112c2fa889b0e249a10643792bfc57043bfc523d6ada97b8bc7d6e7d6c
TLSH
T17CD080776B0BF411E35D5131D503C75127BE507179625723F158C41D99B41D697C51C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 8acf61646e796a4d08d2a220e5430c33ce399ee0cda59694288d2cf6c3862798
MD5 587b03385d3bfe64216fe8dad006f323
SHA1 d3943cec20ecfccede3115f92a02efe898395669
SHA512 8021b69ec66f835925dc33f44512657209e834bf69b11cab62eb6d6e224a6875e8d21939ea5123f3ac26523874ac991348c6c958abf3c469e3dfb644dbcd848d
TLSH
T1D6F028AAC921AC3708FD1B2D30694B47E754136B2B80895F3B3E920D8FB163B469691C
MD5 SHA1 SHA512 TLSH

Submit Download

f_0000a8

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a8
Size 364KB
SHA256 8659c125bc8718eb28f8269dfb43a22a2b080ffa264928c0370e09a444ec142d
MD5 c6684b15c592145210534468e21335d9
SHA1 3ada6b014dc2227be173aabdebca3da225e51cb9
SHA512 2dd829c13df5113112632ccb6288105485ac73f48f08820cf32aef74edfb59287a243fd16c7f88fc208c94ac524117bf3dcc4b9cdd9bc85d6fbc38888e79a1b9
SSDEEP 6144:/xy3n4OXVRq7eQwYem1rSDGHmWjXe4wIg9zkxDHwwoGu4Dz25/tCB4V/FIGzZHmL:/xun4KV+eQwYp6GHmWju4hCCUwosi/7Q
TLSH
T1348423BE81B84C867A3E1AD57943E723C205BE26E1316BC73E4E010A23765E3457BDC6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 54c51372a52d7420d0cfdfb5d97b3f03ad85e77c61827a57f4cf07d85373156e
MD5 6ef6770e6a72fd42b480f2c02e7bad4a
SHA1 fefe30b4a4162edc8ae2075134da61e04941b529
SHA512 9a6da8da3184ae306744e4f0b63c23850cf77423fa85c2754c3a4eba09d4bbd641b37dbaa3c6959a07d082d98707842ef634f7d85aa288fe717c6c5be542c023
SSDEEP 96:2sFa4RSIHHyJJhV17yovS0IH+clBRPGUrQCIl:2snlHyPVZylljQj
TLSH
T161A15CD412C29BE1EB10E0BA7BE1620A31B14779DE87AF5B42E81CF9710B75501F68D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5889ad.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5889ad.TMP
Size 3KB
SHA256 ae4036d24383db954c06a2c2b0b60110d48ee8b7fc2f5089731ed66b69fb5e0b
MD5 5963731f5c442efeb6fbe331d7a04685
SHA1 68a9361a420d26532e10b00081dae06501742947
SHA512 aebb45b6c11c1d055108e306c2885bde42827da9e125052056f8e833fdff86c2c32d6cc83b5eb578acff8519a330227644e99aa5b7642e8b5b499810c5411ffa
TLSH
T162614CE426C2C3E0E720C13EBBE2510B75768B79CE177F9241E058F93A18B9541F65C8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 692b47efd39d02c2853d4bd92a86b8eb905a9e70a955847d104afdbe4342b959
MD5 6f4c7baa0ef60f6bbec5ae1eb278b06a
SHA1 b1f6e6a1b20f81233bb6b295493223eb95856c86
SHA512 4e9ab7fa53d9712951b7f41d6b43653c0dbece1ba2df97f65e0cd4d20f32f7aa7e27abb657ea3d21e51ac68d5c7eb5b5db77545dae54c0138c5840f32344bb92
SSDEEP 192:D1aIQ6/ST/OvFv8+qNr/nuWaij6W1XqS/pO3Irs8YthfyUOvjV2UkUDOu9kQT:D1aIQ6qT/OvFv8+qNr/nuWaiGW1XqSxZ
TLSH
T1872270E3C3EDC32DC91156F46614BE2BCE2D0914932D3D2A89E4AF4BD3E2871D24665E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 3e367aa8e3cbbd9c62aaa70e5aea356600d8df4b5f3ceb2c2c8121bb3aa64f9c
MD5 9f4b68093e62e88565f4d0de1887cf42
SHA1 421bd2a1abe69f57e89be1af556a57afe5f3084f
SHA512 e393cc7b7b1cacda0c1693cdd4e81fc762b2282bab4160754bfd042972b47203315c9e8519df77f63a46493ea7544ff1fcf8ab8051855183968a355a02616ef1
SSDEEP 192:sxZORpyMqZjK1Ml8Mk7/frsj+huo43ggVzodp2pHm56+WN8qh/e3EF8QX9MOXazb:sxZOSM7/frsj+Q1+GHHH/ekMTq0
TLSH
T13D72D716AA3889778CE6D219F945BF53D7F95573D2904E44AAFC8B0C04D7ADC220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 792a78bdb54708bb9d6bd96699f8bbea8303560cbb988f46cf0924205e8bc8ae
MD5 db02b409737fd36a815f20ae494d80f7
SHA1 2cc3af89c2d94a52aa453411f8361d9100fd1a6f
SHA512 49b927d4fb3864d648455f6df9362615f8ab3fcd595e3ecc946f3d933ec89efc3ae2f25f1eefe400777e0a160d8b6482595103cc470365389e1d2f648df9f503
SSDEEP 192:sxZORpyMqZjK1Ml8UQHk7/frsj+Puo43ggVzodp2pHm56+WN8qh/e3EF8QX9wOX3:sxZOSqE7/frsj+W1+GHHH/ekYTMb
TLSH
T1F972D656AA3889778CE6D219F985BF53D7F94573D2904E44AAFC8B0C04D7ADC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 70d6438e52895aaa97e23eea42ffba5aecf9e9f49fa25081c19cfb9b22d906f2
MD5 c9730ffc9bc92a678f072a62325d3434
SHA1 76884699d2254fb57d8c3c34d54323bd15910f99
SHA512 c1b1b10be9caff525e00a34643967715e4bea82d3fde839d30a734971d01f4f458d73db18e7b6b14955339ca4d2f16159acaa76bd428364ab38b1018ba7bc9c5
SSDEEP 192:sxZ+RpyMqZjK1Ml8Mk7/frsM+huo43ggVzodp2pHm56+WN8qh/e3EF8QX9MOXYII:sxZ+SM7/frsM+Q1+GHHH/ekajq0
TLSH
T16572E756AA38897B8CD6D209F945BF53D7F95523D2904E44AAFCCB0C04D7AED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 16d2796fcb361f36730272279c8e978d89ea25cddffb40912496f33c0314521e
MD5 87887b7ada646fd6abb5427c2aa558ff
SHA1 776bd59416c99ec571653a85b507a68f5d39dbc2
SHA512 d78a67958d7466f3a9fdddafd57fbd6a9d767018bf16248ae514d760e9a69148cf3ffed6981b65762d3ce4f419fb9558d2015d4be9baa956d2e44e94670c7b27
SSDEEP 768:/Zk4Pfe7pLuLnXDWvXt4h8F1+UoAYDCx9Tuqh0VfUC9xbog/OVneHiLl42vJ4ro4:/Zk4PfeEnXDWvXt4hu1jaSeHiL+QJDWH
TLSH
T1BAF2FA3B680CCB7E4F804E9CEC2ABE9A6EE8018F5698CD5447FA444C03C76EB55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 120B
SHA256 7a146f4387fa626d9ae74bf33d5f58ab50213bb56bb036de5d17d7040e9e1e00
MD5 9a2c201d9cf85cf37294aef2a0c57fc7
SHA1 c2565ee60326a07fb9515934c79cdb79752ce4f0
SHA512 9c6aa270b2da0339eacadf55d9001256c4bdd03daeec177d18ac60b321f07ef36f9a3600277b86310c95045204f7baf0bdd266fc6199dbfaf9cbc2c3e4ffc85d
TLSH
T163B01241068C5E81CC4402F045841548530599506DC1A3030478C4588C6F9C08555D09
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe586983.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe586983.TMP
Size 48B
SHA256 154b05e08c523c82a47912ba4539c24bcab4c6aa7f9642c7eb8004a203be0c94
MD5 af905ee5568dcf9f78b7e55e8343c6ca
SHA1 3593dcd0c0eaa52f276718cd00a1b6f3c2eedf11
SHA512 8af567bd7838f509bd3a9668f3f4f3169da0c38b65a082efa82dcae1ece6baac65d3901d5cf66675879023746f902a216b08875247013a9d906aa20afb77c15d
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 deb638c4dbb2c92b7c86717c58c97df14e7ff421955d8b5ed4928242d0925ffe
MD5 591b0e266a5c62e7a22ec3090aac600d
SHA1 e203818efef27620302ada7eaff99b4f34eedd77
SHA512 9970ca5cb6ef65782e0d7ada17c610fd5c6068a16e5c6c61236d45a79e27b9e1d3478a2e7e4be70414aa2e36882158fa62e30b295395a8bec52172a92e91500a
SSDEEP 192:EtjGz7Y1/St59NZp1ZVzDqHgnmz3th9AZkzPr1PVIfPU18LvY:EJGnYNSv9PpHV/qjWDY
TLSH
T170B24B13313A03423CBE2508A2A296779E4231B3301DE67F77A904A64E67E225DFDDDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 34b66c7ab856a44c3d5b6d302fbdce4d8d449e72f2841aa79d8d0f85cc11433a
MD5 796c99a07bb1dd0cdef6a31074f0b277
SHA1 16d794b8f973cdbab5b5c28140c242a683f4280e
SHA512 abfff78420e89e979ab5d759dfbbff26812d11c66ebdaa3846a06744e4c34604fb04e8a2f1607ad8d361cacf84a04d111e23d3c9f0e10887af008bcc863ec6db
SSDEEP 384:n1ciF1tNnNnb9X3sNi8TUNTUlI4kkzoNmRR3yBfgVIzdo1BUy5ctoU4pwY/UBKqS:1HF1jZbN3Zwg2l3VIUUKZhaY83hk
TLSH
T10AD25B329868DEE7EDE78FD6B31A7B47AFE411A7C4881AD4DAD90D0D00D719D130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 dffc0bd233d1854e4d1f904d9bd720b3f45e1a8cbb3d5f1284015f65f4c1d734
MD5 ea546160d1fb7e6bc3104213f0137dbd
SHA1 0adca4cedff59bd91ec7eaa37d2a43f23b9b4bb7
SHA512 36dd0d1bd3679b6790b8f22819df081cd2c1f11b17dd1f3fd8f3d0d82075b60a312509360b856dd022bdaa720652590dac1a5fe5f4781aba8eccfdc0e49515f8
SSDEEP 384:nmciF9CcmyWCs3sNb8TUNTUlImkrzoNmf4vyBfgVIzdo1BEX+qhkP+lFYS/G1lzn:mHFccps3Iwgl2vVIUEphkoFYS/iL
TLSH
T175B25C31EC98DABBECE64FDAE74A6A47DFE011A7C1984AD4DAD91E0C00D719D1307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 56aacd60f2c084ea5b3146a92acd556614e1f3e71656242105fdeefdfc510b20
MD5 f6f940934e1176500ff1f9b53128ac1a
SHA1 5551281f96a668d2d7c9895f864a533590c7b1b7
SHA512 08b9660adc13b1e5e914407d18facb0aab8795d2cdc18809a163a91723de00c6082cc7d41f0442a3d2079fc200bab7036c7065e1cf9b2045765767c2c4edef30
SSDEEP 384:ngciF1tNnNnb9X3sNi8TUNTUlI4kkzoNmLR3yBfgVIzdo1BUy5ctoU4pwY/UBKqS:gHF1jZbN3Zwg2j3VIUUKZhaY83hk
TLSH
T166D25C329864DEE7EDE78FD6B31A7B47AFE451A3C4881AD4DAD90D0D00D719D130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 8efb57aa2b0ff30ab8d644f9f110d129ee3fe89a76cfa4965c38d07f66616413
MD5 3c444fa55f0b8e5f5c4ffba573619871
SHA1 0528b065615a979db2a76d65af5f87b5f27de176
SHA512 a0890f8ee516a475bc6211b52960946ec9b1691006d3264a73219fe46a7b8fc0e4339452f4357d72f8b5ab02feefbe67ea32bb43346865ab7853a0423df16ce1
SSDEEP 384:n1IiF1tNnNnb9IU3sNi8TUNTUlI4kkzoNmRR3yBfgVIzdo1BUy5ct5U4pwY/UBKl:1TF1jZb/3Zwg2l3VIUUKuhaY83hk
TLSH
T1EBD25B329868DEE7EDE78FD6B35A7B43AFE411A3C4881AD4DAD90D0D00C719D130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 3b50a53ee783da86d401be6aad38083167e776f58eca8132db9be2ba4c80d408
MD5 5c392c75b7c3f286ce3ffcadc92733eb
SHA1 0044e48e34fcf47e020ba4c310aeada2daf66365
SHA512 a8fc85a40c6f886fbba77a60ebca48fb90d8d648612238fd9a776d738d3ca8a4853668fb33f1c5e92da8bf264815d9ebd8763f77dc24d57b8b6e06b2ad4dc062
SSDEEP 384:ngciF9CcmyWCs3sNi8TUNTUlI4kczoNmLR3yBfgVIzdo1BUy5ctoU4zTHy/7Igk:gHFccps3ZwgWj3VIUUKZhzn
TLSH
T153B24A32DC98DAA7EDE78FDAB74A7A07DEE051A7C18849D4DAD91D0C00DB19D130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 1740507d00a90c2b42b16edc1a445a2b01774ad8747abf1a6fafa620ef267a81
MD5 e1bb0684299f97a41ac9489197f442ed
SHA1 64f463e620b2d1c0e30ea89f2bfd7990f340705f
SHA512 4e0642917e547ec5fca0cf230f525556a84a3393fe5c2cf2aa9ec7a06f90e1b7d8ec1cea66b97d86abb4fd68a7fc5aa00a2de2dbc79531df676dcbcadb356876
TLSH
T12E3101E16D381AD0D4BD0ABEB4D778FC85D8C32AF1A4307E6858D9980739A1E644543F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 70b15e9c32faa84108a2fd3680a7ab8cf9faf89fbdcf5f0a17ccb1ab39d31607
MD5 21ab867702ff70de06c40af6e0c327f2
SHA1 69bc791964f165a89b04071ac5e006c655686b39
SHA512 8905bbd12e993a49b498d8bf36ae5da60b48e24aae7a61b6acc504f6308a29dd964e2b4408f91d857c5f377ac7064eeeee19ad21b32116da66a1547377a4f27d
TLSH
T15A4144E15C381AD0D4BD0ABEB4D778FC85D8C325F2A430BE6858DA880A3D65E648543F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 1ca625fe2903995966fbb7661ca57dd803fd603463542e1e8f048e2d7e911d5c
MD5 8502895d2a1bb188ad0ed0d89a1a53a7
SHA1 be38e027e578a13e9312d47b9a49c49222e8956a
SHA512 3c1000da49f649f2715bc3ccfc504cb77ff29e399b8275c3717bf9bacbd7a3bce11cf81e0cbae5f39190adad036b94a48a2334a463b9e033cede67057e1018b2
TLSH
T1DC311FD16C381AE0C4BD0BAFA49774FC85D8D22AF1A470BD5858E9940A3CA0EA44543F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 8ad580bb3a4a8d311ea00695e3e625d19ce82db8e62f40eae8052084b2204273
MD5 531c9d6f903ec203f874b1733a2bd851
SHA1 b040eb4a6d3c34547803661c8d1ff7abd4063f20
SHA512 aadc95dad50c14485c42832fe4a7b80c67aa76f188e598be874b03db4106ab35f1d2c55c78d49df9bc68443a8d6d87a5585ff951138fd2e278074f2bfe41f506
TLSH
T150410B5CBAF91148B3B76E5AAFF6A96D487BB8772E06D49D00110D4F0A63A40C861B37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/4308-386-0x0000014D666E0000-0x0000014D676E0000-memory.dmp

Download