hxxps://shorturl[.]fm/Xr1mb

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/06/2026, 17:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://shorturl.fm/Xr1mb
Sample260622-vpgm5aey21

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1704	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134266217877716931"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{377FE594-5FFF-4FC7-8C65-1B82FEB0EBB6}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3484	msedge.exe
3484	msedge.exe

Suspicious behavior: LoadsDriver 3 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe
2228	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 2228 wrote to memory of 3516	2228	msedge.exe	85
PID 2228 wrote to memory of 1704	2228	msedge.exe	86
PID 2228 wrote to memory of 3684	2228	msedge.exe	87
PID 2228 wrote to memory of 3684	2228	msedge.exe	87
PID 2228 wrote to memory of 3684	2228	msedge.exe	87
PID 2228 wrote to memory of 4880	2228	msedge.exe	88
PID 2228 wrote to memory of 4880	2228	msedge.exe	88
PID 2228 wrote to memory of 1876	2228	msedge.exe	89
PID 2228 wrote to memory of 1876	2228	msedge.exe	89
PID 2228 wrote to memory of 1876	2228	msedge.exe	89
PID 2228 wrote to memory of 3464	2228	msedge.exe	90
PID 2228 wrote to memory of 3464	2228	msedge.exe	90
PID 2228 wrote to memory of 3464	2228	msedge.exe	90
PID 2228 wrote to memory of 1532	2228	msedge.exe	92
PID 2228 wrote to memory of 1532	2228	msedge.exe	92
PID 2228 wrote to memory of 1532	2228	msedge.exe	92
PID 2228 wrote to memory of 1052	2228	msedge.exe	93
PID 2228 wrote to memory of 1052	2228	msedge.exe	93
PID 2228 wrote to memory of 1052	2228	msedge.exe	93
PID 2228 wrote to memory of 4568	2228	msedge.exe	96
PID 2228 wrote to memory of 4568	2228	msedge.exe	96
PID 2228 wrote to memory of 4568	2228	msedge.exe	96
PID 2228 wrote to memory of 764	2228	msedge.exe	100
PID 2228 wrote to memory of 764	2228	msedge.exe	100
PID 2228 wrote to memory of 764	2228	msedge.exe	100
PID 2228 wrote to memory of 4484	2228	msedge.exe	101
PID 2228 wrote to memory of 4484	2228	msedge.exe	101
PID 2228 wrote to memory of 4484	2228	msedge.exe	101
PID 2228 wrote to memory of 3328	2228	msedge.exe	102
PID 2228 wrote to memory of 4920	2228	msedge.exe	103
PID 2228 wrote to memory of 3328	2228	msedge.exe	102
PID 2228 wrote to memory of 4920	2228	msedge.exe	103
PID 2228 wrote to memory of 2916	2228	msedge.exe	105
PID 2228 wrote to memory of 2200	2228	msedge.exe	107
PID 2228 wrote to memory of 2200	2228	msedge.exe	107
PID 2228 wrote to memory of 2200	2228	msedge.exe	107
PID 2228 wrote to memory of 876	2228	msedge.exe	116
PID 2228 wrote to memory of 5108	2228	msedge.exe	117
PID 2228 wrote to memory of 1416	2228	msedge.exe	118
PID 2228 wrote to memory of 2028	2228	msedge.exe	120
PID 2228 wrote to memory of 2028	2228	msedge.exe	120
PID 2228 wrote to memory of 3484	2228	msedge.exe	122

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://shorturl.fm/Xr1mb
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffe8e6dc188,0x7ffe8e6dc194,0x7ffe8e6dc1a0
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1960,i,4652811524231691097,10656153019653315308,524288 --field-trial-handle=2064,i,6640350062180429149,1000866445589080752,262144 --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1692,i,9051945050160195511,15085519782149686255,262144 --field-trial-handle=2064,i,6640350062180429149,1000866445589080752,262144 --variations-seed-version --mojo-platform-channel-handle=2060 /prefetch:2
  2⤵
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2036,i,2056179774699495704,12961364785538875581,524288 --field-trial-handle=2064,i,6640350062180429149,1000866445589080752,262144 --variations-seed-version --mojo-platform-channel-handle=2716 /prefetch:8
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3392,i,16252075342139660128,491774218658501430,2097152 --field-trial-handle=2064,i,6640350062180429149,1000866445589080752,262144 --variations-seed-version --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3412,i,966393521699363710,14235859567239434359,2097152 --field-trial-handle=2064,i,6640350062180429149,1000866445589080752,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:3464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4208,i,14384640841986793975,17374792371077697591,2097152 --field-trial-handle=2064,i,6640350062180429149,1000866445589080752,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:1
  2⤵
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4236,i,11056260538694643649,3145468034988812678,2097152 --field-trial-handle=2064,i,6640350062180429149,1000866445589080752,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:2
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5056,i,7256502818473367924,14286791477031183293,2097152 --field-trial-handle=2064,i,6640350062180429149,1000866445589080752,262144 --variations-seed-version --mojo-platform-channel-handle=5032 /prefetch:1
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3624,i,8336471268442591287,17161720586761606976,2097152 --field-trial-handle=2064,i,6640350062180429149,1000866445589080752,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5196,i,8901327695797223562,8913315638518258338,2097152 --field-trial-handle=2064,i,6640350062180429149,1000866445589080752,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:1
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5544,i,7671728887441816591,2693992647988482270,524288 --field-trial-handle=2064,i,6640350062180429149,1000866445589080752,262144 --variations-seed-version --mojo-platform-channel-handle=5540 /prefetch:8
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5560,i,3422179583795608772,9261575354725341348,524288 --field-trial-handle=2064,i,6640350062180429149,1000866445589080752,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:8
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,9485424881885624905,12542634103152473627,524288 --field-trial-handle=2064,i,6640350062180429149,1000866445589080752,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:8
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,9485424881885624905,12542634103152473627,524288 --field-trial-handle=2064,i,6640350062180429149,1000866445589080752,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:8
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6388,i,18206227954931096815,7195239568504966866,2097152 --field-trial-handle=2064,i,6640350062180429149,1000866445589080752,262144 --variations-seed-version --mojo-platform-channel-handle=6688 /prefetch:1
  2⤵
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4236,i,15153124800689498001,3642893221912290975,524288 --field-trial-handle=2064,i,6640350062180429149,1000866445589080752,262144 --variations-seed-version --mojo-platform-channel-handle=3364 /prefetch:8
  2⤵
  PID:876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4348,i,14647263282085864030,11969132724716586533,524288 --field-trial-handle=2064,i,6640350062180429149,1000866445589080752,262144 --variations-seed-version --mojo-platform-channel-handle=4504 /prefetch:8
  2⤵
  PID:5108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4824,i,17935887717582176727,7469261836329717041,524288 --field-trial-handle=2064,i,6640350062180429149,1000866445589080752,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:8
  2⤵
  PID:1416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,10564675751223278038,435221743114380200,524288 --field-trial-handle=2064,i,6640350062180429149,1000866445589080752,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:8
  2⤵
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4408,i,11587740010354492063,10906414761581922903,262144 --field-trial-handle=2064,i,6640350062180429149,1000866445589080752,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3484

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4700

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bf637ca0b28ebd6e948876848ccfe71d201158d460d4ad944f124f9d17ee5472
MD5 827e00d89fccbbde703c679b5c7ff536
SHA1 6d9e235782beb4e6b38fd4db2946f9bfc725110c
SHA512 1d18100db386f25678d8dabb492ab6e15d08e2c5a7d7e6c76bc253df648e2b5438cbc4fcb5a4033a1e14afbda93b271225eb5f545f12663d6bc35ca51239fcc3
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7X:fwUQC5VwBIiElEd2K57P7X
TLSH
T148B3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

26de7942-b043-4676-a4ee-69b42c9a588a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\26de7942-b043-4676-a4ee-69b42c9a588a.tmp
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 bd535895bc299965b4630b80a33b4523a16d172c0159c2baea1ab2246c2f73eb
MD5 adf3699976526855b14e57619cb5737e
SHA1 aef96187230114743fee20a75b0c211254795416
SHA512 686ad014a1d08e8123a94a0abb105a32312f500ccab86401b2dc3c948a109cd1bdd9de98bace7b74d2896cad28dc7fec6bf27b3a7c717064b5495278f790ae96
TLSH
T178710D390A4FC050F3A0C671A5D11D2E7BBE448B475F8E99D3B339FC551A795A563808
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589093.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe589093.TMP
Size 3KB
SHA256 17fb41b20083cc79689f8f0ff1902a001b76d107f6e0a494d3c2b86bd6bc8b09
MD5 7a009d34fce0495f255ed730ab8fa434
SHA1 82709743136469e5809a2b6915cf5b6014f06de2
SHA512 e5ce7e147ef9d522c90b921696c10f8f4a2ae3347508de8b1fce1ee24058d3289b6b1a64a096e8ae8992c297d1e7133844271bf7666ccc6d044c01ebd45eec39
TLSH
T167611C3A438FC160F3A0C672A5D11D0E3A7E40974B4F9EA5D3B339FC951A7A595A3448
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 61f0ed27337b2a3df226e8b3c32edba04d22e5bfdea7ac0930bb5b571a4ba67d
MD5 c588a0ab16fec9e8fa5acb554bc6ed36
SHA1 ae4e653e0a33eca4318deab44a7307d781390e57
SHA512 cc578ac95567d872512f75fe7e014d2a447f8a9dfb3d83797b0315be9e1ad7c89c9b2974065de63f79456926328224dad2bc88d51b90a1d47f94cc6c6235474d
SSDEEP 96:DuXhrOuXZuXbuXguXHJuXUuXiuXAzxuXo7uXPuX/uXBuXaxTuXKbBuXjuX0uXWBI:DuhSuZubuguHJuUuiuANuo7uPu/uBuEp
TLSH
T1B9A1ABFBC2D9821DEA6152F16B103D2BCD6C091543683C7A89FAEF0F53E1875E20166E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 bd5c284680965016a7f8d10ee1bf225062e40186c327307fe2658cc18b16d461
MD5 db9514623d52dbb61d54c17d8f18bbcb
SHA1 23df060bef373984320c6e71780370ce5daab0b4
SHA512 b66dbdecf3b8bf706a516aeecf44b9f213526ce6d5138ca9d18adae9fa41038f82c7c9dd4fc482b023d4c2bec0569ca56edaa9b44cb3b872f9fea384d3eb5dc2
SSDEEP 192:sxZsRUyM/jK1Ml8Mk2/fhsrQSIdp9dAHW6+WNGFi/YHUnTRIgrJ:sxZsiM2/fhsrQbQHb5/H9
TLSH
T1E252D6166A389977CDCBD209FA45BB53D6F50472E2D01E44A9FCDA0C04E6EED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 f91d2ab97ade60bc147304585acde9334d3c99f6d888aa0546be3957887c80b4
MD5 b413fd0374ea63c3900400456eece3b8
SHA1 9ee24f0302b7c0187607f2d590b62b59a2795b0f
SHA512 3917b317ef4d677bb95497fb670124d62025cf3c3423b7a1f5927cf986cac0af9ef9eee0f3246dad4db781e895cea268cdf6ef571d3aca5794e0297ee88925c1
SSDEEP 192:sxZsRUyM/jK1Ml8UQqk2/fhsFHSIdprdAHW6+WNGFi/YHAWnRIg5UJ:sxZsiq52/fhsFHb6Hb5/Aq
TLSH
T14B52C6166A389977CDCBD20DF945BF53D6F50472A2901E44A9FCDA0C04EAEED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 05f254cbffcc5a7df1649e5536f2fa0c42532b6db037846068f8491d4bc03691
MD5 803472707a5e18e3c9fee29c6391f64e
SHA1 cd6213dce222488d9a8ae8e5ce4dca596356f714
SHA512 073ff5b72ff1c2088c2ab04a8dc169ba81cbeb473b7e8d586eee2d855b8e96de88857c7f04ac13fc8553f5b1695b3323269df2aec75d0f5b3081fdf6a67cc7e5
SSDEEP 768:kXUZYTMWvg09o8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4RvroVG0m:kXUZYTMWvg09ou1ja7eLZmR8jm
TLSH
T137E20B2F280CCB7E4F844E9DEC2A6F963ED801CB5A984D5447EA894C03CB6EF511759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\1a5dbd1435c2ccb9fa0cd3e9a4d27e29582c0a34\093919b7-60e7-4059-8a56-556c4f5b1acf\index-dir\the-real-index
Size 144B
SHA256 03e6baa95380e0fae581212e10e187a879b9cfffcdebeb9f5d508e3016a90fa8
MD5 77ec51331296073d27f569d5851a8d10
SHA1 680104af482875e4780b63cfd843275c5b4513d5
SHA512 3ef4998be4525d3a2627481f3fde38e9c8d733acc25b17c1bcb9e68d19815d2608783449f4b341c5d5a77bb07e26e54332532284d239505671f6c7f60d16a4c3
TLSH
T1CBC01230A9400A00C83327B17DE3880853340C550671009D5349F4ADBCD56F88481744
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe587d0b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\1a5dbd1435c2ccb9fa0cd3e9a4d27e29582c0a34\093919b7-60e7-4059-8a56-556c4f5b1acf\index-dir\the-real-index~RFe587d0b.TMP
Size 48B
SHA256 c2cb04efb65ab0e62a9af934effdd2b1010d771b3a9eaea9480db5a92f3afdf3
MD5 97321719da37655d1039fc8c9f130893
SHA1 341d3c4c5a20c889e718c0542761dc75760023f7
SHA512 9a74972897c4deef72ecf54178ce0405e0bbcdaa3bfa1b14a55f3c2ca8d89f24c4520212720b41dc3d1711a486a2b603b9523aba1f8472c1105306e207fe74c2
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\1a5dbd1435c2ccb9fa0cd3e9a4d27e29582c0a34\68a881de-c3d6-45fa-a7c7-4047d517bd4a\index-dir\the-real-index
Size 192B
SHA256 19ad945346b554d5ce0c5b49a52d194766809b8c3634e94e11f985ecbed623b8
MD5 72ef44de2c88dca3d6585975f4fc9519
SHA1 42c84fe8bd122e06b194ce858f18999aa94afec2
SHA512 f3e60f79472ee3418839aacfb8e836c3f29bdd34db36459e333cc7c21fc4349e6b869439ef2a7b64ccf86d727b5fae1f23cdf61981d048cb5e1098b9ea878691
TLSH
T122C02BA0C920432DCC00033DC156C4F032A40C7A66C17E13B040FC004417380D22353A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe586c23.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\1a5dbd1435c2ccb9fa0cd3e9a4d27e29582c0a34\68a881de-c3d6-45fa-a7c7-4047d517bd4a\index-dir\the-real-index~RFe586c23.TMP
Size 48B
SHA256 845e48d28954f366302988b2607a64ad9def83eb829317d0688ff7cf10ce378d
MD5 20d6c82ad6b636f2cd9411f891052776
SHA1 c2a0d6254f8822526b2c9bfc74405e7346ac04d1
SHA512 af83fe630d87a4571133ccd4ef66455da91ae47a327a396a7d1362b860296381004cc816a4e496b0c25394fee5b9bf2e16a5b7e4b4f86afe5d10c322aa891051
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\1a5dbd1435c2ccb9fa0cd3e9a4d27e29582c0a34\index.txt
Size 281B
SHA256 e609a863408fee1a3124240ff811bd7f8c5c0b48b7d2000437a48b37d7026a49
MD5 4d82af7a08ed8b0708cc0a29678b4085
SHA1 0ff02f18722c2958d8babeee461efd631a90e47b
SHA512 2baccda4e95b768e97f89202df1ba3f7ff4de2a0dc6ee131c7e21376e2bd092c5d4ab254c90fa6eb745ab98e7eb1e6e1244139f50dea42826590866cf057b6ce
TLSH
T123D0C222AB668856F3AE87EE9F36B0ADC629F8AA04C8DC488491E02C4074914941AF42
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\1a5dbd1435c2ccb9fa0cd3e9a4d27e29582c0a34\index.txt.tmp
Size 286B
SHA256 1f18007b8a8811845aea2bcebd5da429d3bdd0a25303ae3623c193d1b4ca794c
MD5 94caf51ad125ad172809ae2f56001832
SHA1 0e188fbea10c2fd935d8824204ea8f4e801fb7d0
SHA512 dd3691493b8067bc6a5cfbd983b8a4fd4ccd3298e9cc0e3988d902c0dfdf611b3bf2a50c0988cf4ab9fb2fa3c625e070cd6888dce1014cd6dbb51cbbf156df5c
TLSH
T189D0C222AB668856F3AE86EE9E36A09DC629FDAA08C89C488051F02C4074515951AF41
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe58247b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\1a5dbd1435c2ccb9fa0cd3e9a4d27e29582c0a34\index.txt~RFe58247b.TMP
Size 165B
SHA256 f0f194fc3627fb0d9bc5a2f29fb90c5a723990482b56d016a4aa289aa4e14502
MD5 97d17ed37319fc3668df5a415bafa5cc
SHA1 dc83ae41a08fc41ed22c75a375b8bff99f29db1a
SHA512 676c453cfe868aa4d6225b84cd3a6c1e88f107ed5bea469b31ba9910c3b8abd2303049f70ff59066f753bf5da31c0dd196ef84b9163cefb1e5d93db30de24f4d
TLSH
T11EC0807353214C56E76D46EE8F33744DC71DFCB508C848484041B05C5074555D41BF51
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 d7efd4770a7e6c096cff8510cb95b64b0c5b72864a67662c49d00b89852c0e3d
MD5 3bd37be371da77e712a4d718a76a00f6
SHA1 969167a935dbcbfbcc911fb7e3920b170cde2675
SHA512 bbdfbfbb0f781f53783216cb54e55cf2513c8dca9cd67ab4fcb269ab210f1b61a0a0295df5766627f64ceb8b11ba6eab895d94e0d874daa209e2b33774c1a294
TLSH
T152A002B505D45061C15486F0D441268A2B158A1543433315C3E42464C86224E5112445
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe586a5d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe586a5d.TMP
Size 48B
SHA256 981d39cde268ee8b17bfdf49d4fe0bd35e549670dffb31fde1d2e9951d3441d6
MD5 29af5ec54b24ba2cb08897fca85e07c7
SHA1 860e696c2624ae3efa621c33dd87229050596b06
SHA512 2feb58c05c53f1bb2e9daec3d9535d1f93fd52dad62ecfcee336db55a0fb2c1fd8e40e5d16ad7cf9cf827ccf025843afbaf097b4ba13c86c3c809134947d08b7
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 11d3e4464de24295b6227014d1d4168c518a3cc0db5dc0ce18cd4ee354806d8f
MD5 566275a398d736788cc976c656deb12e
SHA1 4b72184408787573b2c4351cef029976a6bfb182
SHA512 de7b1540523519e66a39bc6d1124cb9c260047fddee2c17ab7081c3de8d5e6697b4bf7d9180ca837ad2fcde51f59877bedbd7359e5a1851d5619dc965bb3dd29
SSDEEP 96:KA1eK2AYPOKQo+G1CKG0vLsfrZhR2ThC9Rr2KpTRd2tjLaNLnWNqK+0o7q5lj+:Ect51j5T
TLSH
T1DFD1184271F622013D7E3B0982A497575E45F163311CA96B7BAC10B64E2AE21DDFF8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe58e903.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe58e903.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 0035c665f26835c9445299f110cb8e95c9e173bb2a753c3da8850faade20cd47
MD5 d4f8509767a252b254c5ea86499a8bd4
SHA1 e13318612b546807b3e4356ab0ce1561e6caed96
SHA512 de807b99e7eaee2d1b6a9a94bcfa9c12c2c42c0d18adce1c77784600729c4f31c40c2417f8a5c68119b9bb39a017c6c9df953116b785679679e03b3053fc3ea5
SSDEEP 384:AtNn/s3n9SfsNoY4Iv2+wzX5od+W8yLXkC82MbdbJEx94:Aj+9U64OtkCix6v4
TLSH
T194926C329465AC2B5EA3E589F50B36170FB89167D7843F84D1EC7F1C05CA6AD130BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 dced06c94f47631e3383fd3f2ce0583324a2d659dfadc80472ede532c67c4943
MD5 87a16e88f901b25ffa3709372bea46eb
SHA1 dd16080e8f4a13237ddc3ad01638d66e43b6711c
SHA512 fa7a7607b82a4a0f10f248d4210da26d42c9b036eb51a364e986b48dafd64bf329f5330fe828709f0aa91d059e3030a7deddaeb13b884a85a91f9494711214cb
SSDEEP 384:7iF1tNn/s3n9SAzsNY8TUNTUlIlt4Iv2gwzX5od+W8yLXWC82MbdbJEx94:WF1j+9TdwgB4OtWCix6v4
TLSH
T18BC209F244D7983AD99E9747B73E3D064EBCD167B6806A40B3986A0CCC8A1BFC306D05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 fd4c105043a566218999740ff1d22d7df9e6db55f74e899af5e2d0edee0eda88
MD5 5fd3f27ca1803b40f15303351b938bf4
SHA1 754c1563c6ae25fcdf8ccf8c1d0c3659804bc913
SHA512 1f4b8d003ee24821fe4abdb65b4592328f0ec9752070535d070baefd52bae59fbe5a2c4274ec4d2c31c0b4c2fd1546746c65bb39ae8108a718becf77f09e236c
SSDEEP 192:yON861VWQmiUySzgGX5Obd+j2jzoryXm0/aY3mDU6:yON86W3gGX5od+W8yUhDU6
TLSH
T1CC02C935A8687CAB8EF2BE49B48737135F992067EA552F84D6E81B1C00D769C2347C37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d64d57852204296288d51f8b4c51cc409acec186bc7860b75372ec3489ac0328
MD5 c3f1dbcc421fa618854fdb9f0f756150
SHA1 543370d99b1f5593102d01132d9a7d087d204821
SHA512 3555d2da46c39a812cca2e851db81cd085762dfcd3a0cda668b93a9bdba29727f14b2c8f1c47d5e0faffa601b2b330374a4ef8610019296ad86cdf1c4e666b6a
SSDEEP 192:zONp612WQmiUyFzwGX5Obd+j2jzoryXmOXY7djJyqyU6:zONp6niwGX5od+W8yLXiCU6
TLSH
T19712F832A468AC6B5DD2B585B44B32135FA95167EB887FC0D2EC2B1C00DFA9C131BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 d7750b88eac0ba237da2b46cdab598103dee98f7a68ad51cee56a0038e4a74c5
MD5 b4843c9ccfe1f55388e711037a58fa91
SHA1 36c93892eab13a9aac84021895b0b2330a64efbe
SHA512 18e419258d30893350d1c97fccff738ffc705636ebb9518ab7d597615c1165049ad34bf5875f63be278aa2281011417c7310506ceedab0db53e0d6d310618d41
SSDEEP 384:ZtNn/s3n9SfsNot4Iv2+wzX5od+W8yLXkC82MbdbJEx94:Zj+9Ut4OtkCix6v4
TLSH
T1AE926B326465AC2B5EE3E589F50A36170FB89167D7843F84E1EC7F1C05CA6AD130BD1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 91919225066b374c739bd170043daba94606625d9f079fa36995a162a6d8444a
MD5 c79fd568f5550ace138e8214a2725fa1
SHA1 652104791ba3e2b11591659202c2eb671525da12
SHA512 b97f9544bb3e51eccffc5c558c40f02b492ffea16311f7b43ab2a86a709dc9850bbcb5ae44eafd2b86e8b9298ab8555ae7808b355c5b27db7460358f5da57835
TLSH
T1CF413658B6E91108F3B76F5A5BF7A86E487EBD771E06D45E00020E4E0A62E40CCB1B37
MD5 SHA1 SHA512 TLSH

Submit Download