2891019edfad5d831e3878803e6b1b72a3a3a63e62232c4b81dbb3ffb59ff757

Analysis

max time kernel
148s
max time network
161s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 12:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
dev/header.html
Size 680B
Sample260604-pfejhsfs2k
SHA256 2891019edfad5d831e3878803e6b1b72a3a3a63e62232c4b81dbb3ffb59ff757
MD5 4ff0cc0850d02942d3d8d6d3209eabfb
SHA1 261218048bc1738d61e0a678acf3b55c48cb156c
SHA512 2e3a1211597ca438f36039b325e222ca8d5e6d12e3da553e5e388dacd75ef7c970a549e6b55d371774695fc18c43a490c885af4e8af8077e63e6bccf7aaccc19
TLSH
T11B01D39099C7701F78020258DA43BDC0C4F7644E8B544D4C1D6F247B6099BDE9C1376D
MD5 SHA1 SHA512 TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4724	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134250489797925501"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2043432456-1617298091-2772621413-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2043432456-1617298091-2772621413-1000\{83D9AB45-7B71-4447-AA00-6C9A7FF0E4AC}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1736	msedge.exe
1736	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe
2144	msedge.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 2144 wrote to memory of 6076	2144	msedge.exe	80
PID 2144 wrote to memory of 2512	2144	msedge.exe	81
PID 2144 wrote to memory of 4724	2144	msedge.exe	82
PID 2144 wrote to memory of 2512	2144	msedge.exe	81
PID 2144 wrote to memory of 2512	2144	msedge.exe	81
PID 2144 wrote to memory of 2556	2144	msedge.exe	83
PID 2144 wrote to memory of 2556	2144	msedge.exe	83
PID 2144 wrote to memory of 5232	2144	msedge.exe	85
PID 2144 wrote to memory of 5232	2144	msedge.exe	85
PID 2144 wrote to memory of 5232	2144	msedge.exe	85
PID 2144 wrote to memory of 2012	2144	msedge.exe	86
PID 2144 wrote to memory of 2012	2144	msedge.exe	86
PID 2144 wrote to memory of 2012	2144	msedge.exe	86
PID 2144 wrote to memory of 2420	2144	msedge.exe	87
PID 2144 wrote to memory of 3976	2144	msedge.exe	88
PID 2144 wrote to memory of 2420	2144	msedge.exe	87
PID 2144 wrote to memory of 2420	2144	msedge.exe	87
PID 2144 wrote to memory of 3976	2144	msedge.exe	88
PID 2144 wrote to memory of 3976	2144	msedge.exe	88
PID 2144 wrote to memory of 4080	2144	msedge.exe	89
PID 2144 wrote to memory of 3152	2144	msedge.exe	90
PID 2144 wrote to memory of 4080	2144	msedge.exe	89
PID 2144 wrote to memory of 4080	2144	msedge.exe	89
PID 2144 wrote to memory of 3152	2144	msedge.exe	90
PID 2144 wrote to memory of 3152	2144	msedge.exe	90
PID 2144 wrote to memory of 1076	2144	msedge.exe	92
PID 2144 wrote to memory of 1076	2144	msedge.exe	92
PID 2144 wrote to memory of 2516	2144	msedge.exe	93
PID 2144 wrote to memory of 2516	2144	msedge.exe	93
PID 2144 wrote to memory of 4516	2144	msedge.exe	95
PID 2144 wrote to memory of 3200	2144	msedge.exe	96
PID 2144 wrote to memory of 4516	2144	msedge.exe	95
PID 2144 wrote to memory of 3200	2144	msedge.exe	96
PID 2144 wrote to memory of 5304	2144	msedge.exe	98
PID 2144 wrote to memory of 1324	2144	msedge.exe	99
PID 1324 wrote to memory of 4604	1324	msedge.exe	100
PID 2144 wrote to memory of 5616	2144	msedge.exe	101
PID 2144 wrote to memory of 5616	2144	msedge.exe	101
PID 2144 wrote to memory of 5660	2144	msedge.exe	102
PID 2144 wrote to memory of 5660	2144	msedge.exe	102
PID 2144 wrote to memory of 1176	2144	msedge.exe	103
PID 2144 wrote to memory of 3944	2144	msedge.exe	104
PID 2144 wrote to memory of 1176	2144	msedge.exe	103
PID 2144 wrote to memory of 3944	2144	msedge.exe	104
PID 2144 wrote to memory of 4664	2144	msedge.exe	105
PID 2144 wrote to memory of 4664	2144	msedge.exe	105
PID 2144 wrote to memory of 1032	2144	msedge.exe	106
PID 2144 wrote to memory of 1928	2144	msedge.exe	107
PID 2144 wrote to memory of 2480	2144	msedge.exe	108
PID 2144 wrote to memory of 3340	2144	msedge.exe	109
PID 2144 wrote to memory of 3340	2144	msedge.exe	109
PID 2144 wrote to memory of 1736	2144	msedge.exe	113

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\dev\header.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x25c,0x7fffbbc8c188,0x7fffbbc8c194,0x7fffbbc8c1a0
  2⤵
  PID:6076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1588,i,9556825488552506355,8296455673253461190,262144 --field-trial-handle=2160,i,9747438142862001433,7372099251112161331,262144 --variations-seed-version --mojo-platform-channel-handle=2156 /prefetch:2
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1804,i,17392532013838192511,11854546363485262395,524288 --field-trial-handle=2160,i,9747438142862001433,7372099251112161331,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2480,i,13776447987339707841,11025307537093839274,524288 --field-trial-handle=2160,i,9747438142862001433,7372099251112161331,262144 --variations-seed-version --mojo-platform-channel-handle=3136 /prefetch:13
  2⤵
  PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3524,i,8760645408735394095,11515687300863712814,2097152 --field-trial-handle=2160,i,9747438142862001433,7372099251112161331,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
  2⤵
  PID:5232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3528,i,14976567715123560215,6737299665946815370,2097152 --field-trial-handle=2160,i,9747438142862001433,7372099251112161331,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4188,i,17951586966080555665,1015072013252726818,2097152 --field-trial-handle=2160,i,9747438142862001433,7372099251112161331,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:1
  2⤵
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4196,i,18445908465771175811,7090781519680436465,2097152 --field-trial-handle=2160,i,9747438142862001433,7372099251112161331,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:9
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4220,i,5036431860843864795,4936348585661822157,2097152 --field-trial-handle=2160,i,9747438142862001433,7372099251112161331,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:9
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4208,i,12827635933605784837,1872545957691070303,2097152 --field-trial-handle=2160,i,9747438142862001433,7372099251112161331,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:1
  2⤵
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4888,i,12161088388560911708,16355073223037293419,524288 --field-trial-handle=2160,i,9747438142862001433,7372099251112161331,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:14
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,7820908346101099404,1118512826049914924,524288 --field-trial-handle=2160,i,9747438142862001433,7372099251112161331,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:14
  2⤵
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,16571732372977396885,17078839099161812450,524288 --field-trial-handle=2160,i,9747438142862001433,7372099251112161331,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,12303063585706816725,9158246764697169768,524288 --field-trial-handle=2160,i,9747438142862001433,7372099251112161331,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:14
  2⤵
  PID:3200
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,6777930740606960811,17345000649212685629,524288 --field-trial-handle=2160,i,9747438142862001433,7372099251112161331,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:14
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6184,i,6777930740606960811,17345000649212685629,524288 --field-trial-handle=2160,i,9747438142862001433,7372099251112161331,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:14
  2⤵
  PID:5304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6348,i,18018708514640363577,17610612983009965672,524288 --field-trial-handle=2160,i,9747438142862001433,7372099251112161331,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1324
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6452,i,4860502751155548287,12413483547633240152,524288 --field-trial-handle=2160,i,9747438142862001433,7372099251112161331,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:14
  2⤵
  PID:5616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6616,i,17283721948148625445,9019640847328873082,524288 --field-trial-handle=2160,i,9747438142862001433,7372099251112161331,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:14
  2⤵
  PID:5660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6776,i,8670221896473076085,17868252336817941886,524288 --field-trial-handle=2160,i,9747438142862001433,7372099251112161331,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:14
  2⤵
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6768,i,16478844584821934997,11843132121606988652,524288 --field-trial-handle=2160,i,9747438142862001433,7372099251112161331,262144 --variations-seed-version --mojo-platform-channel-handle=6744 /prefetch:14
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6872,i,11305001029756647037,15275553197860074930,524288 --field-trial-handle=2160,i,9747438142862001433,7372099251112161331,262144 --variations-seed-version --mojo-platform-channel-handle=6764 /prefetch:14
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,16302302810623490443,18152800694640432132,524288 --field-trial-handle=2160,i,9747438142862001433,7372099251112161331,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:14
  2⤵
  PID:1032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4184,i,10043679712368994372,13098288723990581609,524288 --field-trial-handle=2160,i,9747438142862001433,7372099251112161331,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:14
  2⤵
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4480,i,11657082587028690488,10846116053074554093,524288 --field-trial-handle=2160,i,9747438142862001433,7372099251112161331,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:14
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4940,i,16451280408478650967,7072218306980425030,524288 --field-trial-handle=2160,i,9747438142862001433,7372099251112161331,262144 --variations-seed-version --mojo-platform-channel-handle=1580 /prefetch:14
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5584,i,7094101873468990842,18111817692188851123,262144 --field-trial-handle=2160,i,9747438142862001433,7372099251112161331,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1736

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4664

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 994380ffd288a5f1a9acc9eb76a487a55b12cc1daec839d811240f6cbdc4da3a
MD5 f5ed4946834be586ac6410ed88740a7c
SHA1 6108ce368e8b3bb8012956bb25606c3b16835c7b
SHA512 76bf60b37c50422ab125edd3da70629e685408a106655a9b7e5cb6aa7b6a9000c76d8ac2f5dc85e58e893b61bef9b539b9488ac894f1fc1338a58944dc9f4711
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P77:fwUQC5VwBIiElEd2K57P77
TLSH
T1E5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 72d46989a95bf72ba8dd6bd7c103ed98f260bc4cd752291ffe0fe22ebe19ab9f
MD5 60b4b0010bde0a90da634b59e1cb3907
SHA1 cc222b898cc2c0a26787374e6d4beb3f730138c1
SHA512 fd728fee89e141a7515870d1f29e536b5420651941b86a563f1295b15306d28e8bce82285f7940c352d628f7ed9d42f20d2edad22cbf26376d8f5602ca287a88
SSDEEP 12:sf9iXhV0xosfxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxosfxWMk8xVTeYWI31BtXP
TLSH
T136254C85B34494FFC8835E7189BD27903774F6DF1F02966B6A77760E2E271C84B44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dcfc4c476f41db2d6042449b7b855b9751140e2127be8e8208aafd46a5893b7d
MD5 08e448ed3ad1512fa216c2eea50fff9a
SHA1 2d684e6af180cff0b8adea283dbb0c009102fc3e
SHA512 f9ebe4d980c84e665fbd9643a31fbc7a6b08028d289cd54ea7400acc1d6a7d231dd7952c9c49775207225efebf00cdaaf6a2b295dbeac8f234ed7bdfa52c4693
TLSH
T122D0C073050D0000EA0D41312073C7050313BB210E013C03B855F8381D708C9438F1C0
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 89ab71a3a4e732da8cbbe2e13ba149e13c94226b7119c8a0598106b99907544f
MD5 ca938be236bc251b79a4ee9dbf06dd19
SHA1 2ed95a78846a95a90b8d9b70e9cdc6188f0ce608
SHA512 caf4662a529a373a26b513e285938286f3af46a8729fb4c0be324b084fdba1e10dacca4b8f67585c4a5c6683f45dc7e259548eaf3ffb985905aeefbb7225e0e7
TLSH
T124D0C073050D0000EE0D41312073C7050313BB210E017D03B855F8380D708C9438F1C0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 4af25e80add28697c1791a52a1afd7d39c3673872ceda1c514a517332b179d4a
MD5 6ace2d30dcd05d1fc48b480453b3c724
SHA1 27e29714b110a7bd51a03fe544e190e6f951264b
SHA512 4de929a9eadd96be5ff2db6a60850da3081f5edf352badadee750a4f4eb5d7136078f83da6f30bfcf255f1188ec4700d87bcea167b4d425b32a75ac1da93f970
TLSH
T16661B4D2DA120DCFE371CA3284E5D60334F5918D8B937EA751440FB7A625F71F265509
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58afa4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58afa4.TMP
Size 3KB
SHA256 b2ebacc017d108de0e1de341c8ce72052cfc721ab13b810a5fcc93d1e320766a
MD5 90268d88feb267b96609a48c24c3994b
SHA1 bcf0e7193da494ec19bd69cff59e961b2a16d9a7
SHA512 9a700b64f2341394e051e303260f1dbdc8def4bc9c6c01689e99020e19823c9e34e3adad484e5baa638a15e4d05cef3be9f54399ff0fc42dc9813fe03a771774
TLSH
T12461B2D2DA120E9FE371CA3284E1D70334F1918D8B937EA752800FB7A621F71F225509
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\Temp\scoped_dir2144_1404611183\CRX_INSTALL\_metadata\verified_contents.json
Size 1KB
SHA256 d23b2ba94ba22bbb681e6362ae5870acd8a3280fa9e7241b86a9e12982968947
MD5 738e757b92939b24cdbbd0efc2601315
SHA1 77058cbafa625aafbea867052136c11ad3332143
SHA512 dca3e12dd5a9f1802db6d11b009fce2b787e79b9f730094367c9f26d1d87af1ea072ff5b10888648fb1231dd83475cf45594bb0c9915b655ee363a3127a5ffc2
TLSH
T12B317466C8683D56267A63348E2D0602EB57C2BB0050640EB5AC558D4F7115FE242FAF
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\Temp\scoped_dir2144_1404611183\CRX_INSTALL\manifest.json
Size 962B
SHA256 5694c91f7d165c6f25daf0825c18b373b0a81ea122c89da60438cd487455fd6a
MD5 e805e9e69fd6ecdca65136957b1fb3be
SHA1 2356f60884130c86a45d4b232a26062c7830e622
SHA512 049662ef470d2b9e030a06006894041ae6f787449e4ab1fbf4959adcb88c6bb87a957490212697815bb3627763c01b7b243cf4e3c4620173a95795884d998a75
TLSH
T1661121366E2FC4260AE00698DC51308AF92453ADD380850E35BCE42E5B744FA430631E
MD5 SHA1 SHA512 TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 759b12dc32c6fb766efd78dd100cccad559c5e823e3bdd920acbfdfeeddec9cc
MD5 a10b638a736f3c17f78526396c8d1fd6
SHA1 3936f574e17ea303dcb4783a5e09fec064f42b15
SHA512 29a47fa622bf00c49af3dbe0640d4a6ce0fb99e0399cdd906a2da24a30ada6fbf6788566c64b06a24e75ddb97381a9a188a1816054b513ffc0379d7902882829
TLSH
T1A841AFF3C6E8856EC91196F0BB28AE1BCE1D0A14432C3D5AC5E4AF1B93E3471E24155F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 d275a1607c01b012e02e34bc53c910cae93ef6f541ae905acd24398654016293
MD5 869eb3794bad67569b840be08e4a877f
SHA1 d97fb7be99bb2f4a1799a4dc27ca869d504447b0
SHA512 bae9d278f7cedd2a894260c9e9e9756894bcb16de423a4d008ba00f9fff4176d781a498a29a6640cce3a2282c4643abb4dd824deec6e91180ae7857cd3b327e8
SSDEEP 192:sxZVRmyM/jK1Ml8MF6/fHskDyX90XcHIdpyj/W6+WNGY01ejEIg4J:sxZV0d6/fHs6y2rI/bG5lc
TLSH
T18952F902AB3499B7CCCBD209FA517F53D6F85472A2900D48A9FCD60C01E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 ba79fe73f9625a8ce68082f619287bd58d099d6b0bc5f5244c15a84c0799f5fb
MD5 ab31609ef97a1287f569c703251f51b9
SHA1 84373e494671c331352a0eb92eaa45e5365c995b
SHA512 832685c7d12ea59a5a30218e151928890eb44c0f2a8d284884971402834232796d7dae50378cdccd990c2fb97689bdb75da28b0a41741f1c079d2c34360f89d6
SSDEEP 192:sxZVRmyM/jK1Ml8UQhF6/fHsFDJX90XcHIdpEj/W6+WNGY01/jEIg5O8J:sxZV0qn6/fHslJ2rq/bG5C5
TLSH
T1CE52FB16AA3499B7CCDBD209F9517F53D6F8547292900D48AAFCDB0C01E6AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 36KB
SHA256 244d1c6f22eb3ab2f19f3e33baafbb153265798d52120f31a6e24056062b6e16
MD5 2e60b717df5170dc3a74f955e9217c68
SHA1 e06dd7475e7396b8d53e8c0b029a74a4b077dbf3
SHA512 4abd22d1b877a340db8ccd0ae3bb40ce83d08fce7285b6542a991bd37946851c4db5c0ccb0239395760a69882dc9d677c51f25aeb1a04dfd3b5a78f8c49c02e5
SSDEEP 768:pu4bSV4b+8b4bm2qU7pLuLXG4bRWRmG4b/QB4bH8F1+UoAYDCx9Tuqh0VfUC9xbU:p9u+68si2qYEXl1WRmlzQqju1jaK+3Vk
TLSH
T1E7032B3B280CCB7E4F844E9CEC26BF9A6DE8029B5698885447FE454C03C66EF551B1DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 ef6e4c770e427f96e6ac811daf962dd19876ffe45dddbb62b08fbc10662cac1b
MD5 4cec66c1a23118a91a57212023f5c75a
SHA1 66474713d00141866bf303b55bdba0f78d1e1c36
SHA512 3600d23bb4456322e7aa373f461463a7fc4ad60619bbfcba179191704e4bd22dbcc86be0c35a748fa47a66c4bdc48804962aa0c4e1e719eeeab4a08331769bcf
SSDEEP 96:KA9uKWoy2lmKmABIaIbIoI0IiIgIQIFlIcIpI4vI8IFKnI0vISIFDI6ICIRIcIw+:8x10IaIbIoI0IiIgIQIfIcIpIwI8IWIv
TLSH
T160918352707B13463D7D26489360872B9B82B5E3355D6C2B3BAC65E61E27E104EFD4CC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 336433ddce4ae41505b5c7f0b7bf95e308123041efcd3a22421620e605664dc6
MD5 f03c8d6ec2f0367e2978275a1ea84976
SHA1 bff756cadc4e3eb6a7e131526f49f703cc6ac81e
SHA512 0c9e6506ee7a0230779ad7f29f3d22f71580b25ded88f2f66f0b745dcdc7377e02540ded6ccd99ed99c9ad9e90c425a49f544499b73b26050ac27a50aa573f31
SSDEEP 384:ngtNnNnb948N59xSm6A4jr3b+A08wCXg98jZALEnP5z6:gjZbeJfrpe6g96Fz6
TLSH
T16F927D326939ADF75AF26945F90B32475FB801A795C43FC4D6ECAB1C05DB29C130AC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 e01fad63645f74463a363648d49e904cc0c9ec3673042ffe276588997f32542e
MD5 824356e9efa2c289894f6fcdfe8779e4
SHA1 74bbbc140908223657c08a1c3c59fd667d96ddb3
SHA512 66e9fb8bc73efbac93574093213c882b73feae0d0fbb1b176028c878ca3e1eb6fe5d9fa556b2add9d9f68a4ffde29e8ad6d0bb38c706f9d68e277d6d894e7b6b
SSDEEP 384:n8tNnNnb948N5hxSm6A4jr3b+A08wCXg98jZALEnP5z6:8jZbeJfrpe6g96Fz6
TLSH
T152926D326939ADF75AF26945F81B32475FB401A799843FC4D6ECAB0C05DB29C130AC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 a9964c0b87abaaa53d2234bd1b820158d73161eb7650ebddb16f5b59d907bdcc
MD5 ae6a61c905e26e34b91d5079db99082a
SHA1 a59cd3cb4720b379a3adddf76deba163844a374a
SHA512 2f8a014cdfc89ea7ddf3ca53d366221d8e8715d75fb3537b8f4314bf96b0c6baae624c2f6a2cec98b622bd3b85042e8eb8998864c7de6b3a55b28c200bfcc90c
SSDEEP 384:nCtNnNnb9O8N5cxSm6A4jfDfcF3b+A08wCXD98jZALEnP5z6:CjZb8MEFrpe6D96Fz6
TLSH
T184A22935E835DEB7A9F25685B60B72879FE401A745CC2EC4DAEC6F0C05C769D130AC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 cf985e4fe071e4220869882a89c7103c4d4f3311ef03f1d26231cfe95c85497d
MD5 514d6631278e5c52905f4ed43b171274
SHA1 156cc89a6e6120656222eace0a63625c4a60c2ac
SHA512 8bb28bb13856d8d7ebfee7102080ab23d9d31d67b12d90ed7dcf1df16bef38f067ed4472303f2f58dfe972bb67a706fa0265b69dc9d44a0dd76f7519881e9e65
SSDEEP 192:nRGNK6yMQmiUy9oJmv1Y3b+jckjzorrLoWCMnyEdU6:RGNK6xBc1Y3b+A08wkfdU6
TLSH
T1A002F935BD786CB79EF26E45B48727138FE8113BDA952F84D6E82B0C04D765C2307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 dbcc7962c2652b82b7c92ae2d137a0c6ae93c6fc9bb858e96d7d78e774e20e6a
MD5 95d902e885af0484b925a35f1f5196c3
SHA1 4fc74fec029efe472a1d26b9b55acc2f50325370
SHA512 b0b52e88a9d3878a671beedb62f75e2994fb2a76f25616c83243137dbd2dd5ca86167c938960f01f5568160386bf45309fab30e38f233d1157fd1cace01133e6
SSDEEP 192:nRGNM6yLQmiUy900vxY3b+jckjzorrLoWpX+4MHqyU6:RGNM6IOxY3b+A08wCX29U6
TLSH
T11412F935A97CBCB75FE26D45B88732139FE8116BD9856F80D6E82B1C04CB65C130B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 3477ac383177c6947a172310093b0762cf4d4902ce38680fd9bbe74bcc2c9cee
MD5 b41f080d932a0632b79800cf6de5a676
SHA1 1eee9937c0f6074e54fb6f9ea13e175bfd406383
SHA512 4b5a9882c984e13d74f3898d31a52b4691e5b791f92287d2003bf36014f762e8998bfff6bc3f3ac74d28eb002ab0e5228ad7fc92a7f8cc72d86485efe653a6d3
SSDEEP 384:nYtNnNnb948N5cxSm6A4jr3b+A08wCXg98jZALEnP5z6:YjZbeMfrpe6g96Fz6
TLSH
T1B9926D326939ADF75AF26945F91B32475FB401A799C43FC4D6ECAB0C05DB25C130AC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

af7b261c-3ad7-4906-9aa4-c6909660ac2a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\af7b261c-3ad7-4906-9aa4-c6909660ac2a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

2c46d3b5-e49e-418c-a1df-d47b0934afa9.tmp

Path C:\Users\Admin\AppData\Local\Temp\2c46d3b5-e49e-418c-a1df-d47b0934afa9.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

7986c765-4d97-4bd5-8d71-2c7129d825ac.tmp

Path C:\Users\Admin\AppData\Local\Temp\7986c765-4d97-4bd5-8d71-2c7129d825ac.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba91c406-1c4e-45b7-92e5-7ca139b51277.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2144_103564253\ba91c406-1c4e-45b7-92e5-7ca139b51277.tmp
Size 147KB
SHA256 d766e75ceffe993aa1dadd5619b24043a0ebe9a9689a6796d19d88bf952683d4
MD5 a9f7675ff091bb15c88909424bab4a39
SHA1 90f753d8d7e4397de0f49631fcd9222a7f59148c
SHA512 ff1f89fb04ae9c9a4c6cf6b1475f5a77f1c4f90829acda95cb39889b6b15c3b4f0b3b822a668f8ec8520b002cc90dd397cc26d314ac8fd5f3e2c9826bd458df5
SSDEEP 3072:Ph3iICVe1DvTtr/3tOpPu8LdKBTJyU4AshzWnD7UVDvuZE4tkGL:PgTVWvTZPghwln0AD7UV8Eeky
TLSH
T12BE3E01D29E2846EC82B24F4BA4A718FC71ECF07910BE40F25D984A55C7474E17E2EED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir2144_465060383\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download