bf59a74b4404aa0c893ca8bbe636498629b6a3acdff4acb84de692462fd626e4

Analysis

max time kernel
599s
max time network
503s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/06/2026, 13:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LICENSES.chromium.html
Size 5.2MB
Sample260620-qq5dcsfs8j
SHA256 bf59a74b4404aa0c893ca8bbe636498629b6a3acdff4acb84de692462fd626e4
MD5 4247afa6679602da138e41886bcf27da
SHA1 3bb8c83dc9d5592119675e67595b294211ddbf6e
SHA512 ad3103f7fd32f0ec652bc7fcb8c303796367292a366037acad8e1312775cdd92c2f36ed8c34a809251ad044508e1e7579b79847de61025baf8bda5ad578a0330
SSDEEP 12288:/7etnqnVnMnBnunQ9RBvjYJEi400/Q599b769B9UOE6MwMGucMEbHDuX0YnpWQZG:sPMM5FaWStHvmUKItmfDTeHiVQZp4
TLSH
T1D546B62F7B48037306C242627B8BA5CAF21E903F3B565654345CD1681B6BE2983FF6D9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3936	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134264359074036166"	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2894455325-857903158-4263030270-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2894455325-857903158-4263030270-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2894455325-857903158-4263030270-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2894455325-857903158-4263030270-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2894455325-857903158-4263030270-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2894455325-857903158-4263030270-1000\{92A74148-5EFE-4B05-A369-E64BA96F5812}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2894455325-857903158-4263030270-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2894455325-857903158-4263030270-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5712	msedge.exe
5712	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe
4252	msedge.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 4252 wrote to memory of 2672	4252	msedge.exe	88
PID 4252 wrote to memory of 3940	4252	msedge.exe	90
PID 4252 wrote to memory of 3936	4252	msedge.exe	91
PID 4252 wrote to memory of 3940	4252	msedge.exe	90
PID 4252 wrote to memory of 3940	4252	msedge.exe	90
PID 4252 wrote to memory of 5964	4252	msedge.exe	92
PID 4252 wrote to memory of 5964	4252	msedge.exe	92
PID 4252 wrote to memory of 1744	4252	msedge.exe	94
PID 4252 wrote to memory of 1744	4252	msedge.exe	94
PID 4252 wrote to memory of 1744	4252	msedge.exe	94
PID 4252 wrote to memory of 3140	4252	msedge.exe	93
PID 4252 wrote to memory of 3140	4252	msedge.exe	93
PID 4252 wrote to memory of 3140	4252	msedge.exe	93
PID 4252 wrote to memory of 564	4252	msedge.exe	95
PID 4252 wrote to memory of 564	4252	msedge.exe	95
PID 4252 wrote to memory of 564	4252	msedge.exe	95
PID 4252 wrote to memory of 2688	4252	msedge.exe	96
PID 4252 wrote to memory of 2688	4252	msedge.exe	96
PID 4252 wrote to memory of 2688	4252	msedge.exe	96
PID 4252 wrote to memory of 1200	4252	msedge.exe	98
PID 4252 wrote to memory of 4512	4252	msedge.exe	99
PID 4252 wrote to memory of 1200	4252	msedge.exe	98
PID 4252 wrote to memory of 4512	4252	msedge.exe	99
PID 4252 wrote to memory of 3624	4252	msedge.exe	101
PID 4252 wrote to memory of 2120	4252	msedge.exe	105
PID 4252 wrote to memory of 2844	4252	msedge.exe	106
PID 4252 wrote to memory of 2428	4252	msedge.exe	107
PID 4252 wrote to memory of 5200	4252	msedge.exe	108
PID 4252 wrote to memory of 5200	4252	msedge.exe	108
PID 4252 wrote to memory of 5712	4252	msedge.exe	110
PID 4252 wrote to memory of 4060	4252	msedge.exe	111
PID 4252 wrote to memory of 2480	4252	msedge.exe	112
PID 4252 wrote to memory of 4060	4252	msedge.exe	111
PID 4252 wrote to memory of 2480	4252	msedge.exe	112
PID 4252 wrote to memory of 2708	4252	msedge.exe	113
PID 4252 wrote to memory of 2708	4252	msedge.exe	113
PID 4252 wrote to memory of 3716	4252	msedge.exe	114
PID 4252 wrote to memory of 3716	4252	msedge.exe	114

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x268,0x264,0x288,0x7ffb298bc188,0x7ffb298bc194,0x7ffb298bc1a0
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1552,i,18438765659693401100,17190791841015303063,262144 --field-trial-handle=2984,i,10937030952762204526,16182234362703399979,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:2
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,12716024068209030210,17793188804259090004,524288 --field-trial-handle=2984,i,10937030952762204526,16182234362703399979,262144 --variations-seed-version --mojo-platform-channel-handle=3392 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2396,i,8253119920990020446,1074961281821606200,524288 --field-trial-handle=2984,i,10937030952762204526,16182234362703399979,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:13
  2⤵
  PID:5964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3340,i,14330584294295860199,14901034675507979565,2097152 --field-trial-handle=2984,i,10937030952762204526,16182234362703399979,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:1
  2⤵
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3332,i,636111829869971887,16700381023317075167,2097152 --field-trial-handle=2984,i,10937030952762204526,16182234362703399979,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:1
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4244,i,3438035825096298109,5011833031187932527,2097152 --field-trial-handle=2984,i,10937030952762204526,16182234362703399979,262144 --variations-seed-version --mojo-platform-channel-handle=4560 /prefetch:1
  2⤵
  PID:564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,3052412742775485829,9093923059679347843,2097152 --field-trial-handle=2984,i,10937030952762204526,16182234362703399979,262144 --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:9
  2⤵
  PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,14590934439674577709,10377472066854401482,524288 --field-trial-handle=2984,i,10937030952762204526,16182234362703399979,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:14
  2⤵
  PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5304,i,12016106564236896127,14540689777275557921,524288 --field-trial-handle=2984,i,10937030952762204526,16182234362703399979,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:14
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,3188437127528668291,817886306979002797,524288 --field-trial-handle=2984,i,10937030952762204526,16182234362703399979,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:14
  2⤵
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6056,i,3188437127528668291,817886306979002797,524288 --field-trial-handle=2984,i,10937030952762204526,16182234362703399979,262144 --variations-seed-version --mojo-platform-channel-handle=6036 /prefetch:14
  2⤵
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,13160360938896352621,450915741768346368,524288 --field-trial-handle=2984,i,10937030952762204526,16182234362703399979,262144 --variations-seed-version --mojo-platform-channel-handle=4684 /prefetch:14
  2⤵
  PID:2120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4676,i,12414097490321662979,435638343360946295,524288 --field-trial-handle=2984,i,10937030952762204526,16182234362703399979,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:14
  2⤵
  PID:2844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,12690093221389158822,14705831047184340962,524288 --field-trial-handle=2984,i,10937030952762204526,16182234362703399979,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:14
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5644,i,7098974614018114442,11609120662493869875,524288 --field-trial-handle=2984,i,10937030952762204526,16182234362703399979,262144 --variations-seed-version --mojo-platform-channel-handle=3064 /prefetch:14
  2⤵
  PID:5200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6468,i,9302352420116709895,5932064083051531203,262144 --field-trial-handle=2984,i,10937030952762204526,16182234362703399979,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5500,i,16774920764517154099,6526003684591431910,524288 --field-trial-handle=2984,i,10937030952762204526,16182234362703399979,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:14
  2⤵
  PID:4060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2572,i,4497366078939227506,7056931748560341999,524288 --field-trial-handle=2984,i,10937030952762204526,16182234362703399979,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:14
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4724,i,7794274825950445926,5035189691789915284,524288 --field-trial-handle=2984,i,10937030952762204526,16182234362703399979,262144 --variations-seed-version --mojo-platform-channel-handle=4700 /prefetch:14
  2⤵
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2380,i,16810727227840870993,7005669120883687361,524288 --field-trial-handle=2984,i,10937030952762204526,16182234362703399979,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:14
  2⤵
  PID:3716

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4288

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4196

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

0ceba8b2-4c4c-48a0-af8c-8b4b391fea64.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\0ceba8b2-4c4c-48a0-af8c-8b4b391fea64.tmp
Size 38KB
SHA256 0204b03b42da2440901cfb5bc073de545d26dac01437bcf6c821bf1e47305fbd
MD5 cfcd112fd7dc436e0d67c79aee356807
SHA1 cb9c004a61157234459492cb42a7f153c498efce
SHA512 9d9ddcf9c31f468fd6b5c344482d7c623fc70c82f4beb7f6f7dcd7269de8cd7a0826453bc1231024185988a556062271c78b600331f1afec980e7c69b6c38415
SSDEEP 768:ZkjaeqD4MlshiLdMmJ31UIcO7TgDOa75riXYUsZUgb9eHU/+ApXTcHT+:ZkqcjhIdMG3176iIUsZUgb9sa+KXP
TLSH
T1FC03C07999A48C678CF2D6C5B36765472FB941E386C56ACCD8CC6B0D02E32DE530782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4921dac989a582c68ea2ce6e44eb3bfcd7f8bf3d87dd155763734d09e46d6684
MD5 6fe58dba083868c4939df3729856b544
SHA1 2946fc6a531247a5afe5d20c0abec1329e76da1f
SHA512 435b892e3c3ced9c341bcad7627e98220f381783f6c0d232345dd92e9cb28357bd93211262aa046fe541f6bd0686d5084ac7e92c687fc72829288aa7d9c823de
TLSH
T1B7D08034FB45B745C78605F2D514A720637A864534C2C60DB1A2D50D98681D0B7E79F7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0f06119439d622a1a5078cf90d2c84d55bc25c179cc319a31bc271a3e62dc8b5
MD5 39897ff436f6a2795449c696417893df
SHA1 b1e15f7b2c6f5ca94bea9d8a160cc9e6864c1d06
SHA512 75fae24fb44003376ccf64d6c3715357ca6f73fb6cca4422a2574a4960dc75c830ef617f5476e7fc21942b321e9fe764ebf9ae64abfc2b05a73fdd7fb96ad95e
TLSH
T1F2D08030FB45B745C78605F2D514A720637A864534C2C60DB2A2D50D98681D0B7E79E7
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 de917ed2e4c65d5a9fd0de97fd53b45f6bdaa723805f91421e945196d8a7751b
MD5 f6cc700a71455a4937e841d89ed516c3
SHA1 8670b75889dc804f0b2725e0b2ffdd4c8b470c18
SHA512 33aac0cbd143773256d65fc9cf59ea51043bbb9a67d02c234c9e42e051d1cbf2bb6eb58df00b73449a50c259129ef24f232337ecfa663426bff817dc54d00c51
TLSH
T1A8E026C445CAC32FE30076DB816C634C8384360ED2C8AD8E6704CC847046644B3C6ED1
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 e1560a67c581ddfeec226df01c2bcafc496f4bc8d39cfeaee71404f61de870db
MD5 e861e0247596d0db7a36b361490b9f8e
SHA1 66f072d46e39eb94eee1fbaf81c8f620d3a84326
SHA512 9f034a1ea94404485f8c2b1628777ff44bbe16b344cc21f78a7072f9b45680a40c3698bd294f9c26a5f9345196af0bc5aac04d7553bfd24b09f170b6c5980616
TLSH
T1DB716F6C49F10FD2FB28047872DA36E53B749AC28E87DF1152986074BF4334AE4AB4C2
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe592447.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe592447.TMP
Size 3KB
SHA256 acda729218d19dbdbfd5306459cebb3e532da79ff03c1a715477c66b0dc0d41b
MD5 f60ea106ec016c115ccf5f055b91c584
SHA1 b5f8f45ab94a00a69aa6d081b69fe39452e7b42d
SHA512 3a8cbc03d56e91eebee1050d64eff5c862f2728d62d6e7f5ecf570d848b59bf4eb868cc6aa716d372bc89cbcdc810f26d27a00b319f5ed90be1edb8f46056aaf
TLSH
T1F671616849F10FD2FB28047872DA35E53B7496C28E87DF1152986074BF4334AE4AB4C2
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 527a741e4a32eb6d0f2e2241674a996f8b03a9ba8461bc51cd26d2eb91927518
MD5 56af98ce7a67638a8165073225197f83
SHA1 09bca91a8d31dea6651561e57dfcb7f45671c42a
SHA512 c4995e07b6bc714419ffef8797309b251005464d454714de5781bb17fdd317e1c7532f38a57980daac7e1ab5dc6d3b7cf0514a3061bb15d74c8c195b5bd7ba66
TLSH
T19B41ACF3C3E4866D991146F0BB187E2BCE1D0954832C3C5AC9E4AF5B93E2471E14195E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 8247813a3167a49f41523a1d742c5dd4b0fd1a501e2b0e26c77e862cc84e8e65
MD5 38140905fbb1d692876aca5c62d9a949
SHA1 bf017d24be91a380b2bf2f86101fdd9450524be9
SHA512 9d773ec81d2679445bfb5b1add83c7cf80ee644ef95191d99b7b6abc35da1d5a714f263c2c3019e5ea71527f437f997d2d84488b3449e65b9165df2b2a1021e3
TLSH
T15B41CDF3C3E8866D991146F4BB183E2BCE1D0954832C3C5AC9E4AF5BA3E2871E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 929e37b07c2e65fc49b78f9d8cce225c45b88eb333893b2620445ad4956cb0a0
MD5 842081dfeb4a87c642f4672c2d4dde1f
SHA1 ab0b9ba56819032652e3e78d6744ca90c5c1f6d7
SHA512 c86164e997510b1d72de44121dbbffd2800dc8b721f63103c468d12eab33454d52f313a1b25bacee65edf84bf391bfda823ee540f7d0794e5240f8ca7809e3c3
SSDEEP 192:sxR+R7yM/jK1Ml8wF4/fzs+/IyhzoA8p4CU/g6+WNIYPPUWGUHIgDYJ:sxR+jb4/fzs+/mlU/5ILKHI
TLSH
T10662C9166628597BCCDBD20DFA457F53D6F91473F2941E44AAFC8A1C00E6AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 328d63ca13a495a4cba761eb4bc0f4d2f63c25bc7f334c184d3a29957d326bbc
MD5 7b30d3b51721317bdfcc26c280266176
SHA1 78fe2d87fc53c81391c332ebb92b30ca4cff34c6
SHA512 373f3055ef94e6317d6cd9eda0192b254460feb96a45029935d1578ebe8e9786cf6b22687f1cc35bd14e146a2cf7435ae9750b7a40fc7b89d293a966f33bf43f
SSDEEP 192:sxR+R7yMqZjK1Ml8UQmF4/fzs+PIyhzoA8peCU/g6+WNIYPPUWGUHIgDqJ:sxR+cq04/fzs+Pm7U/5IRKHC
TLSH
T14462D7166A285D77CCDBD20DFA857F53D6F95472B2941E44AAFC8B0C00E6ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 2763d342eecd300363064785dbb6a497c7fd87e341be97c1e776c726743c1dc7
MD5 6cf6cfc7d33c354179608a529e1ce679
SHA1 d086ab779e6fbec18b706a998ec5b62abc47113b
SHA512 ae53ed07446fdfc6696bef54966860478f56c05151e237998473a6703097a19c1b36f44a1f184e46a38d9369e022588cca4f4ad00047e041d53af2b34fa66148
SSDEEP 192:sxR+R7yM/jK1Ml8UQmF4/fzs+PIyhzoA8peCU/g6+WNIYPPUWGUHIgDqJ:sxR+jq04/fzs+Pm7U/5IRKHC
TLSH
T15F62C816A628597BCCDBD20DFA457F53D6F95472B2940E44AAFCCB1C00E6ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 50bba0da38a8c203c57412f7fa0f2f5ac1e655fa04635ba39a911aaf0ba75466
MD5 ea436976cd84a0f145fcba00c4deb5e8
SHA1 65a2da57d667c68f5725f8a153d0697915099af2
SHA512 0cae9faa3e97f284e555b60587dc597b5168f7d46cd4152a4b712ae98864459365df6f0bdf7abee6426605b94e4239b08e6ff55be3666ca531f3b883532d3865
SSDEEP 192:sxRBR7yM/jK1Ml8wF4/fzsI/IyhzoA8p4CU/g6+WNIYPPUWGUHIgIJ:sxRBjb4/fzsI/mlU/5ILKHs
TLSH
T16552D9166628597BCCDBD20CFA557F53D6F91473F2941E44AAFC8A1C00E6AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 7da915d4ba35b28318e4e506d8d89f40ad6147e2109838c10bcb03fc507532d4
MD5 2077f5325e3f027b9578b6bd8b50dd05
SHA1 ac3600800fb9b80eeb4f67e506212c940cb1ced9
SHA512 0ae4e8b3c3be7024797f568e48579da7fec843ecccb3dba6796ac9892b55454ba5d0d81111367f0e941e70bf049a27fe295a069e9aed3b32ec313d1d688a8e6b
SSDEEP 768:LKKg6xWgdVf7k8F1+UoAYDCx9Tuqh0VfUC9xbog/OVJ3nYMrouevdWSm3:LKKg6xWgdVf7ku1jaY3YXuevdWSm3
TLSH
T179C20C2B240CCB7E4F844E9DED26BE9B6DD801CB97584D9447EA880C03D77EB521A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\fafefb68-86fc-4b9c-913f-97d110b2636b\index-dir\the-real-index
Size 768B
SHA256 d6b7c4d94c620ab4df2d01ac43a605176be7c68d89d59b1fe6c43d30b1cc428f
MD5 b88c07d104a0394042bb711395238dae
SHA1 5be2fd349557a818a305cc07dfa0098e9f70a4fb
SHA512 61aa60d30d82fa5345ff45f61e1d5471722fdc0d5edb09521c901da18edf710231a0006ee966dbc5f69a932dfdc0f6bd726a26d352304ba61e5ad83bbcae026c
TLSH
T13501E1E5DCE03A82CE30297926B1300C233747FC4908954311BCB46CCC57BB429512D8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d66bb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\fafefb68-86fc-4b9c-913f-97d110b2636b\index-dir\the-real-index~RFe5d66bb.TMP
Size 768B
SHA256 2bab6e3bc098302382aabb1039e73d9db7e7d9d45aa1ca755e6995128cb607cd
MD5 94bc55b92678fdd9b647a6996f332969
SHA1 5a1a38be3f7100634a6a528226fcac70d2b0d94e
SHA512 6bdcc515d9f10876d1ff5e37ec9432258418a6a4b3a36fcc249aa8d7017ac32d4832d9fb92af8374ad76866d926f1a4870bb2bb565b8971167b882517f97b346
TLSH
T18501C0E2E5E13EC6CE1116B4AA92900D337B99745D04CA0750E0E12C8CA7B6436A41DD
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 952c2ce1dc335d7b08c7927681485e1a8eadbf15f326097b4a327c04a11c9d9d
MD5 37e4540a40706abcd7dbc3114f074085
SHA1 71185822deed50d6986a68ca796007f2d87938ae
SHA512 5998cec895195100fb994fa024a0dbd77abb6f7efd0e010ed6626a8e92c50c3f7b97e7263e9efc8d9005868e9cd1ec11b486c2295d948b0e4341de55aeb74ecf
TLSH
T1E6E068B23AE72434FE6F83D214714CA90200B8949504EC5F507962C344A33582896C2A
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 eb0bfd6fd48adc4e527de3be04aba2d3d1051ba0873be2a0740081a8d6b341e9
MD5 51d86e779d8310a1e1475b17696cb074
SHA1 552177387ff9efd3a8c45eb1b24adeee3b0ea95e
SHA512 5a00267a6b683f70432a9a2b832c69f1eb61b06a2726adf416bd364248405ef4562f45116f3e846316c20f21ce165a9fd6f386fb63e4a4dd0c67a8b33e4143fa
SSDEEP 96:KApKKSEqenOKU8Zb6HbN11OrF0VN7OKF7NpORD7M5rPd:odZ/7d
TLSH
T14F916404797E62102CBE3458A0A18D2E234974F736AFA57B7B6D10FA1D6AF001EFD4D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000001.dbtmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\000001.dbtmp
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59bf20.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59bf20.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 20aeed989e2b7c17eaa286695bd2c18cfc84b0a8e4d5ed09db458cac1684c2b7
MD5 dfecaa4796ccff27b18e6704078dc371
SHA1 0e86534d90aef6af5bc1c8234a74aaa85cda4f0a
SHA512 cbdae66dcf5a673f3a6e4e21a767d4e4b1449f2ea757bc803a27d50de430bbbbf91950dd4b7dd2e6013a42ec3813e33a0644f61a0efc2b8e8ff5e37c6dbccdd6
SSDEEP 768:BqjaeqD4MlshiLdMm83D+cO7TgDO5xt175riXYUsZUgb9eHcV+ApXTcsTJ:BqqcjhIdM33INiIUsZUgb9sQ+KXP
TLSH
T14713C0B59DB4CC678CF2D6C5B267B5872FB441A386C569DCD8CC6A0D02A35DE430B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 a706c23ec77d2b0694e85383af5f547dcbc970cbcb7eaab6e96ea6469ecc33d2
MD5 ad00d37201525ccadbfcfb29fd974601
SHA1 10a197ebf4254097d10b8f5552d4ad2ed79cee15
SHA512 a56edea3e9bca3a0a4a63f37b2626ccf791660774cb0e4aefb40b6284cebae94adc4fb00f8f150a6abe35408f0a29a3ef8b3b13c1baf702b1b49d4788d4d0646
SSDEEP 768:Rlj+9S3v9+cO7TgDO5xtY75riXYUsZUgb9eHcV/+0Fv+:RQ9S3eiiIUsZUgb9sQ/Zv+
TLSH
T118F2CF71A9B5DCA34CF196C5F22B728B2FF441A380C659C888CC6B4D06D76AD430FD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 35519fedb99b446971dbc8f414df087b42da794ecb73385db1ae17c19b76f9eb
MD5 97fb95b2de4bcc7c866f97349e612269
SHA1 e613992caa04697c7a44190af88d5a8a462d00c0
SHA512 577a7bef24e99fb30e0aea96d22f8ed96a55172a206bbf0b2b64cfacc8dcd1c15db63a27057882c22670ab91d123482c508bb9ace392da0461f83c2255aacfdf
SSDEEP 768:pBF1j+9Z3bwgD9+cO7TgDO5xtZ75riXYUsZUgb9eHcV/+0Fv+:pA9Z3UViIUsZUgb9sQ/Zv+
TLSH
T19A03B07299A4CD6B8DF59BC4F62A724B6FF001E384C6A9C49ACC6E4D01D72AD034FD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download