hxxps://support[.]docusign[.]com/s/contactSupport?language=en_US

Analysis

max time kernel
598s
max time network
554s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/06/2026, 10:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://support.docusign.com/s/contactSupport?language=en_US
Sample260625-mxvkysaz7v

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
744	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134268585703765986"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{0C089EE7-95D7-4571-8131-A28D8A8875B4}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4188	msedge.exe
4188	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe
2764	msedge.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 2764 wrote to memory of 1600	2764	msedge.exe	86
PID 2764 wrote to memory of 744	2764	msedge.exe	91
PID 2764 wrote to memory of 2700	2764	msedge.exe	92
PID 2764 wrote to memory of 2152	2764	msedge.exe	93
PID 2764 wrote to memory of 540	2764	msedge.exe	94
PID 2764 wrote to memory of 2700	2764	msedge.exe	92
PID 2764 wrote to memory of 2700	2764	msedge.exe	92
PID 2764 wrote to memory of 2152	2764	msedge.exe	93
PID 2764 wrote to memory of 2152	2764	msedge.exe	93
PID 2764 wrote to memory of 2996	2764	msedge.exe	95
PID 2764 wrote to memory of 540	2764	msedge.exe	94
PID 2764 wrote to memory of 2996	2764	msedge.exe	95
PID 2764 wrote to memory of 2996	2764	msedge.exe	95
PID 2764 wrote to memory of 4468	2764	msedge.exe	96
PID 2764 wrote to memory of 2452	2764	msedge.exe	97
PID 2764 wrote to memory of 4468	2764	msedge.exe	96
PID 2764 wrote to memory of 4468	2764	msedge.exe	96
PID 2764 wrote to memory of 2452	2764	msedge.exe	97
PID 2764 wrote to memory of 2452	2764	msedge.exe	97
PID 2764 wrote to memory of 4188	2764	msedge.exe	117
PID 2764 wrote to memory of 4192	2764	msedge.exe	101
PID 2764 wrote to memory of 4188	2764	msedge.exe	117
PID 2764 wrote to memory of 4192	2764	msedge.exe	101
PID 2764 wrote to memory of 4776	2764	msedge.exe	111
PID 2764 wrote to memory of 2624	2764	msedge.exe	106
PID 2764 wrote to memory of 3384	2764	msedge.exe	107
PID 2764 wrote to memory of 4012	2764	msedge.exe	108
PID 2764 wrote to memory of 2872	2764	msedge.exe	115
PID 2764 wrote to memory of 2872	2764	msedge.exe	115
PID 2764 wrote to memory of 4188	2764	msedge.exe	117
PID 2764 wrote to memory of 1200	2764	msedge.exe	119
PID 2764 wrote to memory of 1200	2764	msedge.exe	119
PID 2764 wrote to memory of 2580	2764	msedge.exe	120
PID 2764 wrote to memory of 2580	2764	msedge.exe	120
PID 2764 wrote to memory of 176	2764	msedge.exe	121
PID 2764 wrote to memory of 176	2764	msedge.exe	121
PID 2764 wrote to memory of 3332	2764	msedge.exe	122
PID 2764 wrote to memory of 3332	2764	msedge.exe	122
PID 2764 wrote to memory of 1100	2764	msedge.exe	123
PID 2764 wrote to memory of 1100	2764	msedge.exe	123

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://support.docusign.com/s/contactSupport?language=en_US
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7fff02acc188,0x7fff02acc194,0x7fff02acc1a0
  2⤵
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2016,i,7560816687208233601,13556403207877686198,524288 --field-trial-handle=3136,i,8769842665442126151,16949776168586534287,262144 --variations-seed-version --mojo-platform-channel-handle=3164 /prefetch:3
  2⤵
  - System Time Discovery
  PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1748,i,1886346823776248111,1127336127689232960,262144 --field-trial-handle=3136,i,8769842665442126151,16949776168586534287,262144 --variations-seed-version --mojo-platform-channel-handle=3132 /prefetch:2
  2⤵
  PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3212,i,16104897699861972943,18397665906601302087,2097152 --field-trial-handle=3136,i,8769842665442126151,16949776168586534287,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2344,i,8561170865153299792,6767944709861834540,524288 --field-trial-handle=3136,i,8769842665442126151,16949776168586534287,262144 --variations-seed-version --mojo-platform-channel-handle=3196 /prefetch:8
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3192,i,16946947704850278964,6362764348966065921,2097152 --field-trial-handle=3136,i,8769842665442126151,16949776168586534287,262144 --variations-seed-version --mojo-platform-channel-handle=3304 /prefetch:1
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4108,i,10003591602494962091,1431648964706961026,2097152 --field-trial-handle=3136,i,8769842665442126151,16949776168586534287,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:1
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4168,i,7058873881367225184,9751249826085727720,2097152 --field-trial-handle=3136,i,8769842665442126151,16949776168586534287,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:2
  2⤵
  PID:2452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5048,i,4744889453226582439,380178069183875265,524288 --field-trial-handle=3136,i,8769842665442126151,16949776168586534287,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:8
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5040,i,17316142046097143143,18229680469608178666,524288 --field-trial-handle=3136,i,8769842665442126151,16949776168586534287,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5800,i,17026522068111768778,17569666330552464754,524288 --field-trial-handle=3136,i,8769842665442126151,16949776168586534287,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5800,i,17026522068111768778,17569666330552464754,524288 --field-trial-handle=3136,i,8769842665442126151,16949776168586534287,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4532,i,13436930070374067387,15336870384051342191,524288 --field-trial-handle=3136,i,8769842665442126151,16949776168586534287,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:8
  2⤵
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4548,i,17130145105963439738,9341972699561031518,524288 --field-trial-handle=3136,i,8769842665442126151,16949776168586534287,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:8
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4544,i,4415223091554444968,14844975167693077203,524288 --field-trial-handle=3136,i,8769842665442126151,16949776168586534287,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:8
  2⤵
  PID:4012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,11649815741140333892,4581000785092444778,524288 --field-trial-handle=3136,i,8769842665442126151,16949776168586534287,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:8
  2⤵
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5904,i,11116983704742737171,16317684577238409912,262144 --field-trial-handle=3136,i,8769842665442126151,16949776168586534287,262144 --variations-seed-version --mojo-platform-channel-handle=4380 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5468,i,15907670207842553893,13731342339637360965,524288 --field-trial-handle=3136,i,8769842665442126151,16949776168586534287,262144 --variations-seed-version --mojo-platform-channel-handle=1040 /prefetch:8
  2⤵
  PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5608,i,4045008552712321784,13719887420861125683,524288 --field-trial-handle=3136,i,8769842665442126151,16949776168586534287,262144 --variations-seed-version --mojo-platform-channel-handle=4564 /prefetch:8
  2⤵
  PID:2580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6240,i,4695301877995610710,16315287117010790514,524288 --field-trial-handle=3136,i,8769842665442126151,16949776168586534287,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:8
  2⤵
  PID:176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4500,i,1790051272119106716,791234519911537177,524288 --field-trial-handle=3136,i,8769842665442126151,16949776168586534287,262144 --variations-seed-version --mojo-platform-channel-handle=1308 /prefetch:8
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,12854899799160118704,5847204812824201377,524288 --field-trial-handle=3136,i,8769842665442126151,16949776168586534287,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:8
  2⤵
  PID:1100

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4644

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv
1⤵
PID:4776

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 994380ffd288a5f1a9acc9eb76a487a55b12cc1daec839d811240f6cbdc4da3a
MD5 f5ed4946834be586ac6410ed88740a7c
SHA1 6108ce368e8b3bb8012956bb25606c3b16835c7b
SHA512 76bf60b37c50422ab125edd3da70629e685408a106655a9b7e5cb6aa7b6a9000c76d8ac2f5dc85e58e893b61bef9b539b9488ac894f1fc1338a58944dc9f4711
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P77:fwUQC5VwBIiElEd2K57P77
TLSH
T1E5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 6KB
SHA256 a32af4e20e3dae6f04629336175f0dd7699d7a147efbb157031132e047023b3c
MD5 24fc229cc385eca1175e88edffaef7a9
SHA1 8d64715b8fb0a14dd0972731a6b09e987a6d9e4c
SHA512 7c3f43f41c3e7b6cea25403f6fca3c5fc5967f09ef99e6dd25035f9ae827695b67d94fd0cd5000ec2ab4bc6dd937cc36ea3c6fce6d53dc6550d599461045eaf8
SSDEEP 192:Ijj9cQoQQQzQzxzxzxzOzOzfzfzfzfzGzGzGzGz3z/znzyRzdznzOz3zGzpzDzbV:CjjpxctttiizzzzKKKK7breRZ7y7KtXl
TLSH
T130E15956C2D4DB9ADF15209A49B463AC41B0370EEBDCD90C038C9DDD348E69FF4A97A8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 56493f25ab8b44d86afadffb8624ce046a3614960e750bad49c087385ef95e21
MD5 b2af11c1def16ebec5f9ea5b9479c12e
SHA1 78eff8fd4075dfee380b86eb0dadf2d8b78985dc
SHA512 0c5f71e0b4c88cd1850fbea340ecbbe7bc89ddd6ddae2ecd3127a867e9266d569ac0d3d7105f06fdc47929e7ca461ab2fa3c05a7b6f99fc6bfae2d31a9971cac
TLSH
T17471717906A755C4F3110738B3F23608367141A80A9FEE1A3957BFF869C27AF6118A5F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 055df2fa9e87c40806ec2f81a6545b5b177b5f97f00efd4d9d229ade29ecaafc
MD5 4fb6e61a1d7b2b4ba2fcb14f4898564c
SHA1 18b170b489e8d98d19af05e6e3b2aaf0b7dd149b
SHA512 2de82847054c7e0e5a50076e1249a4cc36fd907380c35b2d37096d68c490f7492b4646297c9f714ee9dd1dafaf9c8ef0f2099e1bc45e3f0491d7c67eb2143a42
TLSH
T17571817906A715C4F3120638B3F23608367141980A8FEE1A3957BFF469C27AF7118A5F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58dcaf.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58dcaf.TMP
Size 3KB
SHA256 3485ca3d7e3097b1804ebf5fb9e3b8f40bc405314083de6541eaa7118f48a322
MD5 f8732ad52166b5d6e0a6f09ca83f4d13
SHA1 59e6bee191ee9ed9883c6eb58a4d54e38ce10963
SHA512 adf25c31f4206627629ce2beddcde3d16ccc511168446b20da97b7d83f131f383b139b715bf35f282bbcd45c81bfe705da80647fd1c600dd65562b8c11c7d36d
TLSH
T126615D79066305C4F3214238F3F1321075B14498089FEE1A38177FF465C1BBE6115A1F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_support.docusign.com_0.indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_support.docusign.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 d2563152c97fae40e23cd2e72888aa8831499ffcdaf4f287e41f9b9f8fae92c6
MD5 0f067519bc5a53899458b0c17178391f
SHA1 831771fea600635c23a56927436e7df9ef1bc64b
SHA512 38d7505425d811acc1627d2cd90e30467cf9403c9ebc6644b9c256ed2c0940d0a2c61c4cc57f7201b05e7b8b3fb6a4e190c8fe9440ba0c0db32a20f4d435145f
TLSH
T17D414BF387B45D2DCD2252F5BB352E2FCD190810A36C386AC6E46F1B93E1464E101A9F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 83c89a60cb172dbaf34454eb8332a83f8700460bd98e24ca30aff68ab82cd059
MD5 074b7e73995b95f4d0c6f692656f3cb7
SHA1 e19310e8c0bbc88e3f28fe66be8c592356b297ba
SHA512 db609281080cb6b681255f7695b1adae940fa6cb92164669b0aae6cae0707a416c18e178cd13e9ad82432dc48f09bbdf9aeec099edbb95f5bf90a0c73bb50f9c
TLSH
T175414CF747B05D2DCD6292F5BB352E2FCD1A0410936C386AC6E46F1B93E1464E101A9F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 e5ce29ba280a9befb989e73ccb88c8e0a5ae527eec364889fe7cec1edb730fc9
MD5 b855fed3e7a0dad20db2d4220c235800
SHA1 7aa5e51b8f88cf8341b2ee3fdb538256b12ab80d
SHA512 d06f7ef59597bb895e6000aff03b628a0672885573229537d47a2e66716636f838d161ccc0a55f52eb1d634d72d484a96f1e024ef6b44480c91f10b3f02ae16d
SSDEEP 192:sxZo/yM/jK1Ml8MkS/fTsw2vIdpMKHW6+WNUdT/YHkZy5xIgrJ:sxZo5MS/fTsw2A7Hb2/o9
TLSH
T1AA52E7566A346977CCCBD309B955BF53D6F90472E2941E44A9FCDA0C00E6AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 26171b617738c710088531bc5207cb90b41639dfe04ab549cdeff2cf5f3306e8
MD5 4a32cfe97d60fbd45bdd7351943ed54c
SHA1 e4d1fab610d85d7bdcf1737ec80c88f39c7086ce
SHA512 38bf935cd1efc83c79a7b628da1a1d53ddc7da39b030c18c618acfafd859848e3805a3dc8f548c4f6450ad3c10990bd6bfe2b8dbf436d8675460271ae56e3065
SSDEEP 192:sxZo/yM/jK1Ml8UQGkS/fTs7B0IdpOKHW6+WNUdT/YHh0q5xIg5KJ:sxZo7qtS/fTs7BtdHb2/Ug
TLSH
T17952E6566A349977CCDBD209B951BF53D6F50472E2941E44A9FCDA0C00E6EED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 a1a822664966b6f7129fbe8f43db9defb176d270a6c7cce14938cd6a9b653843
MD5 d7c27768dfb0ed36de2bb1c53de0eebc
SHA1 3aba7e98930f6cb4167697cbb8e4821fe252dc94
SHA512 eb0656498499dc3a6ce7d3aa579868b52cdaef5d19d1610144fbca93b18879c510b621c4997ef3b0c04101c99d654e33fa1105ce56d3525d8319ef044e6578a7
SSDEEP 192:sxZo/yM/jK1Ml8MkS/fTs7B0IdpOKHW6+WNUdT/YHh0q5xIg5KJ:sxZo7MS/fTs7BtdHb2/Ug
TLSH
T1F552D6566A345977CCDBD309B951BF53D6F50472E2941E44AAFCDA0C00E6EED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 fb20d9b216dbd6c527fd5f16157c2d7b9116a4f2c3f7c437759db7ab6f47c0f9
MD5 db1f132e1190535ca68c1558e2c36bd9
SHA1 b44a5a8f5cf79a054612d44afb9f74452a216930
SHA512 92ceff98cdd70abcbd43fd234b32d8b6ff08f9b2eb619ded773a99117f11da532cd9cbb5db98de8eb12af8a8c620a88370f02206b79e680e137d7da8b9381058
SSDEEP 768:e9UZYTMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4R9roV40s:e9UZYTMWvg0Pou1ja7eLZmR2ls
TLSH
T1CAD20B2F284CCB7E4F844E5DEC2A6F863ED801CB9A584D5447EA894C03CB6EF512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\53f0f5bd-7408-47e8-b6a3-5aa7e69ac4b4\index-dir\the-real-index
Size 1KB
SHA256 65c3d3f2868024af95af599d6aeb76eb8b78bb0cfc97a739917de1787cd9fe7c
MD5 61abfd40520beb08ba8edbe123ac6e98
SHA1 2aff9eabf7dbfe0997a61f65fd8cedc3c2f28073
SHA512 0cb4f451bd37376b8b9ffe6a53971234c0ddca15f27b480649a6d9c795d31c82bc43dd8df577c4db6afe7d3eeb2926c9a3f95924a1292b257992c98658e454da
TLSH
T11A31128D4EA0998FF8A081B21176B6A0737198DC4B25B3135C3C31327E2735E36175DC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5cd47e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\53f0f5bd-7408-47e8-b6a3-5aa7e69ac4b4\index-dir\the-real-index~RFe5cd47e.TMP
Size 1KB
SHA256 6b05dc44ff6cd42f53da7543874fd87e558be89e848403dca2085b9144e7267b
MD5 f86e24a267fec1518484f6347c771819
SHA1 072072381b964ccab17d518ce0899e6275fef8f8
SHA512 9a436b7ce1e79cd697c357ebee51de0946686e8ac162ff6725ac0a36df60afb903a8d36f0bd3a12ff188f0c5e1d88cdf98ade032cf7594558927909c40cb8277
TLSH
T16331254A4AD54D0BF884507A1963B4B8733188004311B393997C62395D31B8D1B4F0DD
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 371B
SHA256 8b26c3592e52cc9c37d3defbab55f29cb57b17b92254bb11d357275c2d8539ce
MD5 f4f07ba973d8ab10d71875529e4d2fa7
SHA1 7a94a14ed4df12e5bbadb948a9013a1588d8edf5
SHA512 2ce81cfc5509e399a104fe5218cfe73ed1685454dcc320452592c90645a516bc0c8b7702e9617be171e7e2e78084a27a09c49286d2181a0f539b3d20224ffeaf
TLSH
T1E6E0C0F33DFB1810AD7FC3D74471E4A441013CB8C64CAD8E00AEB2A310B23052806C32
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 6014ad8c81b57a2aff6d1b326a73ee52613b83884605aa88f4f8d11ba3e5d0e1
MD5 bc0fc90f2e6caa14e49b3783ff706e94
SHA1 5f72c9d3744ca1a4a188539986691c318244d138
SHA512 505fc86a99438dd295bb87df43b0443918652f3c0097685ac166c27e34c9ccd65e8c6a85d86a62094311974663818ed4c0f87eccb49bc30e707699a6e2738327
SSDEEP 96:KA1eK2AEsIKZSi6cgKNiOvaKAsWje9+cK/qd:E2PncJjeyu
TLSH
T16CD1295270FA22023C3D2A089354975B8E52F1A3305DE96F7BAC15B18D66E249DFF8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 5632201031c48cf741830c58ca3a3ccc2e8170b74f05c1fc4670035ac4cc5251
MD5 011d4e337205fef34d1312188bb8a6e0
SHA1 b89cb990d6dd69b36befd24f5afa0262ca1fabd3
SHA512 4142b03ffa48206fef0eb3b12ac35e9f76236fdeb1a53cdaa761882162e98a6a3539cd7c41a9f9a73146b0d1856dac8b113844f1a45e469fc8e0816c0f188635
SSDEEP 384:xtNn/s3n9ShzsN83RD9bRQNozX5od+08y91XFcGmn15wbAjEbX:xj+9eRD9bAwOrFhmn12bfbX
TLSH
T1D2927C36A8386C235DE3A58AB04B32175FF85567E7C53F94D1EC5F0D00DA6D8132AE2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 cfbde46d05f684a87eac39e417dfb2b49f4987588a16262da976262e2eb651b9
MD5 bd15a7f8a8ebe0de6ef2bea190d37265
SHA1 04c339db1235c8fbf7e8abddb4e48989a9d63b49
SHA512 bde26b6646b3280faa14d78dd88d1ddb51f25c9a75edbb7d164417f4f45177ccb6e46a05f8c8f83ad0b893ea8b1f5599dd4bd3d68d28fbac8e3622a8426b5dd1
SSDEEP 192:yONJ61VWQmiUyIpgGX5Obd+jIjzorynm2k/ao3oDLU6:yONJ6W7gGX5od+08y9zrDLU6
TLSH
T15402D83568687CAB8AE2BE49B48737135FE42167EA552F84D6E81B1C00D769C2306C37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 da24ab3fbec2072a1900eb48bcd3bc0a928d42ae61cc68628f85fe2d5d213a6f
MD5 4b8150b5ad25ba9fd587e71859c57048
SHA1 5159864ae99c1349bb8a37e824b44557e241aea3
SHA512 6390d7b39a0c40ff30b2d9cb6f3333a9091bc7fa8515f8d3683ee1c3b5bf71f017ab86e2dc7154cb6047c47413eaa5c867d105a4f7d9c02f3c62e3ec0667cd64
SSDEEP 384:w9tNn/s3n9ShzsN83RD9bRQ3ozX5od+08y91XicGmn15wbAjEbX:Oj+9eRD9b+wOrihmn12bfbX
TLSH
T192B218F654E75C32C99E5747B37E2D025EBCC027B2842A44B3E85B0CCC9A6BFD216916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 7289aec98243e048b71686e6d96a0efc8fc796ce6d7b4222b8105800f45ee641
MD5 d33ba4c1e20cb43321cf8f510b9758b6
SHA1 161301000ad5c753b9e0fea9d3d42bad2e02ae91
SHA512 9c17cc9f305acb0cbfaec93ce20f598e92fa2690b3f39de97cf2dad0de35a0adf06aab7c20bb7827cd04a0153ea706ba9a20fc12d9a1bc714adcbf14c3e188bc
SSDEEP 192:+LsN8zQ1IDStebvjtyga3QmiU1nf34zX5Obd+jIjzorynm21XaD04QWqYGU8:0sN8zRD9bRQNozX5od+08y91X9cGU8
TLSH
T11A3208366878AC674DE3B645B04736139FB41167EB893F84D2EC6B1C00DF6AC131AD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 eccebe0894ee2ac4a0f5391a026b6cb85472a80a356ebe98077cd0e364d92531
MD5 b6ad0e3402c45f9ceaaa158449b6ee24
SHA1 8bf7c4a9b71ed13c034c3e83a8c0d1cc9a20352b
SHA512 a4d96e1aeb5d7c0ce2f507cb18a760c8463412fdea9aa2c829eba2440d9a0cc8514beb2e0126f785298aa3274c5541dee44b3e58612d655e55274bf0d06b42d9
SSDEEP 192:AON161uWQmiUyZpYGX5Obd+jIjzorynm21XaD0jJWqYGU6:AON16XMYGX5od+08y91XncGU6
TLSH
T1C1120936A868BC675DE2B545B48731135FE95167EB887F80D2EC2B1C00DF6AC231AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 f9d2cf0442d8470f764d88ffc698124df134aec1429ec82abefebe17328713d3
MD5 25844edf4f5c2ffd8c7efb0fe463ba18
SHA1 4ac3cab3b3f400d1c379f81af488609c5ede3345
SHA512 fd6e13d8498e0cc03f3e9a8a46cc42845c59e9e71908bbf796e4ca13c2638dd73828df0f27c834d74fc64f1a921d1977c2df1d73f0f74f0166d860b04e4fb232
SSDEEP 192:u8LsN8vQ1IDStebvjtyga3QmiU1nf34zX5Obd+jIjzorynm21XaD04QWqYGC1B:XsN8vRD9bRQNozX5od+08y91X9cGC1B
TLSH
T18A421A766878AC678DA3B546F04736139EF45167EB893F84D2EC6B0C00DE69C131BD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

125f2b13-be83-4459-aeab-865f97b0eeb3.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\125f2b13-be83-4459-aeab-865f97b0eeb3.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 6cd4fb57a87ca65d02fe783231845839fd8ea491b9b5f021839f638ed5c893c0
MD5 104c27e41e77c53eb743a13e6089f65f
SHA1 74899a3f62572f7e2b17e88a4146bf6a73cd4329
SHA512 cb1688be8a820484e8e51c2cc1bb2a4aa6f8438b6977e8f0c518867d7faf9db5ac1acea058e215fb3ea481265c91637c09675b5899330b69471f5c32a7101af2
TLSH
T10841D758BAE91158B3B76F4A9BF7A86D887EB9372E06D45D00110E4F4673A00DCA1B37
MD5 SHA1 SHA512 TLSH

Submit Download