d311a4f486e2f81d1ffb11b37782d8bc1325b1df96ff21ab3b3de818ae3d5d84

Analysis

geolocation tags

asiadelhiinindia
user interaction
yes
max time kernel
299s
max time network
297s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/06/2026, 02:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
1Xi9Tw.html
Size 11KB
Sample260622-css68agw4m
SHA256 d311a4f486e2f81d1ffb11b37782d8bc1325b1df96ff21ab3b3de818ae3d5d84
MD5 c229b9d23420402bdea979bae2d31dde
SHA1 cf5cb6cd0c16a3cd252c792a13907df48fa2f0d4
SHA512 bdabdc88c2c5f8c1b6e4730801ad263d8f0172f9cbc19d80de98acaec7d06218f830366b5c10a63cf589de17ed23dd3b84542ab2183f93fe383f9fa3bd6f6fb8
SSDEEP 192:zMilLhIJhKYX5kerCNRupjQ4vYJkTcOHsU:zNOJhda4s4vYJk4OF
TLSH
T1BF32764A1EF280E701E785A97DF2FD0DAD85864BD219FC4832BC80A90FD7D468DC7995
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1716	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134265684636779617"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{A731159B-50B9-40EB-BDE4-3ACE0C2F3DE4}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
852	msedge.exe
852	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe
4108	msedge.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 4108 wrote to memory of 5032	4108	msedge.exe	85
PID 4108 wrote to memory of 4420	4108	msedge.exe	86
PID 4108 wrote to memory of 1716	4108	msedge.exe	87
PID 4108 wrote to memory of 4420	4108	msedge.exe	86
PID 4108 wrote to memory of 4420	4108	msedge.exe	86
PID 4108 wrote to memory of 1840	4108	msedge.exe	88
PID 4108 wrote to memory of 1840	4108	msedge.exe	88
PID 4108 wrote to memory of 2100	4108	msedge.exe	90
PID 4108 wrote to memory of 2100	4108	msedge.exe	90
PID 4108 wrote to memory of 2100	4108	msedge.exe	90
PID 4108 wrote to memory of 568	4108	msedge.exe	91
PID 4108 wrote to memory of 568	4108	msedge.exe	91
PID 4108 wrote to memory of 568	4108	msedge.exe	91
PID 4108 wrote to memory of 2804	4108	msedge.exe	92
PID 4108 wrote to memory of 2804	4108	msedge.exe	92
PID 4108 wrote to memory of 2804	4108	msedge.exe	92
PID 4108 wrote to memory of 4156	4108	msedge.exe	93
PID 4108 wrote to memory of 4156	4108	msedge.exe	93
PID 4108 wrote to memory of 4156	4108	msedge.exe	93
PID 4108 wrote to memory of 2300	4108	msedge.exe	99
PID 4108 wrote to memory of 2300	4108	msedge.exe	99
PID 4108 wrote to memory of 4492	4108	msedge.exe	100
PID 4108 wrote to memory of 4492	4108	msedge.exe	100
PID 4108 wrote to memory of 2200	4108	msedge.exe	103
PID 4108 wrote to memory of 4300	4108	msedge.exe	105
PID 4108 wrote to memory of 4300	4108	msedge.exe	105
PID 4108 wrote to memory of 4300	4108	msedge.exe	105
PID 4108 wrote to memory of 2956	4108	msedge.exe	108
PID 4108 wrote to memory of 2932	4108	msedge.exe	109
PID 4108 wrote to memory of 2724	4108	msedge.exe	110
PID 4108 wrote to memory of 1044	4108	msedge.exe	118
PID 4108 wrote to memory of 1044	4108	msedge.exe	118
PID 4108 wrote to memory of 852	4108	msedge.exe	120
PID 4108 wrote to memory of 3012	4108	msedge.exe	122
PID 4108 wrote to memory of 3012	4108	msedge.exe	122
PID 4108 wrote to memory of 3160	4108	msedge.exe	123
PID 4108 wrote to memory of 3160	4108	msedge.exe	123
PID 4108 wrote to memory of 2212	4108	msedge.exe	124
PID 4108 wrote to memory of 2212	4108	msedge.exe	124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\1Xi9Tw.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffa4b3ac188,0x7ffa4b3ac194,0x7ffa4b3ac1a0
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1752,i,13375150884085993508,17128325771497803295,262144 --field-trial-handle=2264,i,9530388142384485385,16999172890449059002,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:2
  2⤵
  PID:4420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1948,i,16139476408715010094,12300493664404679572,524288 --field-trial-handle=2264,i,9530388142384485385,16999172890449059002,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2564,i,12292920579553339184,4764157316571534628,524288 --field-trial-handle=2264,i,9530388142384485385,16999172890449059002,262144 --variations-seed-version --mojo-platform-channel-handle=2556 /prefetch:8
  2⤵
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,18384459661929226304,3985380350062112073,2097152 --field-trial-handle=2264,i,9530388142384485385,16999172890449059002,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,14671694613434198495,16234896316132456030,2097152 --field-trial-handle=2264,i,9530388142384485385,16999172890449059002,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4200,i,7888621728958652480,3132036442255248372,2097152 --field-trial-handle=2264,i,9530388142384485385,16999172890449059002,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:1
  2⤵
  PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4232,i,5374579753624459218,17473216380537691975,2097152 --field-trial-handle=2264,i,9530388142384485385,16999172890449059002,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:2
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,2723902472227635582,9576441696459617031,524288 --field-trial-handle=2264,i,9530388142384485385,16999172890449059002,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,5686369025443436599,2746792316692407434,524288 --field-trial-handle=2264,i,9530388142384485385,16999172890449059002,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,5977817072386690373,11620184487665559371,524288 --field-trial-handle=2264,i,9530388142384485385,16999172890449059002,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:4432
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,5977817072386690373,11620184487665559371,524288 --field-trial-handle=2264,i,9530388142384485385,16999172890449059002,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5940,i,9028924339841099964,2661838718083544783,2097152 --field-trial-handle=2264,i,9530388142384485385,16999172890449059002,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:1
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6436,i,200022828292306127,7792373793941453844,524288 --field-trial-handle=2264,i,9530388142384485385,16999172890449059002,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:8
  2⤵
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6432,i,3453629995237975662,4182653167262910294,524288 --field-trial-handle=2264,i,9530388142384485385,16999172890449059002,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:8
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4476,i,1499647265117743647,13175624249048780764,524288 --field-trial-handle=2264,i,9530388142384485385,16999172890449059002,262144 --variations-seed-version --mojo-platform-channel-handle=6524 /prefetch:8
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,10861225351385337913,14823098345833892850,524288 --field-trial-handle=2264,i,9530388142384485385,16999172890449059002,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:8
  2⤵
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6132,i,14484531783550954405,3495087216250600129,262144 --field-trial-handle=2264,i,9530388142384485385,16999172890449059002,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3580,i,5025663476128265601,14696643610293796570,524288 --field-trial-handle=2264,i,9530388142384485385,16999172890449059002,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:8
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,380343103914144070,2107308436672687330,524288 --field-trial-handle=2264,i,9530388142384485385,16999172890449059002,262144 --variations-seed-version --mojo-platform-channel-handle=748 /prefetch:8
  2⤵
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3596,i,6728137704281376336,2679744840213535959,524288 --field-trial-handle=2264,i,9530388142384485385,16999172890449059002,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:8
  2⤵
  PID:2212

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
MD5 8c7cdfea4284ba987d295d82a9c7ddd6
SHA1 7d1a3a66f2d64a383b230196ba89a263ce7ee957
SHA512 59c8229e834c944265aed4131c79f41f9f940a48651b9fb18800cef5bae36d17c7fd5880120c6fee8ce22a157b65bc63846b65765bc4dc86e15926dcce400d0d
SSDEEP 12:sf9iXhV0xoUZxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxoUZxWMk8xVTeYWI31BtXP
TLSH
T105724C85B34498FFC8835E7189BD27903774F6DF1F02866B6A6A760E2E271C84F44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 81240d13af4ca099e1358c75991e3fa5640dbb3aac72c2d98006f6159bf74aa0
MD5 96dd753cd2d8557b97ab2cd76f7fc6cf
SHA1 81697ccb13fb04a07bd47b552b3607597251f36d
SHA512 355c412a688a71b124e85c0527177b3f97efceb2a5553f8428e0913940daffd3bd176f5476b940c64eee52d543f0568112ac073984d9a64015adc15cbef552de
TLSH
T174D09224BA29A149E282007AA881EB565219DA95296B9622E620C44DBD2B925A3851C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4bf0783d55eb083b4adaa03ed8b76a2bd35b0819c8ad2530a78e1b8d6856010b
MD5 7a50c2e276f05b686e8cb6c95b86650f
SHA1 bc892af04a9d6b1bee8047f67518d676df864301
SHA512 f1d02fd9f067323214d78de08172e1a78028eba76f4754436f4d77b849e8422865dcea22be13f21c36ac2c5807b393c1dffdb0a3217c3353a517a0467461a474
TLSH
T19BD022203A28A008E282003AA880EB020208CA80282BC322E220C00CAC2B820A3800C2
MD5 SHA1 SHA512 TLSH

Submit Download

f_0000c1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c1
Size 16KB
SHA256 b17b23990851346a40d733da642788136fcc9913a5e690865be124637f16bf66
MD5 e97f51ffddb5102e601f568bebbe6656
SHA1 80b1ed86320c70b9a17f9d5981a132b9a4a6afeb
SHA512 0561e3a1f680d2cf8fa0d19282359588fbdb3a508831810aa5059d6b7b072c840b06323d4ce4c66464ab016fdca47bea6eedbd765acf8c6a503ff2edf91d5fb8
SSDEEP 384:PUsJMhkvuJpDKSNflVDtakrzt2ro/zvllLMZ3u:8bz7Y0ztmez3LWe
TLSH
T12872D0A96EF500237B2B8CEE15D083948E847AF36D6B7DF642883067849C6A17D1858F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f5c8660f7eba7a61bb2e86142785dd633902554c517562d4f5d449af346db431
MD5 429d98ef0d39222aa6d08b0452da0a0c
SHA1 b66dc6fcfb52273b51a78ac90dcee85cbdf29097
SHA512 9616a109d57194f4894f5a122d922bd7dbe87e8b5598f63c3251b6196a89ad041c72da7cae8c82a3b396c4f22fe3d57f9ffc43939a70850c81351e6d2dd5ec7f
TLSH
T14F71E7350921B891F3901F3A70E60557FC7AC9E8F7978E9791AEC9B46927B60413E2CC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 cfd715429b36aa2235b16e32f602e8a70f9b4a9b057cc292fe9c08e80ba148e0
MD5 bac90b329ae8113243bb8ed81747016e
SHA1 b65892e4c5e4b21a1e20d05328b96338469cfac6
SHA512 83535763d640348535753199e9a33c9a12b2f1ddfa0d253b6c09c81336832ea6e4660edaecf4360329c08f4d192c42072c9fa9c9019a93c8d34af11f1962c6a7
SSDEEP 96:tJ0vcSeQR/c8gEGQTsQ00ZX4Cla07oqr/RY/wL/qn9TWg+cM1/MCC3a0f/5qSM/Q:wvrcOLTRXJt/KwDqtM9hC1OUH07e1
TLSH
T1D1D10B3144A67090EB409F3960E9091BFFBCC9D1F2075F876C598EB5A827BD5846AECC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe586ee2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe586ee2.TMP
Size 3KB
SHA256 0e3e6a4b480eecfb80a86c4c811e86ffd56538063df0b872f6aafe027489ccbe
MD5 668417149ced368722695120b670b41d
SHA1 7682cc773397ff926257b780dfd50c477f606332
SHA512 747a3573073447ac51f26793f5f2f92cc30245113dc00f85236a1e699ae6b5afd182b652a14375df222245de08f95ddbd3ba4d182f7928de9c1385c7ad2844b0
TLSH
T1CB71D6350921B891F3901F3A70E60557FC7AC9D8F7578E9790AEC9B86927B60413E2CC
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 fb136f65f050a9e060456b697972220be4c4d97161f23b030a37711c6aa91b3f
MD5 cbe04565c19ab44ed03f77e5f12ba1d2
SHA1 f3ea5554e9884293dd6c8c4e6e43abf2a03dad0e
SHA512 89d94f8811fb0d1c9f4561c00d123952d6e902a282ce8e97f255747eee8aeb1e07387efbb68b85e0affdf2081be46d61d3b5cea37b28b31e8a510048eeb76dd9
TLSH
T1A7519EF3C3E6456DDA1195F0AA147F1FCE19054243AC3D5A89E4AF4BA3B28B1E111B8F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 5b633188de3d5fd12dffe2d913eaae6d9d4e9416d630e85e2cac256ec516e513
MD5 ff4bb2df363984d243a219ad3d663b7a
SHA1 bc715434239d4a3ec811154218e1c7567b64484d
SHA512 7db397492e62699c54397fd1c2db6f6ed57c5c8994995224f683ed9f3b250b88c87d7c808e5c07cf452b19812a3532f7d040eb91121580f4b6a3784cb3754137
SSDEEP 192:sxZrROyM/jK1Ml8Mkj/fWs7n40IdpdkHW6+WNGYCk4rz6IgrJ:sxZrYMj/fWs74tmHbGl29
TLSH
T15D42DA126A349977CCCBD209F955BF53D6F51572A2541E44A9FCDA0C04E6EEC2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 d462a934da493efd75784b2b497240e8997675b958b0fcf60e4301c8059710f1
MD5 449e3123a936c76fa422412c04a747e6
SHA1 3555d33ca0db7213061c92f18ea3258123038418
SHA512 f03778ac86a7883a0ffba087a96adaa33032040ad4426f2ef7d1e90a39f67c9e19007c083778313696dff799e5fe2f9473545aa10216252607fa158e4021ef5f
SSDEEP 192:sxZvQUn/ROyM/jK1Ml8UQ7WOj/fWson4OxsxMudp4akHW6+WNB2G/YCQhrz6Ig50:sxZDn/YqyOj/fWso4O2lyHbV/A2i
TLSH
T10A72F7126634593BDCDBD219F9027B63E6F84462E7940E48A9FC9A0C04E6EDD2217C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 489914fe0226213fab53e391b488680d228fa100beeecf1e5a013ab0cef30ece
MD5 3720682008ce819d255b8419556041a0
SHA1 7eb47e967b35e7caedc3f95b901667315ddd4049
SHA512 38d6a2b1e879b8b18e13021beb93b77c36485aaf40047d8987d71dbe561c1ff8447d776d96180dc6fb75bc3b7d8c78f1231ac4a05597f457025e182ec0f9e9b0
SSDEEP 192:sxZrROyM/jK1Ml8MWOj/fWson487sxMudpmakHW6+WNB2G/YCaOrz6Ig5QJ:sxZrYuOj/fWso484lYHbV/v2i
TLSH
T13262E8126A34997BCCDBD209F9057F53D6F80462E7940E48AAFCDA0C04E6EDD2217C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 430946650fe69ca24e6813d2fa4e91ac8fcb8a7617a8a0a69bd4016a38f023b4
MD5 346665bad83b1d89d9b68299119e0aee
SHA1 8c0cc3350535762c9a043d0560d3e31f736cefa4
SHA512 664cb6386da425cc7747d3eb6125159de64141468bc3b7c71f8923630e896fb3b4888e7a804af63ced359a932fbf830216572edace4276ac7d78a16bb3deaeff
SSDEEP 192:sxZvQUn/ROyM/jK1Ml8MWOj/fWson4OxsxMudpmakHW6+WNB2G/YCaOrz6Ig5QJ:sxZDn/YuOj/fWso4O2lYHbV/v2i
TLSH
T16A62F8126634593BDCDBD219F9027B63D6F80462E7940E48E9FC9A0C04E6FDD2217C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 7aa96465b84cfb03190fa1c88f98e4b00469d449d261a0772178bf9e22f1a3bc
MD5 e20d92209554588e44482beaec4de410
SHA1 1f1b32081f51d281f404060d8115eb706871c08b
SHA512 ed50b69e67d25dd35425cd5ac401db93207bf2f547225594bdb0d05c102990d769bb8ae0737cea15ad958edcaaf18a9d16c5b70807dba3a5cbf92c88a857dccd
SSDEEP 768:Xk8bqn+WvSCt68F1+UoAYDCx9Tuqh0VfUC9xbog/OVnZLlRTKVMrot:Xk8bqn+WvSCt6u1jaCZLbWVXt
TLSH
T11ED2FA3B280CCB7E4F845E5DEC266F962DD801CB6B988D4447FA894C03C76EA511B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b72c29a0-bd55-435d-8f59-04769e50d179\index-dir\the-real-index
Size 72B
SHA256 be7819dcd9c3fbb4ef8d60991711c6e5af809024ea596fdf5a69d2ab61bb5f48
MD5 8382b5f3742e1801751583ca7d8d1cb8
SHA1 81f837355caeeb26a88d8c228ed4e340bf57f35e
SHA512 5541004a933967cc37a063468840c1b267e5af344c3f755e6bbdd6080a00ac60b4846ea9747382e65119a979bce032eb0bf70df63a1e63ae837c892137ae2909
TLSH
T1CBA0021922C00002C03273B025AB514D625ADE509607230B45D33849EA799554549A0D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\b72c29a0-bd55-435d-8f59-04769e50d179\index-dir\the-real-index
Size 72B
SHA256 0fd790bbffc6c978da1c8b32f19a73ac7306f2bc106de3a881f36ce7c8ba37b8
MD5 641e930bdbe3279efe98bb93d6778703
SHA1 d30f78b916f120b327cdebcda683678e6933ee0b
SHA512 f6797a8b4ce9fbd7fe4073eaaa2828d119cd6b75beb8c5feb1c2b4b8a1054309f8eafd39263456febaa57aa2a9ec27bb9b165992e08f84cdd53ab8a6d7d06967
TLSH
T165A002600380C805C05212F2ADD312423390CC902180170750A91484CC504554DC101E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dfa4cd3b-6396-44b1-9341-22ecfa35924f\index-dir\the-real-index
Size 3KB
SHA256 0e4d772759ecb443b4dab385844c98f9728721f550af6128d3213b926837a8cb
MD5 e990ae89e72ec57423952d0bf4505e54
SHA1 cdd9384a3d2d8526b397aa8695fabf0472ef7e3c
SHA512 e509336328f9cb4655fc41b45773258c8c377faff8e3822279b3f2770624e0fa95f3e73a9ba1d7594ef29187154f6d4f4d09743035d83bd2b394dee44791ec6c
TLSH
T13E51A79D6D4F2B4ACCB8227324B504853736A9DD5E584E0329FC65386CD73392DA9A4C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dfa4cd3b-6396-44b1-9341-22ecfa35924f\index-dir\the-real-index
Size 648B
SHA256 ab24f720a33d516b0eeaeeeb2abc2f13d0c6dc7ea211edf835a4647b5ce30bd5
MD5 fce494a1841725c0419ca93ce69c21aa
SHA1 49dd8b6b9223bc1e9801e8dbed7674e240addd63
SHA512 553b8317fc19c8613c4c1c992045c19eca0a87ab191004c49f91c1bc5f57d4985f97558df705b85dd864af01a0935caacec1859a3ad19e3b8d582a1bacc5e460
TLSH
T1EDF0DC5A1FE19927DEA24DB320F560B473B0DEEC7B26C457506D273B2C36308A0572E8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5886bf.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dfa4cd3b-6396-44b1-9341-22ecfa35924f\index-dir\the-real-index~RFe5886bf.TMP
Size 648B
SHA256 4e32278ffa20395ce998dfd29c7bd893b18de691aa5716a5687cf6f898431e58
MD5 fa7ef8a65a98992c6192416bf53bb6fc
SHA1 750dfd2eb60417eb2d4892e73c025de6339d95a6
SHA512 793eb5b9f1388c542b373d84b2b33bb04040dc4628e0147d8726eb5a1eabdabacebcaf9edf70f26652720539cf0d04d537dbb80c817b71089c53f2a42064faaf
TLSH
T11DF023DA87A2996BED6009B618E550F6B330CD003372E49350A96B3E1C3638865030D8
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 9a398e12bce5157c1c530f25ab3f082b46e965904e194c786f5c68cae3eddbb2
MD5 3bab609b72ebdc6c048bfdd8ab20f3c1
SHA1 f1d662e2e85e75e962b761c947df6656f9657e84
SHA512 929795fbe83b5bd6dde19ba113fa2b44d5922c9341cc178d11b69f402f4613243add7c871ec2735b2c004df65c2243963eb2409841e80286f63092dae10e1f94
TLSH
T1D2E068FA29E72864BC7BA3F5247048E0024A7988C946FC8E01A9A1D750F3361285AC60
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 32b2356fc1b764e94ced2179ceb1dd19d662245d66c7172885ab261b59cc0c0d
MD5 47d8feaf73a87e97020d9302d4550ffb
SHA1 f6dba3a438af42d3e0993e21699ba7e4f359afb3
SHA512 574fb1ff06faedf825d6949aa67831f742a72bb9a801725a2eb37759d69c746b5d14cc0542d7f4e01f967206e3616df19cf12b10d083df184f247b0058902b38
TLSH
T1FFA00213D6594099C0210774B44321847216CD142F092A1144A48458FCB47848132414
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58e9a0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58e9a0.TMP
Size 48B
SHA256 60b9489110df9e4decb87f4429aae0b7c0e9e8074ebc7b49bd326b88e1b063b4
MD5 f4af666df66da57e3b83ad57e11b241e
SHA1 c91247d48d1800882e1299c93d9f6d10a7210d2d
SHA512 082b43d5bb4b6ee07cf09a0af6e906a5e315693ce8b490ff9ba547d757c0c6f9c5fa12b23d6655d6fa15fa1a38e7a6deb87b682f150337a3f693e75385187876
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5914c6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5914c6.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 4fae920491bb37cdc16b93a143db06fb87ac9aed67b4e54ef9e950213f0e4798
MD5 d411ab1ba5596db7e425fe03f0d7bb10
SHA1 2b7c085a19f1e8336bee0799bca47760666d78fb
SHA512 88914eccae3b13fab6d3154d36590327f81b048250cc7f039c13f9a923f16b14c7c86f8680549dae81eec383f893eb45d2dc56a54074861779a3380732af801e
SSDEEP 384:9tNn/s3n9SfsNzguldfyJuEa+lOy+HVYo5kSm3m9hScuWVv:9j+9UrPa8Oy+VSSaW/uE
TLSH
T1D6927D3269385C3A5DE68694F44736179FF84167DA812F94CADC6F0D00CBBDC135E92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 17008616fdc81d96faa81d1aee643e86bc83577db581661768dc65ddf448dc84
MD5 10d33ee1e36ae8fdbcdcac507756866a
SHA1 0d901d526596bcce913199680a6bfa0b7a05ef5e
SHA512 5880842c146a759cad2a5a580ad30bbb46f38f88727dedaae17b46bb144239278e91e38abe5cebf6253cd54d9c67bce71cdcfc76afdd763e6625f6b6235e2b1e
SSDEEP 384:liF1tNn/s3n9SizsNN8TUNTUlIlXTjldsCJP2Ea+lOy+HVYo5JSm3m9hScuWVv:sF1j+9tcwgPlla8Oy+VHSaW/uE
TLSH
T13BA26C3369288C3EADE68B94F84A36179FF441A7CA816A94D6DC9F0D00DB6DC134FD25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a0d9594836dfc82b9882faa40342a310b46fcbd3cba9cbad097ed77f8ab8c593
MD5 ea99c1dc2cf41cf56291f6acc2f7aa85
SHA1 b7ff9e3d6e72710fe5efe685d62683fc8643deeb
SHA512 b625b5375562d078757f6baa4d2ff18caf34940013eee870fe80d3df9f236f6875c7395b81dfbb2a45f4f7d131f7a39ca5ca3ad47b78d192064c989f436d88c1
SSDEEP 192:vONf6Db6QmiUyhaHBa+jpOmN+BRgURrU6:vONf6upHBa+lOy+IqrU6
TLSH
T17002D73968385CBB9EE26E49F48737275FD4203BDA566B94DAD81F0C00D769C234B836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 a293b7cdfc99732ee27bcaab8d0cdcc78b52e4e461848ea94e0b07de311b92c0
MD5 98780e599dc7c7ed27902ed7a34dda46
SHA1 c4456f9b9177f50f15be531dfd1aa58391dea293
SHA512 4c7bef50cea22d2ddd871a6e43d49542830b8b6fed1207a746ad7d3750626eea36e56de62cdfaa085b0b4cc14a25e3e0c7a74b90a92369f643cd6d9c096c0008
SSDEEP 384:UtNn/s3n9SfsNzVTjldsCJP2Ea+lOy+HVYo5kSm3m9hScuWVv:Uj+9Uglla8Oy+VSSaW/uE
TLSH
T1A1927C3269385C3A5DE68698F44636179FF84167DA812F94C9ECAF0D00CBADC135E92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 cdc0105bcfcf0eb484f65618667318943a7521c7b6ffeb9123d5b8de8004f382
MD5 f65618f84494a9b1204d85056e4f05ee
SHA1 9784e00c437e037fd573ee08240fe115a021a68b
SHA512 761d491503b5052a6e96c470f449adabebc76d6464cf24182a1454a4dbec1fec0e81290f0bcbc1e672bb9acc32696d419c81cc21c69523e73191e442c8575859
SSDEEP 192:uONm6Db9QmiUysaUBa+jpOmN+HVPPwo5UNzAdq8U6:uONm6TWUBa+lOy+HVYo5USU6
TLSH
T17712183669389C7B5DE26584F48736179EE84127DE4A7B90D5DC1F0C00EFA9C134E827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cbd563e9-3720-4e64-8a8c-17cea79d7f1a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\cbd563e9-3720-4e64-8a8c-17cea79d7f1a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 2e456b0c593b57848f4cbe42dcb15e834ddfdd8a1af10eb374c00c018ab76c36
MD5 e40ff2f25a0f2e6376e6ca1fedba63d7
SHA1 95678ac4870c160c84cfd1a955c6b2429fdf1756
SHA512 73f6f451288a8476c25341e1eba18d6f9450b5b5ef890f0cd5d7c2a184f4fb15e47e6ccd032b691f39775cd4939ded923a4d6328de96ff9552890d4551cff315
TLSH
T166413B59B6FA2144B3B77E1AAFF7686D487EB9272E06D45D00110D4E0672E40CCB1B37
MD5 SHA1 SHA512 TLSH

Submit Download