hxxps://tria[.]ge/dashboard

Analysis

max time kernel
899s
max time network
714s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
23/06/2026, 01:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://tria.ge/dashboard
Sample260623-bvsg2ah19v

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2740	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134266517809412048"	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3054922120-1500138384-519748408-1000\{7C7A7AD4-66F0-4D85-BE96-6667210F4B04}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
724	msedge.exe
724	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe
4152	msedge.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 4152 wrote to memory of 4668	4152	msedge.exe	83
PID 4152 wrote to memory of 2740	4152	msedge.exe	84
PID 4152 wrote to memory of 2956	4152	msedge.exe	85
PID 4152 wrote to memory of 3840	4152	msedge.exe	86
PID 4152 wrote to memory of 2956	4152	msedge.exe	85
PID 4152 wrote to memory of 2956	4152	msedge.exe	85
PID 4152 wrote to memory of 3840	4152	msedge.exe	86
PID 4152 wrote to memory of 3628	4152	msedge.exe	88
PID 4152 wrote to memory of 3628	4152	msedge.exe	88
PID 4152 wrote to memory of 4024	4152	msedge.exe	89
PID 4152 wrote to memory of 3628	4152	msedge.exe	88
PID 4152 wrote to memory of 4024	4152	msedge.exe	89
PID 4152 wrote to memory of 4024	4152	msedge.exe	89
PID 4152 wrote to memory of 3040	4152	msedge.exe	90
PID 4152 wrote to memory of 1700	4152	msedge.exe	91
PID 4152 wrote to memory of 3040	4152	msedge.exe	90
PID 4152 wrote to memory of 3040	4152	msedge.exe	90
PID 4152 wrote to memory of 1700	4152	msedge.exe	91
PID 4152 wrote to memory of 1700	4152	msedge.exe	91
PID 4152 wrote to memory of 3272	4152	msedge.exe	94
PID 4152 wrote to memory of 3272	4152	msedge.exe	94
PID 4152 wrote to memory of 3272	4152	msedge.exe	94
PID 4152 wrote to memory of 3336	4152	msedge.exe	96
PID 4152 wrote to memory of 3640	4152	msedge.exe	97
PID 4152 wrote to memory of 3336	4152	msedge.exe	96
PID 4152 wrote to memory of 3640	4152	msedge.exe	97
PID 4152 wrote to memory of 3296	4152	msedge.exe	101
PID 4152 wrote to memory of 4856	4152	msedge.exe	108
PID 4152 wrote to memory of 780	4152	msedge.exe	109
PID 4152 wrote to memory of 1236	4152	msedge.exe	110
PID 4152 wrote to memory of 2096	4152	msedge.exe	111
PID 4152 wrote to memory of 2096	4152	msedge.exe	111
PID 4152 wrote to memory of 724	4152	msedge.exe	112
PID 4152 wrote to memory of 812	4152	msedge.exe	113
PID 4152 wrote to memory of 876	4152	msedge.exe	114
PID 4152 wrote to memory of 812	4152	msedge.exe	113
PID 4152 wrote to memory of 876	4152	msedge.exe	114
PID 4152 wrote to memory of 3116	4152	msedge.exe	115
PID 4152 wrote to memory of 3116	4152	msedge.exe	115
PID 4152 wrote to memory of 1624	4152	msedge.exe	116
PID 4152 wrote to memory of 1624	4152	msedge.exe	116
PID 4152 wrote to memory of 396	4152	msedge.exe	117
PID 4152 wrote to memory of 396	4152	msedge.exe	117
PID 4152 wrote to memory of 760	4152	msedge.exe	118
PID 4152 wrote to memory of 760	4152	msedge.exe	118

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://tria.ge/dashboard
1⤵
- Drops file in Windows directory
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ff81eefc188,0x7ff81eefc194,0x7ff81eefc1a0
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,2445922069393748895,11384785107761167123,524288 --field-trial-handle=2716,i,575942887812105466,195573766705800912,262144 --variations-seed-version --mojo-platform-channel-handle=2764 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1700,i,16852076035393193979,16058701810602866801,262144 --field-trial-handle=2716,i,575942887812105466,195573766705800912,262144 --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:2
  2⤵
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2260,i,17108995833725192263,16436156566992952696,524288 --field-trial-handle=2716,i,575942887812105466,195573766705800912,262144 --variations-seed-version --mojo-platform-channel-handle=2784 /prefetch:8
  2⤵
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3476,i,6286867406370569255,12942931411814392259,2097152 --field-trial-handle=2716,i,575942887812105466,195573766705800912,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,4144729150945889688,36720958534064610,2097152 --field-trial-handle=2716,i,575942887812105466,195573766705800912,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4188,i,7785968425090029939,13596769025419592639,2097152 --field-trial-handle=2716,i,575942887812105466,195573766705800912,262144 --variations-seed-version --mojo-platform-channel-handle=4184 /prefetch:1
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4248,i,12662940269731736403,11573445325298343695,2097152 --field-trial-handle=2716,i,575942887812105466,195573766705800912,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:2
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3576,i,3885409166534190856,2028830945170130276,2097152 --field-trial-handle=2716,i,575942887812105466,195573766705800912,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3612,i,6192610790218400556,12869123310387529404,524288 --field-trial-handle=2716,i,575942887812105466,195573766705800912,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:8
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3552,i,3575515303166657537,9123976921439450181,524288 --field-trial-handle=2716,i,575942887812105466,195573766705800912,262144 --variations-seed-version --mojo-platform-channel-handle=3780 /prefetch:8
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,3651627660314976698,10063739616556389136,524288 --field-trial-handle=2716,i,575942887812105466,195573766705800912,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,3651627660314976698,10063739616556389136,524288 --field-trial-handle=2716,i,575942887812105466,195573766705800912,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4204,i,2294732451554009353,17493629138744603672,524288 --field-trial-handle=2716,i,575942887812105466,195573766705800912,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:8
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4248,i,9728212059252264668,15365835626430325864,524288 --field-trial-handle=2716,i,575942887812105466,195573766705800912,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:8
  2⤵
  PID:780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4236,i,17415964761511002344,5349195202518822283,524288 --field-trial-handle=2716,i,575942887812105466,195573766705800912,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:8
  2⤵
  PID:1236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4908,i,13525137590781150973,16564065762938617916,524288 --field-trial-handle=2716,i,575942887812105466,195573766705800912,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:8
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3712,i,6687568728871599309,12620024390156607765,262144 --field-trial-handle=2716,i,575942887812105466,195573766705800912,262144 --variations-seed-version --mojo-platform-channel-handle=6120 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5700,i,16069435814883527901,11690149908332380003,524288 --field-trial-handle=2716,i,575942887812105466,195573766705800912,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:8
  2⤵
  PID:812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5524,i,11839763186797161325,8985932830355772061,524288 --field-trial-handle=2716,i,575942887812105466,195573766705800912,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:8
  2⤵
  PID:876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3512,i,10878461470718765001,14442815079596422219,524288 --field-trial-handle=2716,i,575942887812105466,195573766705800912,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:8
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,10040369425942803110,16521153277149796591,524288 --field-trial-handle=2716,i,575942887812105466,195573766705800912,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:8
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,17254301647914474744,5932813931698065204,524288 --field-trial-handle=2716,i,575942887812105466,195573766705800912,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:8
  2⤵
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6396,i,15298977418461854124,4813982653542437284,524288 --field-trial-handle=2716,i,575942887812105466,195573766705800912,262144 --variations-seed-version --mojo-platform-channel-handle=1548 /prefetch:8
  2⤵
  PID:760

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5108

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9ad7b3e4-01c9-4188-831b-9702f71f8afb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\9ad7b3e4-01c9-4188-831b-9702f71f8afb.tmp
Size 8KB
SHA256 b28bd97b163a4cf8efb6a12fd53d9099ac5dd19d9fec027a6f24e7f92ba17104
MD5 df7a57186011e09836a14fb11ccfecea
SHA1 7ebef35fc67249100ed932418f099ba727640e63
SHA512 248d5d248cfe937740fbe0edf884b4bad7978891eff4ee4da54cf94869eba40884b0446082e869117c02d2994f55884d4589e6d2beff98c1bf05d96995b79950
SSDEEP 192:nON56G+bwQmiUyUeHE54aP12yXRYcT2XeJ08ShlqDVU6:nON56HwMHE54at2yScT2hwU6
TLSH
T1B8120932A8746C6B5EE3E851B48736136EA98327E7C5BB50D6DC2B0C41EF29C130F526
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fb2adc73b0e2921e667c28899e7c4f830fbb29c7f563ca0b3319ac4cd7007983
MD5 5a6df42dd698122d665520fb12140c37
SHA1 9d09f6fa2f10e669a83386ff53aae5fba73effeb
SHA512 52513e0bbf5b162ddc3643441c215f197264c32736ed560286ad3dcfba5831b89dd961ff3c2ddda1a50ae1bbaf4589e17ef43817fe8c3294ca18c88dec2e21b4
TLSH
T15DD012317B5BF001C6C120B2D8348B79923F889A74D7C652B024C88EFDF625DA3D6067
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c2c9a9ffe645bb4483011279363f1d6b7efe3d1311c969002595db89e2e28e26
MD5 fd1a71c5f52353ab70a63caeadd8a35f
SHA1 1c2efede69f9484a6b25dfb9879b2e134c0c04fe
SHA512 53bb310c44087d0ad54291ea32ae8e6708d9e6675875d074264aa49b27317393b3c1f0758bd53b04795df767f42392d93ad325da28f085258329151e4a47a03d
TLSH
T12ED09B213756A001C5811071D4244765512E44557497C6527014844DEDB61595395057
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 aa31403004195e69a5aa75b14f48d3f01f96aff60cc25e9999eda38159b90fbc
MD5 c30b8836645b2b6ccc9b6ff521af9f8a
SHA1 4599fafdbae1494a799e704662a8e9fc9f313b94
SHA512 9a9499007359901cb957b2d971f197d83258630ba5eb55cac829f8d7ec4f3c53a00579beba8bf0e2c8036417ef13846e9fd992df309440154955a5cbe305a002
TLSH
T13CE0D84C8780F2F601C29546D8586354AA54364B9ECBC99E376CA48C1421BC0CD98E98
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 dc7a90505f326bc93345f92d71082827b008769e6a55d44f771a2b3dbc58a927
MD5 cf631c44b182e4552418e838d9c3e519
SHA1 d8e203fb77f7190ee6f73c9b0ca3bdc4addd6935
SHA512 35d56b72c011cbdb41dfb393c259c188412cd63b84860076eec6c447b1c9a2a6b4edf4cdf55b39831d677f1e329064d7401cd056c594d35b2c59857d44db0597
TLSH
T10BE026884ACAD3BEB380644F4269470C92C1360E9BCB6BCE2708888DF041384E7D66A0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f40511856cc8ddcd62e19e29e6375d826968a9b3eba8a21cecab8a294ec05c1d
MD5 ae8cf28a758861d567e6ceb80be29ba2
SHA1 19d17ad4d40ae6c49d863649139d365f46cad608
SHA512 085d7c2d99432e2329f7bf5b460b3c931f72fe1c9ecc2bc4d4f3a913eb7325b03d6600f3330b303b14c3fe8cbf5d60779493cd4aac37997fbcbb35ed8d21471d
TLSH
T1DE71E814220688F3F750CDF1ACD2D54436B949315B674E8589512DFABE067A7CBF83E8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b35d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58b35d.TMP
Size 3KB
SHA256 c3d996998656dd192b1c82a727f3a4ff6a1c21215b95ee1f6e019c07a74e0fae
MD5 1edee74c3ee5c232ed9ee8e7b580bb16
SHA1 1fe3a00fc188eea782ee41456bc576978bee4188
SHA512 c1c995fa813304af3b74778b93e394cd368c7aeeb20c670bd85fe65c71b82cf5ddf6c445b8d97c3602dcafa66e4dd38c45f4fc22801755138104f198b8e4a658
TLSH
T11661D804260684F3F350CDF1ACD2D948367949316B674E81884129F67E06BABCBF83F8
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 534e372ef89c68d31ab050e9cf39a0d78bed6dbdeae062f956e80958c7c9b92e
MD5 36403e51ae5656c2cc2f743cca17895f
SHA1 dd3cf730685b007d2c24495644beeeb6229a91c8
SHA512 de1f0dba074c2a9dc0c52b99de0e4421e3c91f8be35c2ef4a886eaeec44ab84e7681e5d02ef06b23a16677c4cf354746907ef7d486fea6a7863a2514c506153c
TLSH
T17A31CFF683A186ADDE1152F0A914BE2BCE5C0441436C3D5A8AE0FF5BA7E2071E002F4B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 c9a31136fa7148390c6539a34c9331a1cf6539948101772195b36e81676053c1
MD5 96887d110e8bbd4050e4fad53bf972a5
SHA1 dc02d492b7c650615270dea54c709c68a952b594
SHA512 ba3b595d9d56fecd7b0623eaae5bbb06feb1b98b934061ff1c3866bab8db026e578e794d310a95fb5ee60c0f4c0fbb77a87b50f503b96e564f8a6922563dd21f
TLSH
T1CC31BCF3C7D585ADCA1152F0AA247E2BCE1D094653683D1A8AE4FF1BA7E2475E101A0B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 347bb7facfb15e6ff61dc836043844da49f2e900780478fb39b0de4e556c9e90
MD5 2f382f3ca912c5e9c18ae350a81ce9b2
SHA1 dfb1cb4fc1e7c26ff2e307f15542a56cd94deb64
SHA512 c710f57139455385b29ee3526e88d12b2e1ee4a67a14046aead660c11b1df63f1b2d4106fe66b1dc95f051d0ff680d8c4601df50f793757ad5c6d39396b600bd
SSDEEP 192:sxZxRSyM/jK1Ml8UQEkh/fpss0PLKg21Idp3RHW6+WNSn9/Yn+ZqUHIg5+J:sxZxAqfh/fps7zKBGBHbc/qus
TLSH
T1F852D9126A345977CCDBD20DFA56BB53D6F94573E2900E44AAFCCA0C04E6ADD221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 28KB
SHA256 df3a770ac28cf8536ee9e80e0f7d9514d8a64d01157da1e615e2bfb903fd7a81
MD5 a3d04667f396713847714607723fc6a1
SHA1 609c673f1e87118c8241545f9019d5adfb2f7944
SHA512 ad8fbd98bf107a2148a2e8245316b059bb93f092f0a9b35a630bd032668d46d191f012a3d5d52034e7dd4625c91d4c7fed0caee5bed341d00476800b3a3ae3af
SSDEEP 384:sxZxXqfh/fps7zh66s8qMpRiYnazAW8pZS15posJWeT+RBGBHbc/q4s:sZ6fh/f6zh4Mnc7WeT+RsHbeqx
TLSH
T12CD2F706A924C8778FC35D18B57D7E3399EC409262C5CEDA5AECCA0C01AD5FDAB47827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 3a1a5f2eefb1c22fe41892c8d9281db0e279b69e11f3c5df7e8a093e60f29c1d
MD5 9e2a71068f7dea2f8d2f277e1c61fdf9
SHA1 92d95f918487dcfcaad9fba02b6e727859831bd1
SHA512 4aaa435206fff759a9ec62379d8265cc69aef6ce0b2147ab3e6265a388a820b1c00982b434a70841c8230ea9022842666d9bc2dd038eb31f667fe0450dee356a
SSDEEP 192:sxZxRSyM/jK1Ml8Mkh/fpsJ0PLVg21Idp9RHW6+WNSn9/YnvOqUHIgrJ:sxZxAMh/fpsGzVBGDHbc/8u9
TLSH
T1F542D9126A34597BCCDBD20DFA55BB53D6F94563E2D00E44AAFCCA0C04E6AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d3e43ffece80b9db86a9c9948216455880a9f7679c274a77895aa081f002a93d
MD5 49ae77f30003cc86da2317a9a44d6cf2
SHA1 e68116f154828ca5708897e64bca7ab79e408d0b
SHA512 6f56f11660ecaf97f6a2720ac2c7e0b602a8de6b1b5210391a6b518eb172e17f175da8e4b1d644bdf9f762d3ba9eaf6b9533e8ecfc4d0a55b7e414749b03e659
SSDEEP 768:HuQRMvUWv0sTg8F1+UoAYDCx9Tuqh0VfUC9xbog/OVFTLlTBshgro/YxDP:HuQRMvUWv0sTgu1jakTLROhr/YxD
TLSH
T134D21C3B284CCB7E4F841E6CEC2AAF976DD801CB67984D5447FA884C03C77EA511A59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\6265b350-bfe0-4fa4-9770-1f37078466b1\index-dir\the-real-index
Size 1KB
SHA256 acb499d7b7488ac2a5e25b12f3ae922d8eafabb1254db6456c04432a60213cfa
MD5 769c25f19624e8abe0c2ea239fa5b715
SHA1 4b6f35f53f9ab8edeac3194efae8c1198efb5aca
SHA512 b8e0e7c492c4a1d77158a15780db4df0edca0e71d161427b9208f574581aee5541736dba540c24c0e88606d4d58a7cff70123f28892ef8f8ae107c63cb9a5b40
TLSH
T10F2150998E978A1FF9A449B200B368E033B0C9DC2321A3635C3C233B2D217992D172C8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5cf99a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\6265b350-bfe0-4fa4-9770-1f37078466b1\index-dir\the-real-index~RFe5cf99a.TMP
Size 1KB
SHA256 4e2457bb4d515ce24e4ac0cbc874d763d99b4a549bc2d40bb3fd50f31371a9a6
MD5 96a1601cae4d109221fc7e2d358a6cb6
SHA1 9782f05de77656351e1b064c50f311cb21ec0ec5
SHA512 555beac01fce78ffb731e2d9341fce238566a064e379cdea8f564c5df92335f55191d4ad421e2dda21b6718794aea4ee18b7b0ff4bc18845229fca6b0890b846
TLSH
T10E2140CA4692494FECD441760543A4F43370C900A322B383A939263E1C3478D5A4B0C5
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 592fde550ffd627e743b52efc8784cbd67ef5d69f6375be8ce343767cf2878f4
MD5 338631bec4897f1cec3e44cc88879c60
SHA1 219f4cb5a1098e477d64e429182b71fcab70e816
SHA512 01582c4d6ec34581b370325eaf13becfbd29d42c602d846796209465693ffdfd2f49207c2edf878ee37c3ec3a31ab6e24a932707f39c0883512cf6b86d50a298
TLSH
T1A3E068B63ED72924E86F83C2283300A90189BA58D408BC5E002672D3E0B57213801C91
MD5 SHA1 SHA512 TLSH

Submit Download

6350d566-2223-4603-829f-575698a56c07.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\6350d566-2223-4603-829f-575698a56c07.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 e6564e017c0b96e3f7a8d7931bec55acacc20111e9aa730e710a188b26dc1fdd
MD5 861dee10488cc37b46346860ab850aa2
SHA1 134f01d7cf47d43f3e2c41879500af6ceb332480
SHA512 5f83ff6cfb91194646b8a329f2a53fd5ec084fd08118b92275ab1fdd0a6a4dc153aa7b729762427e868b9c84bc839f83a362833b1876b12160a98c76154db28b
SSDEEP 384:HtNn/s3n9SfsNgk1KeUT1X54at2yScT2UwITGT0IPx92:Hj+9UnJRxwySmbwi+0av2
TLSH
T12C927C339838AC6B5EA2A455F40B361B5EB48667D2C17FA4D5EC6F0C04DF298131BA16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 97a5887d3bf74da93afb076b111209116638d81f1442deb18df2b6e06bfc8c05
MD5 bf2ebdc3ff43a6f1245ea3930013429b
SHA1 0e7d915aa7e16ccb53dd66f5012e503a0ed64333
SHA512 0283e74548dda340653d6709bef16006589d4ff49aaf560c727653aae44c62592108761a68265888f998a02ac0930572818853910757675cd5e12e60672a3c2b
SSDEEP 384:2iF1tNn/s3n9S6zsNg8TUNTUlIlkmKeUF1X54at2yScT2hwITGT0IPx92:dF1j+9VBwgSrRxwySmowi+0av2
TLSH
T18DC21AF248D7983AD9AE5747A73E2E074DBCC157B1C06A54B3C85A0CCC8A1BFC30A911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 7ede7a299d8d534cd449870e8afb6a76cb1e2e543ac9c7eb0bd1d874b37ca917
MD5 e08e57d8b38f486d35712b621c3e2d41
SHA1 0e712d4c0cf928a6fc0260f1c5b38320608e99a6
SHA512 5318f7ef1dc1b4971d5bb424aa93615a96de7b455071fd3873ac4933255a5caecdf9e3831144b3917a87633183c46b7a950476d57cb0f55532cfc676def35ba2
SSDEEP 384:utNn/s3n9SfsNgkmKeUT1X54at2yScT2UwITGT0IPx92:uj+9U0JRxwySmbwi+0av2
TLSH
T16C927C735838AC7B4EE2A455F40B361B5EB48667D2C17F64D6EC6F0C04DF298130B616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 37b54c29bb8e3a13b98b485e1dbf0d9dd53dc1078fa88befa5c24ca107f56736
MD5 df5c569e42bb1ea4c2d85425699af577
SHA1 c8f8610b03d1ce549444b7a7e3dab14c922d614a
SHA512 2602c4f239ad7d67c3cca25af4c6112c1e5aa3206709c8f2054dd2b48b7fbec635f424fb77ca7a047c094e413fad54d68ee7b18e95d5b8f9338a01edcdb83b87
SSDEEP 192:CON76G+bgQmiUy3eDE54aP12yXRYcZ8Oym2U6:CON76HgdDE54at2yScgBU6
TLSH
T1EE02E835A8786CBB9AE3AD45B4872B136F98112BE6C16F44DAE81B0C41DB38C130B536
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1f9c84f8-dd1a-400c-914b-5182bbd39a2b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\1f9c84f8-dd1a-400c-914b-5182bbd39a2b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 0bd9538bf58ea34708fcd1dec86bcdfcb45e20acaf048c78bb566a8e35b22a21
MD5 2f96969c37ac8a7cff9391301e3f89f9
SHA1 b65d66f1a365911dc2bdb67b7ff6042a117ad1c3
SHA512 63d501017cb1ea5b2847460d37fa3ccd744f9f0ef4bfd2ddd21103798df1bce499cb17ebe0bd5fb6b9ef292478eef885a9e0f43652af11b9e0e3419d715df36d
TLSH
T1F641079CB6F91148B7B7BE56ABF6686D447FB8B72E0AD45D10010D4F0A62B00C8B2737
MD5 SHA1 SHA512 TLSH

Submit Download