hxxps://failiem[.]lv/u/y36bfepbk6

Analysis

geolocation tags

eueuropefrfrance
max time kernel
150s
max time network
151s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
02/06/2026, 19:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://failiem.lv/u/y36bfepbk6
Sample260602-yf2hqaex4k

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 64 IoCs

description	ioc	Process
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4360_754271745\_locales\fa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4360_754271745\_locales\zh_CN\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4360_754271745\_locales\zh_HK\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4360_754271745\_locales\sw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4360_754271745\_metadata\verified_contents.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4360_754271745\_locales\zu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4360_754271745\_locales\pa\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4360_754271745\_locales\nl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4360_754271745\_locales\cs\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4360_754271745\_locales\ml\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4360_754271745\_locales\cy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4360_754271745\_locales\sv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4360_2131431578\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4360_754271745\_locales\sr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4360_754271745\_locales\fr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4360_754271745\_locales\iw\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4360_754271745\_locales\sl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4360_754271745\page_embed_script.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4360_22784990\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4360_22784990\Microsoft.CognitiveServices.Speech.core.dll	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4360_754271745\_locales\ru\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4360_754271745\_locales\mr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4360_754271745\_locales\it\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4360_754271745\_locales\ro\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4360_754271745\_locales\ar\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4360_754271745\_locales\be\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4360_754271745\_locales\hi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4360_754271745\_locales\az\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4360_754271745\_locales\si\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4360_754271745\_locales\lt\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4360_754271745\_locales\is\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4360_993390302\typosquatting_list.pb	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4360_754271745\_locales\hy\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4360_754271745\_locales\eu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4360_754271745\_locales\fr_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4360_754271745\_locales\zh_TW\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4360_754271745\_locales\uz\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4360_754271745\_locales\th\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4360_754271745\_locales\id\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4360_754271745\_locales\ka\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\msedge_url_fetcher_4360_1573477930\GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_106_1_0.crx	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4360_754271745\_locales\lo\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4360_754271745\_locales\es_419\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4360_754271745\_locales\bg\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4360_754271745\_locales\de\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4360_754271745\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4360_754271745\service_worker_bin_prod.js	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4360_754271745\128.png	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4360_754271745\_locales\en_GB\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4360_754271745\_locales\en_US\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4360_754271745\_locales\af\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4360_754271745\_locales\ur\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4360_993390302\manifest.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4360_754271745\_locales\vi\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4360_754271745\_locales\kk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4360_754271745\_locales\lv\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4360_754271745\_locales\gl\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4360_754271745\_locales\gu\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4360_754271745\_locales\uk\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4360_754271745\offscreendocument.html	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4360_754271745\_locales\hr\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4360_754271745\_locales\sq\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4360_754271745\_locales\en_CA\messages.json	msedge.exe
File created	C:\Windows\SystemTemp\chrome_Unpacker_BeginUnzipping4360_754271745\_locales\ko\messages.json	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1504	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134249030825353919"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4045429996-2364296335-1634900306-1000\{13C7E743-976B-4715-AE51-BB7ECFD982A4}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4032	msedge.exe
4032	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe
4360	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4360 wrote to memory of 4544	4360	msedge.exe	82
PID 4360 wrote to memory of 1504	4360	msedge.exe	84
PID 4360 wrote to memory of 5500	4360	msedge.exe	85
PID 4360 wrote to memory of 5500	4360	msedge.exe	85
PID 4360 wrote to memory of 5500	4360	msedge.exe	85
PID 4360 wrote to memory of 3836	4360	msedge.exe	86
PID 4360 wrote to memory of 3836	4360	msedge.exe	86
PID 4360 wrote to memory of 1240	4360	msedge.exe	87
PID 4360 wrote to memory of 5724	4360	msedge.exe	88
PID 4360 wrote to memory of 1240	4360	msedge.exe	87
PID 4360 wrote to memory of 1240	4360	msedge.exe	87
PID 4360 wrote to memory of 5724	4360	msedge.exe	88
PID 4360 wrote to memory of 5724	4360	msedge.exe	88
PID 4360 wrote to memory of 2940	4360	msedge.exe	95
PID 4360 wrote to memory of 1272	4360	msedge.exe	96
PID 4360 wrote to memory of 2940	4360	msedge.exe	95
PID 4360 wrote to memory of 1272	4360	msedge.exe	96
PID 4360 wrote to memory of 3596	4360	msedge.exe	98
PID 4360 wrote to memory of 4140	4360	msedge.exe	105
PID 4360 wrote to memory of 2512	4360	msedge.exe	106
PID 4360 wrote to memory of 3344	4360	msedge.exe	107
PID 4360 wrote to memory of 5448	4360	msedge.exe	108
PID 4360 wrote to memory of 5448	4360	msedge.exe	108
PID 4360 wrote to memory of 2016	4360	msedge.exe	109
PID 4360 wrote to memory of 2016	4360	msedge.exe	109
PID 4360 wrote to memory of 5752	4360	msedge.exe	110
PID 4360 wrote to memory of 5752	4360	msedge.exe	110
PID 4360 wrote to memory of 5752	4360	msedge.exe	110
PID 4360 wrote to memory of 4336	4360	msedge.exe	111
PID 4360 wrote to memory of 4336	4360	msedge.exe	111
PID 4360 wrote to memory of 4336	4360	msedge.exe	111
PID 4360 wrote to memory of 4616	4360	msedge.exe	112
PID 4360 wrote to memory of 4616	4360	msedge.exe	112
PID 4360 wrote to memory of 4616	4360	msedge.exe	112
PID 4360 wrote to memory of 3692	4360	msedge.exe	113
PID 4360 wrote to memory of 3692	4360	msedge.exe	113
PID 4360 wrote to memory of 3692	4360	msedge.exe	113
PID 4360 wrote to memory of 2276	4360	msedge.exe	114
PID 4360 wrote to memory of 2276	4360	msedge.exe	114
PID 4360 wrote to memory of 2276	4360	msedge.exe	114
PID 4360 wrote to memory of 5164	4360	msedge.exe	115
PID 4360 wrote to memory of 5164	4360	msedge.exe	115
PID 4360 wrote to memory of 5164	4360	msedge.exe	115
PID 4360 wrote to memory of 5740	4360	msedge.exe	116
PID 4360 wrote to memory of 5740	4360	msedge.exe	116
PID 4360 wrote to memory of 5740	4360	msedge.exe	116
PID 4360 wrote to memory of 5964	4360	msedge.exe	117
PID 4360 wrote to memory of 5964	4360	msedge.exe	117
PID 4360 wrote to memory of 5964	4360	msedge.exe	117
PID 4360 wrote to memory of 5680	4360	msedge.exe	118
PID 4360 wrote to memory of 5680	4360	msedge.exe	118
PID 4360 wrote to memory of 5680	4360	msedge.exe	118
PID 4360 wrote to memory of 5312	4360	msedge.exe	119
PID 4360 wrote to memory of 5312	4360	msedge.exe	119
PID 4360 wrote to memory of 5312	4360	msedge.exe	119
PID 4360 wrote to memory of 1880	4360	msedge.exe	120
PID 4360 wrote to memory of 1880	4360	msedge.exe	120
PID 4360 wrote to memory of 1552	4360	msedge.exe	122
PID 4360 wrote to memory of 1552	4360	msedge.exe	122
PID 4360 wrote to memory of 1788	4360	msedge.exe	123
PID 4360 wrote to memory of 1788	4360	msedge.exe	123
PID 4360 wrote to memory of 4032	4360	msedge.exe	124
PID 4360 wrote to memory of 936	4360	msedge.exe	125
PID 4360 wrote to memory of 936	4360	msedge.exe	125

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://failiem.lv/u/y36bfepbk6
1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x308,0x7ff83ef0c188,0x7ff83ef0c194,0x7ff83ef0c1a0
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1940,i,15868244805493849165,9343271425149866129,524288 --field-trial-handle=3060,i,13327824160490233276,6415610218260379090,262144 --variations-seed-version --mojo-platform-channel-handle=3084 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1764,i,15198583314510874986,10765722517713182369,262144 --field-trial-handle=3060,i,13327824160490233276,6415610218260379090,262144 --variations-seed-version --mojo-platform-channel-handle=3056 /prefetch:2
  2⤵
  PID:5500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2288,i,14400546812985850128,8828968527058812518,524288 --field-trial-handle=3060,i,13327824160490233276,6415610218260379090,262144 --variations-seed-version --mojo-platform-channel-handle=3112 /prefetch:8
  2⤵
  PID:3836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,2532439967552426742,1844683245250325795,2097152 --field-trial-handle=3060,i,13327824160490233276,6415610218260379090,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,10507412421604345817,12304215070855878636,2097152 --field-trial-handle=3060,i,13327824160490233276,6415610218260379090,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:5724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5064,i,4786672348168624967,1541050110903753232,524288 --field-trial-handle=3060,i,13327824160490233276,6415610218260379090,262144 --variations-seed-version --mojo-platform-channel-handle=5076 /prefetch:8
  2⤵
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5036,i,5209757376273644183,1625033573610500993,524288 --field-trial-handle=3060,i,13327824160490233276,6415610218260379090,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:8
  2⤵
  PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5636,i,1525144652260971927,1345137709692138713,524288 --field-trial-handle=3060,i,13327824160490233276,6415610218260379090,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:8
  2⤵
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5636,i,1525144652260971927,1345137709692138713,524288 --field-trial-handle=3060,i,13327824160490233276,6415610218260379090,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:8
  2⤵
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,4514370903027243772,3098497567049428143,524288 --field-trial-handle=3060,i,13327824160490233276,6415610218260379090,262144 --variations-seed-version --mojo-platform-channel-handle=5716 /prefetch:8
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5568,i,3381157246989855249,5564009630172226705,524288 --field-trial-handle=3060,i,13327824160490233276,6415610218260379090,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:8
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5712,i,3536996174054507810,15883435906948679032,524288 --field-trial-handle=3060,i,13327824160490233276,6415610218260379090,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5712,i,7471833538762988104,10462103611954274552,524288 --field-trial-handle=3060,i,13327824160490233276,6415610218260379090,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:8
  2⤵
  PID:5448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5596,i,11830726658574283533,9401139106046540270,524288 --field-trial-handle=3060,i,13327824160490233276,6415610218260379090,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:8
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5076,i,1865311372390853274,11946590379297380714,2097152 --field-trial-handle=3060,i,13327824160490233276,6415610218260379090,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:5752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5136,i,15053951931306920048,15026914750899300749,2097152 --field-trial-handle=3060,i,13327824160490233276,6415610218260379090,262144 --variations-seed-version --mojo-platform-channel-handle=4028 /prefetch:1
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5148,i,7047867558673452090,4494566069627920542,2097152 --field-trial-handle=3060,i,13327824160490233276,6415610218260379090,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:1
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5332,i,11758359776949947571,13986881404613784780,2097152 --field-trial-handle=3060,i,13327824160490233276,6415610218260379090,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6224,i,7512290385264157269,2581221867701234649,2097152 --field-trial-handle=3060,i,13327824160490233276,6415610218260379090,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:1
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6220,i,4946036217733468436,2226327755767337992,2097152 --field-trial-handle=3060,i,13327824160490233276,6415610218260379090,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:1
  2⤵
  PID:5164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6348,i,269701442653266542,15925257262731300244,2097152 --field-trial-handle=3060,i,13327824160490233276,6415610218260379090,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:1
  2⤵
  PID:5740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6448,i,15281189587493203783,4225831891510314644,2097152 --field-trial-handle=3060,i,13327824160490233276,6415610218260379090,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:5964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6616,i,13905649889023057939,14045147911315276885,2097152 --field-trial-handle=3060,i,13327824160490233276,6415610218260379090,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:1
  2⤵
  PID:5680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=6772,i,3097040927935993481,13407324912527518354,2097152 --field-trial-handle=3060,i,13327824160490233276,6415610218260379090,262144 --variations-seed-version --mojo-platform-channel-handle=6776 /prefetch:1
  2⤵
  PID:5312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6780,i,13526805403904902674,15397557241589747330,524288 --field-trial-handle=3060,i,13327824160490233276,6415610218260379090,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:8
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6932,i,10734765592723372488,17352889611598359377,524288 --field-trial-handle=3060,i,13327824160490233276,6415610218260379090,262144 --variations-seed-version --mojo-platform-channel-handle=5792 /prefetch:8
  2⤵
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5864,i,7374859646491877227,10315053733412892366,524288 --field-trial-handle=3060,i,13327824160490233276,6415610218260379090,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:8
  2⤵
  PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6008,i,16027145640158292758,1150880155490332013,262144 --field-trial-handle=3060,i,13327824160490233276,6415610218260379090,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,11411198645123251092,1527312953075549443,524288 --field-trial-handle=3060,i,13327824160490233276,6415610218260379090,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:8
  2⤵
  PID:936

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5872

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5760

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fc69248227d1b80ff41106426895bcd599abcddfbfe7fdbeabc0fcc2aca903ae
MD5 be6741080fa256162cf6b0264133ca7c
SHA1 4914334b0edd1e4c3a470920450bdee63ee2f5b6
SHA512 8d42ac6412ff316aaa68e317e92c2167dbcac331381aec8d8be8410c5bfab4657127a0601dfc90f771660e393667d62af5e917155d6fcc5c7aa6a8ca1e03f903
TLSH
T149D08037394D7015E35D5175A463C7152B664C611497DF01F166CA7CD9B61C462C71C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 008d7618ac1fdc3bf959ecf4eb320ace4ec226b5297354d4ca34afde15f73549
MD5 2eb4b3ec27f592e7ff17b5be12ea89fd
SHA1 70552f7fa9b99f0e25e3933aa877437ac9d994c5
SHA512 2d03572657ad3a667c3a0e56b0ab2f00feeb14ad4bc91f8448f4bac493e8088e9a8313f4adeac02c2cc5690fdec819c73f53f99e91ec862586de36841906b471
TLSH
T194F028F6CC71AC3708FC4B2860A9474AE795239B3B80495B3A3C920D4FB553B858681C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 31685824c6f0a0a9f0293aef5c6044722624813ec4cc765397d1eb3dc1f8d236
MD5 d983a1cef8ffcf3e2dedcbfad7d3bd14
SHA1 bc640374274da0c5fb5d8b372e502a91060a729f
SHA512 dbee335233e1dd5dad186a587e6d94ba74d27ca627a47da9ad762d3ae83665f08669e177a0ea1b4ef62c0be2885d1e33480940b06121a7311434213d054e0ee7
SSDEEP 96:nRsJw4xFIhLzI82mqDEYOeP5ZkNm9PqaN2ggPtX3zb5LyVQiIpbSugPU+ua45L4R:nc10I5rTk8Be9l6naFVGpPFRYzwG7jBQ
TLSH
T1BBB12899C5523E61EB2D0E31C4EADB213C32408178CB6DC91314EEB9692FFED4A19F12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 99db4e21dee11f4c81808227437a0e2607eac34ca876d840d719cfefb9d8fb5e
MD5 cc87cfbf15a5a364b55293343ccedee6
SHA1 5de2320f3af06637c1d1d9c981fab76fa85745a2
SHA512 9f61c5b2c99b8a574379b5895083e01b8ad8c296cbb7353111a9860f3268cb45c8b1be116509caee48a6c0c1e6e3f98516152bb686212d291e1138589eae778c
SSDEEP 96:ubsJw4xFIhLzI82mqDEYOeP5ZkNm9PqaN2ggPtX3zb5LyVQiIpbSugPU+ua45L4B:uS10I5rTk8Be9l6naFVGpPFRYzw+7jBQ
TLSH
T15AB12899C5523E61EB6D0E31C0EADB213C72008178CB6DC91314EEB9692FFED4619F52
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 12KB
SHA256 fd0d3eba018002472577ce64c7643757df8ea02f81c373e23315746e9eb7cad1
MD5 087b132efdc01aa2df501da0f95fb445
SHA1 d5b93cb5a42f03ccdb52c2df38925e644e541116
SHA512 b7c22892c40c521ccf3061b5cc349e9ea243d86113b6ff343ef3b51b1a9665b9d2fd7226a7eadf2e9535da50f037df97b29b2981e518779f36340ce68175a1a6
SSDEEP 384:D1DqeLwd0Z35Y7I+a32SpyIy6vRGSIEzxCPyV4W7ouGGsZHDaTdReX69sywXXcA1:fEhuVZ/e
TLSH
T132426AF383E4856D8A2191F06A196E2BCF590534271C3D2AC9D89F4BE7F1571E102B6F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 599e9da9a73d3841d77b4c8a14d432482686040290335433da7c27478dbb24c8
MD5 174b3b7d5a0af5fc93ed74107d526bfc
SHA1 fa8390ea94d7b3e663b7a44a7c31201411704962
SHA512 903f781992189defd22af6410b1a86e5e655e46597881a60c48376f9fafcd86d177e51be8481dd46f12aca57f42a6bfd42c9604885cb9b5e60ee89a8f0bb3b96
SSDEEP 384:sxZsVMR/fZseF1mZo5PVHbV/eDsVRzZjt33:s0yR/fTF1P9HbpeQHzjH
TLSH
T15E72C756A974497B8CD7D62AF545BB63D7F91523D2904E44AAFC8B0C04E7AEC2203C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 9b1324686d6e27f18fef83ded05a42bcfc6c6a200624494a84e9b6c462777f6c
MD5 6b6e3a087d61eae6716a5d39d4157182
SHA1 4760d547ed420d1193e677299a508daa68cd2642
SHA512 cc26c8b560dfb8052e0704ab51ad80168aed9b503261e25de8b67a59188dd829ce7f4bdac4e78cb74fd6863de965095659d3791e6d20b80f7efa6dde432289f1
SSDEEP 384:sxZsVqKR/fZsGFOmZo5PVHbV/LGElQVRaZktb:s0EKR/ffFOP9HbpLwHakb
TLSH
T1BF82C653A5B44E7B8DEA9536F545BB67D7F9046696804F80AAFCCB0C00E7EED2102C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 35KB
SHA256 2a04cd336105569fea744a6e2993a0e98f1cf687a0a2de8f9f2cb06f4acc91f8
MD5 79dcc11091c45c7ecad86623508ed4f6
SHA1 dcff098af1c1513c5eeeda74d1c08f96144de6e7
SHA512 706b786cfe1a8b2750d3f338f682020a88817ee8e66e557e4c7f346e3ca9b12760f69bb823a9ec514aa1def3accbb0ad4d30d372ab348bd7c3928afe8fcc42d2
SSDEEP 768:P4E/ael7pLuLnC6WvCuFO8F1+UoAYDCx9Tuqh0VfUC9xbog/OV96yVLlFX6BaroS:P4E/aezEnC6WvCuFOu1jak6yVLfqBRVk
TLSH
T163F20B3B2C0CCB7E4F844E9CEC2A7E9A6DE801CB9698899447F9841C03C67EF55165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 3785fa26bfddee242f23078facf6043d5899856e404977af0992e9450d3ffe9b
MD5 b5a57aee44f9508e682f5699006a63a0
SHA1 c006eac024eb5c9f367df2e15cfb9b122750884b
SHA512 f9a03e6d35d428d1ec5e7f640e5f199835063f2f1d3db9c7453b56286370ed237af620a43f24e5ef849e3ce781d2d39d375c1e5a2154dd920212e6702de85289
SSDEEP 192:OotE42aG3iLEAs1AOvQA7uItfg1MhlfznKzO5tZBBHaFlufF5XYP7cNBv3dR5LAr:8ptDYDcfvNR1ANAJBJO
TLSH
T10DB26C16713B065238BF2508A29399379E4235A33818F4BF7BB814A61F67E215DFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 9e69bc3e0c4e4b450d8954ff6143ac6608ee7f93cdd3190be666b7928a1bd42f
MD5 fbc0fddcd0ff299b566ca7b2789f1c3f
SHA1 1c9ef4ec004a3e272680995063c2a7c775511829
SHA512 f990fc28b6b104b40345dc599b48d426aa7c44eba8fec8753a571aec70cbd6065fa7445a911d1a9f89e2497b5271c9e45df4d3c1333563157337f2dd1473e40e
SSDEEP 384:n4iF9CcmyWCs3sNI8TUNTUlImkrDcYh99fBfFGgvSo9PehhkP+lFYS//1lMHy/7+:DFccps3LwgxJxGb3hhkoFYS/LG
TLSH
T195B24A35EC98CABBEDE64FDAE74A7A07DEE001A7869C8AD0DAD90D0C00D71DD1347816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 bace09a1c63db7c5991b8eaa98f14116d0fdaf94cabb7286d8d91dbcc37610c9
MD5 839dc985c66a7a0caa066e2b59f0f037
SHA1 ba85dfbf4b9525ed1a4b72d9187cf2f023a31b28
SHA512 dbdb900e8c35542ea484a0a9b4ef86babec5a205dab61434634a72acd11daac554e58f908ea619252217e53e9019a323dc66bc84a81a6950ef872ef5405b2238
SSDEEP 384:yziF1tNnNnb95sNX8TUNTUlI4kRDcYP4AdufBfFGgvSo9P5PHMn3WvoG4ZoBKZy0:jF1jZb7wwg5aA4GbKqGvujb
TLSH
T1A6D24B72D8A4CEBBEDE75F96A3497603EFF40197898C5AD0EAC94E4D008719D030BC29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 a845de4853aa0cba6e2feb136bc460d1f14e8260bc718f6062d36db18a5712ef
MD5 2d4f5971adb9f78a7ddfd1e242440074
SHA1 870abc8f6873daf33cc73da4fcc52a0828af8576
SHA512 ce61bc78597f3d2e7d91b4c8695002089a8594d840eaedaf9ff7f97dd885b538680d86aea6efaaa07521260785f9c95148d1bc4d5eacdcc36a64ec21ac9c3868
SSDEEP 384:yLiF1tNnNnb933sNX8TUNTUlI4kRDcYo4AdufBfFGgvSo9P5PHMn3WvoG4ZoBKZ5:bF1jZbJ3wwg5XA4GbKqGvujb
TLSH
T138D24B72D8A4CEBBEDE75F96A3497603EFF40197898C5AD4EAC94E4D008719D130BC29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 7ad7f06f7b576945ae243d574fa3ad3b3e579c65227209e973f9d6b080f76afb
MD5 23fc7cbaaab0f0eaac6e426f8b6fb3e0
SHA1 1589698763a092dd26aa7755f8a2c6137a693224
SHA512 917f5ab7074bca0a5c426329b3a33cd6e3c3ed0bee31094ee7cff455307297b555543f73fe6aaa57da443aca5502b763e2f551f54916b3d63928242aad97e6b5
SSDEEP 384:yYiF1tNnNnb970sNX8TUNTUlI4kRDcYPLAdufBfFGgvSo9P5PzMn3WvoG4ZoBKZ5:WF1jZbywwg5BA4GbMqGvujb
TLSH
T1CCE2B4F198E78976E9AE5B97A33D2D029EFCC153B4885990BBC80D4DCC861BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 b7512f9e4030a5fa064f2af4ff7692bd5d81b4db5cce6bcb0f0c61ea36dbffd2
MD5 8f91eb63699c1c6c414f3895fcb84e0c
SHA1 e7c41f0a5cddc538dafbc2d59c3dd3327cbf0382
SHA512 286e0854353a540a8302fdc0632824e16980ef54394fe1e31ccb617502cbad30bca88d99abeede021a9b7d89c28fc326e73224b07abfbb37d1950ea41b704db0
TLSH
T14A4122D25D3C1AD1C4BD0E6FA49B38FC95E8D63AF1A4707D6858EA94063CA0EB44143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 2KB
SHA256 40796bc0d09d6684d27d1bdc3928437e6850b0dc7d3def9d2b6fd28930fe1e3c
MD5 93f6ef23875ac5f74b0ee82356f5ccb9
SHA1 4638a99e5a51ace55bca98531e80faa9d2b4580d
SHA512 7f7ad157832cba2267601604813aefb4c763a50c69a8553dc343fd23569a50d22060669a0cb4af9bc0b41b524240a8014a0c60a89a896059e7de37936cfb71e4
TLSH
T1F24123E21C381AD1D4BD0A7EB48B38FC94DCD726F5A430BD6858DA940629A4D648143F
MD5 SHA1 SHA512 TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\component_crx_cache\metadata.json
Size 1KB
SHA256 1f085e8172469700f1177aa95a72280ef2d1335964e8afa6938089a216f5277f
MD5 bbe2be9c06615615f521d2d86496788e
SHA1 c1bad313390d52e37eaa058457bf11a1e81fce29
SHA512 d1caada50d8c808d9e02e327579833ebbeac3ac9bc6e2363db8c1244e96789ca4b2128da9190eeee2a8764c1156921b39ce4f00a377fdb0874c2f1bea9470d87
TLSH
T1664122E25C381AD1D4BE0A7EA49B78FC94E8D72AF5A470BD2858DA950728A0D644143F
MD5 SHA1 SHA512 TLSH

Submit Download

d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 132B
SHA256 d6bb12722d8ec159af735b3270f83013e8b8e2df54df596eac54c458b11d445e
MD5 e6d52bbc2ba6378f83c8e079c3b58d30
SHA1 2768e8f09a3d414aaa25fb104cffb69e02b8198f
SHA512 40af0fc8008a9d3194c4718b4d0a75793b652b2ee28798bc85f27b90ee46c59025f8d0c8abeea9ff371c756962db066f2f00cee485b203e688a9ee8f2e48648d
TLSH
T171C02B8F243E4DCC4E4A02399048032B8FD07518302402388C0BCA00003DB0E5F4405F
MD5 SHA1 SHA512 TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 1ca4864a12d169fd6eb318e90f028310147f678ebb99e5be1be39095fe22c87c
MD5 e75226475104650f4b043728455fe609
SHA1 e28c0ad255c1683089c26d6d9ff951a9cb688c6f
SHA512 54f42796fb09b0b68115571b07d8bb131b2f80e55471ce227543c8519388346d47e2297e555873c2011d00e77e1b1852fe3efded595de91523f61c490c46d6b8
TLSH
T10641194CBAEE1148B3B76F16ABF7646D587A78322F06915E10110D4F4663A41CD71B33
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3596-343-0x0000023380000000-0x0000023381000000-memory.dmp

Download