011272cc042e7dcb546a33ac78eb31c69e1f5f02be70104e213a06750268f73f

Analysis

max time kernel
148s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/06/2026, 18:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
L1/assets/load.html
Size 1KB
Sample260620-wtppzagt8n
SHA256 011272cc042e7dcb546a33ac78eb31c69e1f5f02be70104e213a06750268f73f
MD5 af275cfc0efa2d0833d5126957124194
SHA1 3c8fc36e65b967d0c15cdad3b4d87d2c3ed56b3f
SHA512 ae2e4282494b6ea2df2f079d7c1a725da547846678f51af6a1c80703f3b656c642a55a1bb8a0281c2c2034607d66831a262b6a59aa4b2ec3277093224f31593b
TLSH
T1E821F1492C835204BAAB626947FE75083267A107350DCE08F88CC3E49F85B6A912B5DD
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2176	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134264527903269719"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{A6F4BA23-BD11-4B5B-B498-0077ECCF6480}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{57A46244-7AA5-42BC-AD57-E3D001CAFBAC}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1532	msedge.exe
1532	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe
4372	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 4372 wrote to memory of 2320	4372	msedge.exe	86
PID 4372 wrote to memory of 2176	4372	msedge.exe	87
PID 4372 wrote to memory of 3284	4372	msedge.exe	90
PID 4372 wrote to memory of 3284	4372	msedge.exe	90
PID 4372 wrote to memory of 1928	4372	msedge.exe	88
PID 4372 wrote to memory of 1928	4372	msedge.exe	88
PID 4372 wrote to memory of 1928	4372	msedge.exe	88
PID 4372 wrote to memory of 3944	4372	msedge.exe	92
PID 4372 wrote to memory of 3944	4372	msedge.exe	92
PID 4372 wrote to memory of 3944	4372	msedge.exe	92
PID 4372 wrote to memory of 3940	4372	msedge.exe	91
PID 4372 wrote to memory of 3940	4372	msedge.exe	91
PID 4372 wrote to memory of 3940	4372	msedge.exe	91
PID 4372 wrote to memory of 4972	4372	msedge.exe	93
PID 4372 wrote to memory of 4972	4372	msedge.exe	93
PID 4372 wrote to memory of 4972	4372	msedge.exe	93
PID 4372 wrote to memory of 1120	4372	msedge.exe	94
PID 4372 wrote to memory of 1120	4372	msedge.exe	94
PID 4372 wrote to memory of 1120	4372	msedge.exe	94
PID 4372 wrote to memory of 4156	4372	msedge.exe	95
PID 4372 wrote to memory of 4156	4372	msedge.exe	95
PID 4372 wrote to memory of 4156	4372	msedge.exe	95
PID 4372 wrote to memory of 2008	4372	msedge.exe	100
PID 4372 wrote to memory of 2008	4372	msedge.exe	100
PID 4372 wrote to memory of 1536	4372	msedge.exe	101
PID 4372 wrote to memory of 1536	4372	msedge.exe	101
PID 4372 wrote to memory of 4992	4372	msedge.exe	104
PID 4372 wrote to memory of 3556	4372	msedge.exe	105
PID 4372 wrote to memory of 3556	4372	msedge.exe	105
PID 4372 wrote to memory of 3556	4372	msedge.exe	105
PID 4372 wrote to memory of 3852	4372	msedge.exe	115
PID 4372 wrote to memory of 4612	4372	msedge.exe	116
PID 4372 wrote to memory of 3852	4372	msedge.exe	115
PID 4372 wrote to memory of 2640	4372	msedge.exe	117
PID 4372 wrote to memory of 4804	4372	msedge.exe	118
PID 4372 wrote to memory of 4056	4372	msedge.exe	119
PID 4372 wrote to memory of 1120	4372	msedge.exe	120
PID 4372 wrote to memory of 1120	4372	msedge.exe	120
PID 4372 wrote to memory of 1120	4372	msedge.exe	120
PID 4372 wrote to memory of 712	4372	msedge.exe	122
PID 4372 wrote to memory of 712	4372	msedge.exe	122
PID 4372 wrote to memory of 1532	4372	msedge.exe	123

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\L1\assets\load.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff9a6fcc188,0x7ff9a6fcc194,0x7ff9a6fcc1a0
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1816,i,6802063634704185018,3133022935014953795,524288 --field-trial-handle=2264,i,17801177935280348566,4841481992780580171,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,12856026687822855392,6610875259973591011,262144 --field-trial-handle=2264,i,17801177935280348566,4841481992780580171,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:2
  2⤵
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2440,i,14336140854148500267,6654851380740962347,524288 --field-trial-handle=2264,i,17801177935280348566,4841481992780580171,262144 --variations-seed-version --mojo-platform-channel-handle=2436 /prefetch:8
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3412,i,3493073358975726043,3717486456999279831,2097152 --field-trial-handle=2264,i,17801177935280348566,4841481992780580171,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3416,i,3783596304601107195,5677577413091808820,2097152 --field-trial-handle=2264,i,17801177935280348566,4841481992780580171,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4152,i,15038531850200765590,8081237269389814754,2097152 --field-trial-handle=2264,i,17801177935280348566,4841481992780580171,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:1
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4176,i,14911059150183242162,10222578139381214580,2097152 --field-trial-handle=2264,i,17801177935280348566,4841481992780580171,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:2
  2⤵
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5096,i,5977438836013720335,8786651364633202703,2097152 --field-trial-handle=2264,i,17801177935280348566,4841481992780580171,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3492,i,883274367625411012,5211554996851798987,524288 --field-trial-handle=2264,i,17801177935280348566,4841481992780580171,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:8
  2⤵
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3904,i,9741597656438432526,13818984403833845432,524288 --field-trial-handle=2264,i,17801177935280348566,4841481992780580171,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:8
  2⤵
  PID:1536
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,1818075065628631512,1695837467946851792,524288 --field-trial-handle=2264,i,17801177935280348566,4841481992780580171,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:8
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,1818075065628631512,1695837467946851792,524288 --field-trial-handle=2264,i,17801177935280348566,4841481992780580171,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:8
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3856,i,16934246329012049979,16492945839138177580,2097152 --field-trial-handle=2264,i,17801177935280348566,4841481992780580171,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:1
  2⤵
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3556,i,11572366341914147261,12146882814080841084,524288 --field-trial-handle=2264,i,17801177935280348566,4841481992780580171,262144 --variations-seed-version --mojo-platform-channel-handle=3392 /prefetch:8
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3500,i,17674866099360962349,7011542986592078249,524288 --field-trial-handle=2264,i,17801177935280348566,4841481992780580171,262144 --variations-seed-version --mojo-platform-channel-handle=4916 /prefetch:8
  2⤵
  - Modifies registry class
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3520,i,15862982212816647693,9957909819914463582,524288 --field-trial-handle=2264,i,17801177935280348566,4841481992780580171,262144 --variations-seed-version --mojo-platform-channel-handle=5008 /prefetch:8
  2⤵
  PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4780,i,13940352806708067327,753957163754462323,524288 --field-trial-handle=2264,i,17801177935280348566,4841481992780580171,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:8
  2⤵
  PID:4804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4296,i,10550089923782688391,4783341711239191079,524288 --field-trial-handle=2264,i,17801177935280348566,4841481992780580171,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:8
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=3520,i,6457080587169097166,15913271101414064078,2097152 --field-trial-handle=2264,i,17801177935280348566,4841481992780580171,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:1
  2⤵
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2736,i,10711185802453725879,12229607428812366642,524288 --field-trial-handle=2264,i,17801177935280348566,4841481992780580171,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:8
  2⤵
  PID:712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5676,i,14052665452848129350,2630274251589337417,262144 --field-trial-handle=2264,i,17801177935280348566,4841481992780580171,262144 --variations-seed-version --mojo-platform-channel-handle=6288 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1532

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4756

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
MD5 8c7cdfea4284ba987d295d82a9c7ddd6
SHA1 7d1a3a66f2d64a383b230196ba89a263ce7ee957
SHA512 59c8229e834c944265aed4131c79f41f9f940a48651b9fb18800cef5bae36d17c7fd5880120c6fee8ce22a157b65bc63846b65765bc4dc86e15926dcce400d0d
SSDEEP 12:sf9iXhV0xoUZxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxoUZxWMk8xVTeYWI31BtXP
TLSH
T105724C85B34498FFC8835E7189BD27903774F6DF1F02866B6A6A760E2E271C84F44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 81240d13af4ca099e1358c75991e3fa5640dbb3aac72c2d98006f6159bf74aa0
MD5 96dd753cd2d8557b97ab2cd76f7fc6cf
SHA1 81697ccb13fb04a07bd47b552b3607597251f36d
SHA512 355c412a688a71b124e85c0527177b3f97efceb2a5553f8428e0913940daffd3bd176f5476b940c64eee52d543f0568112ac073984d9a64015adc15cbef552de
TLSH
T174D09224BA29A149E282007AA881EB565219DA95296B9622E620C44DBD2B925A3851C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4bf0783d55eb083b4adaa03ed8b76a2bd35b0819c8ad2530a78e1b8d6856010b
MD5 7a50c2e276f05b686e8cb6c95b86650f
SHA1 bc892af04a9d6b1bee8047f67518d676df864301
SHA512 f1d02fd9f067323214d78de08172e1a78028eba76f4754436f4d77b849e8422865dcea22be13f21c36ac2c5807b393c1dffdb0a3217c3353a517a0467461a474
TLSH
T19BD022203A28A008E282003AA880EB020208CA80282BC322E220C00CAC2B820A3800C2
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 45853311109c4a073759a5d3075f788b421b5f973add257709c807f08ca7e538
MD5 8aa286d7babfdfe573356d31ecc4f20f
SHA1 cf4f0758307f15d9db87c011f6c05841ab7987a0
SHA512 62438971b7dab67fb46efe0080b807001a2806c0b981d106893d202f391e744efc6ac88149a5383b8df43a025804151e2e232ee42615cdd55227903146eeceff
SSDEEP 96:LgBO1go6FaRhHMJqalUiSD/wVEz/Wg5dIB1SPcBensiebo7KeFtHivbe5kdut6zd:sBO10aRhs8alUiSD/wVEz/WWI7SPcBec
TLSH
T1A9B1527004E19654EB2267708FE2A9B0FB750EC8F603EE422298A97D311A75ECF151DE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe594675.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe594675.TMP
Size 3KB
SHA256 9ba73f2dba0b5b59ad7fbb58bb49b8245311a91e1319b51b653c2595f2ba1ba8
MD5 e21fb18c49b237c24d34a9635a6aa7f2
SHA1 125f0b14c597b5de87e200420085f0d5eec7c7a7
SHA512 008ef035731ed2fd22a518f84311898c44e1ac52b6e5ca4b2b3ca00308312659fe85b9160463f998ce1ec2f835e494c7a4d6b3fdde2c73ad68de849011fafad4
TLSH
T12A61D73409E14B95E31133B083D2A5B0F4A41ED8F917EE862390B87D4624B6FCF156E7
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 73894528932602e40389f120e27e1fc1a6b1323e459c7ae8528f34b9422b9d8c
MD5 91afe2107f44ec892b873e43ec31479a
SHA1 1fc6fa1d4af61d166e4389693a8ae7f789c9e584
SHA512 a5c6ab6573f037c07d7ca8edf64663d46044220380c5f9c85e6af481ca338f70cdf61c2d455561dcefb4fa8099b07e78255a556dff6b7c9f24cb79724612c24b
SSDEEP 192:DxKyXIuax5xaB1j6xbdEUXSEVFc3QVuO/zgyeqxx55PFnwZjZwE:DxKyXIuax5xaB1GxbWUCELkQVuO/0yev
TLSH
T137F1ACF7C3F4862CE81166F46B647D1BCE6C0924572C396ACDD5AF8B67E2061D280A4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 40b6c6a8d7bf60a24436f8d8b235d012e062f691103399a2b35178197336ca4f
MD5 47b7dfd7bb2fb75c89890a5e1d53d1cf
SHA1 0eaa60e13fae39b3bb96c5c37271b088b425a98a
SHA512 01371a318eb6242a457853e5080b27a7059ed465ef3e9e3f4fbeccd49254016223d5768736cca1ec2922eae83530d7507ef0c5d2a82fb1d7d87d95959bd341d6
SSDEEP 192:sxZkRRyM/jK1Ml8Mke/fgsZlItIdpyasDHW6+WNGYCkSr3neEIgrJ:sxZkJMe/fgs7IOGHbGL79
TLSH
T15F52D9126A345977CCCBD219FA95BF53D6F51572E2900E48AAFCCA0C04E6BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 7e6dd71a7d31d866227a4fd4f5eb64285e9b865368a84bbd35f3358e5bd8bdaa
MD5 fc8dc2d7ee4e0d152e9ec0448cc99229
SHA1 681be0476bb058dbda23f7cb28b8a5dafb939d3d
SHA512 56910d5d92a6d88e504333e1629df9ee13b91fa705aa24c2b9cf35a8abd978d4d1c83c95bf999f12c7cbe5a5586c6e2c2705539e1fcdac7720983d786bcbff99
SSDEEP 192:sxZkRRyM/jK1Ml8UQhke/fgsulVtIdpsasDHW6+WNGYC9T/Pr3neEIg5oMJ:sxZkrqye/fgs8VOwHbGJTr7j
TLSH
T1A752D81266345977CCDBD219F991BF53D6F55572E2900E48AAFC8A0C00E6BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 70d157969af857ccd0db2405a4a4c4bbfd4e639a00d7da0e50273ed5875a9b7e
MD5 2d4dc7ff462d977f0abdea74f69df853
SHA1 3de48488b4751317af98290a091fbb6212617a43
SHA512 2bf4c51d3d96071b9f271c0d599ecb9283f312bf8e0b5c71ab082067383006877e25a30beeddb5be90fe601b4a8f9ef8c7036b111f1145f46bde6a4afd3c634f
SSDEEP 192:sxZkRRyM/jK1Ml8Mke/fgsulItIdpyasDHW6+WNGYCkSr3neEIg5omJ:sxZkrMe/fgs8IOGHbGL7t
TLSH
T1AC52EA126A345977CCCBD219FA91BF53D6F51572E2900D44AAFC8A0C04E6FED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 bb8b45d95119cca3e00c8ee6e41ce0705c7a2b6d0930952f7191658944dd022c
MD5 3430cddfe8d538d1279902893ce40b22
SHA1 da1829e8c911e7222a055104665588848374c24e
SHA512 c5751f8636e63eceff1fdb1fb1373704270f8ed43c65e16cd18bd1cd397062c54964256fe961bd1aeddbccb40083ce6656a7608a09a4e36907ccacb28806f1f8
SSDEEP 768:MR8bqn+WvSCt68F1+UoAYDCx9Tuqh0VfUC9xbog/OVnZLlRTKVXro/:MR8bqn+WvSCt6u1jaCZLbWVE/
TLSH
T122D20A3B280CCB7E4F845E5CEC26AF962DD801CB6B988D4447FA884C03C76EA511B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 1KB
SHA256 53d40c398efb9d2b8284c84c62dcfe9d46b12ae2dccb1cac841709422c820aa4
MD5 4d3eb7831ce56ed70d784813c941b180
SHA1 d27cbc1e167a378b6d45e1e3ee7e27aa43123320
SHA512 6c0c478c07093182958f6a4e849803561004629630c3c2baf007e21a8a18a4ef4ef24d214cdf4c09b0fd05556b7f1fd4e34360c02008dcc08d9fd815042620cd
TLSH
T14D216E2062F73F402CBD250A81D4D41E72C530F539A6652A766810FA1926E935FFC9C9
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 849B
SHA256 b0cf53786c00fcdf98093aafeec4d41a3ae2c1f399113c9aff7f849e3eb67471
MD5 4cb540bbca4e5b89b9773eb1c1773423
SHA1 2212730e8bdd1b77dfb23910e8ba962e27743e0b
SHA512 620d523903a3b6c99f5f715f726d44b86089530360b96ef8b0cccb80cbaf65659fa9621d3b2d28fb91a9eda4e8534c42884c9cf89247178c5862a79e2f07c347
TLSH
T1F8014F2132FB3B402DBD650681D4E51E72C530F53966651A36A450EA1926E934FF8DC9
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59622b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59622b.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 7b0f618f462d6d1c496f6b5adeb0b8e4546148afc3472999afda900cadbc3a3b
MD5 246887ca5220df8d8e18e5229d01865e
SHA1 afbf4e722374a6556db9c41f19b1a6cb15694a33
SHA512 c9e83d33d67a69109c9d7a25dac15d79f19a79e512906d5c2a75c56c80a17904628e04b8a93359c3afab29b6a48fffae3205dc5ba5274b423e1ee50d31ecd0ec
SSDEEP 192:ugLsNL8Qebbi33RQmiU1dEiw4Ea+j4+FdCXmRy/Fa9amDqFU8:lsNL8gHv77/Ea+fd4a/GU8
TLSH
T13032193668685C7759E2A544F48736235FF89127EA8A3F94E6DC9F0C00DB69C130B92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ddb8475df8a77234dd5e611b1692ae84220e5b44ce45be1a5e73bbd8641d1cba
MD5 a985df37e927b1de9e3a6662d4f87d2e
SHA1 8f4e3727a2aed5a0e993931bd909c02949191bcd
SHA512 7c303cdea54489cbe9d831c3a585925792809d7806d3ef151bb61e3fc2d7964e50f59761b07fe349985013f0e8d9eb303cbf4f9b3dbdb21045bfb522e0a33a23
SSDEEP 192:vONL6Db6QmiUyeOHBa+j4+FdCXmR2RgjiU6:vONL6u6HBa+fdFuU6
TLSH
T13402D73568786CBB9AF2AE49F88737275FD4103BDA962B54D6D84F0C00D765C230783A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 90af6bc3b175ffafea9cb8273feeb46a6079f9f97fcd2b76c177a4cd4cc3d6c0
MD5 a8655515d53f1aca24c072d058740d0e
SHA1 4392b5851e3269b4a2ead5499086edb4d38b3607
SHA512 640470799067613830abd901a2dc61f70dd8f459250c32d4bc89d96d271b0d6f3d883cfa4f75dcb991bba6b93284b2ef25cd5c1554d9593e36fb439128af7b52
SSDEEP 192:uELsNLJQebbi33RQmiU1dEiw4Ea+j4+FdCXmRy/Fa9amDqFUt:JsNLJgHv77/Ea+fd4a/GUt
TLSH
T11D421A3668685C7759E2A544F48736235FF89127EACA3F94E6DC9F0C00DB69C130B92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 69f062ce58bf8b0bf04922cc03a230cec5a06837b05543fb05b3e6bec745f88b
MD5 2d757a00f11458a677b3b4acf8b97905
SHA1 6674ec2d868b805512436617fc1047f862991402
SHA512 083a52130c2daf753bc854d624311992ae21ab4a459d2d7290a4f73c55bf43f43a8f2ed724c8507bd9d05d7c87274b1638599321f2a8b62c85971f56678c2c25
SSDEEP 384:cDiF1tNn/s3n9SXzsNV8TUNTUlIljgHv7N/Ea+fd4aMGITGT0IyHx9r:jF1j+9Y8wgQMa6vMGi+0Hvr
TLSH
T1EBC229F248D7893AD9AE5B47A77E2D174EBCC1A7B4856A50B3DC4A0CCC861BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 9468522b1a6800f9513214f0a3eb10cfa2d739f13791b8b74888a352aa1e693a
MD5 99f0d1b35386a3ab0c7a92b867795cf6
SHA1 c73849fda88d476138f22075e4e3729c471d6dcf
SHA512 4fe8747caae00518f38988a9491c0463dbd09a2c7478767d87b60e50317c10864847f6398586af0de2305e689598191ca89cdb43da48362fa11cd1ac0fa2998c
SSDEEP 384:BtNn/s3n9SfsNLjgHv77/Ea+fd4a/GITGT0IyHx9r:Bj+9UTMa6v/Gi+0Hvr
TLSH
T193928D3268289D675DE2A485F447362B1FF441B7E5CA3F85E6EC9F0C00DA6AC130BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e4088e1a48545fb3a659b2b9f172c99beeab284e78dea81595875ec2aadd00e8
MD5 8deccc3aeb3ca297379b565e02a7056e
SHA1 a2f7fccb275d25ab483f1a4b0524c491de01308d
SHA512 7218275ad9dfd1fb3581855a8a49b42326ac8c1995ae4527acd0e5a6ce242a54f44cb7f524b9825a7fdf414697217f3a4758db0696a37f0c49ce001a7ff14623
SSDEEP 192:SONG6DbFQmiUyZvOdBa+j4+FdCXmRy/FahNzDqFU6:SONG67S2dBa+fd4a3GU6
TLSH
T1D5120A36686C5C7B5DE2B944F88736235EE45167EE8A7F90E6DC5F0C00EB65C130B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

671abd82-b4a0-4d2e-a66f-d957c3ad3147.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\671abd82-b4a0-4d2e-a66f-d957c3ad3147.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 1da35b42b697255345a187a3934b029a003f11574e5a7f2821deb1c0db7a096b
MD5 fc89453f104a05744a555148473537a4
SHA1 ad6972ae6eb13c33672f3471cbbb221a649f84fb
SHA512 d9f19309304abaddd2b2485aeb793acbe48b9c0bd5b61d9607a02214ba0d4d7edd4672c2ccb53d04eba8c75ee9109d467cf2db4183341eee1959194be3db2b78
TLSH
T15141F798A6E91109B7B77E56ABF6A86D483FB8772E0684AD00010E4E0662A44CD71737
MD5 SHA1 SHA512 TLSH

Submit Download