51470d8abf1636640cdbaa8ec94cf25d008f187f35bb67e8592cad51c480b628

Analysis

user interaction
yes
max time kernel
899s
max time network
720s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/06/2026, 16:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SD&Ops_SOPs.html
Size 671KB
Sample260625-tpzchads4w
SHA256 51470d8abf1636640cdbaa8ec94cf25d008f187f35bb67e8592cad51c480b628
MD5 592bbaf9524614e647bb3c15ffc962df
SHA1 b744b5caec9e87209dfea66fe228304b01d86ccc
SHA512 02232a96b4083f0867b81402b916d46d17b604343d288d26533aa01c88fba8e0148d08feedc21ece7d8fde1c63909b2a442057e4196e943e024139ea420fc62f
SSDEEP 12288:FiNp4S5xoInmCgtGmAzkKAHQsBjxCkYA06Dp4tZmXsPSB:Pm3n1gtGNqwsBVHYAkbmXs6
TLSH
T1DCE4BF726145A2BB4C2B44EAF914276B7DD07D2BFA970AE064FDC3B11FD2CA08D39485
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setupact.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\setuperr.log	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagerr.xml	UserOOBEBroker.exe
File opened for modification	C:\Windows\Panther\UnattendGC\diagwrn.xml	UserOOBEBroker.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FileCoAuth.exe

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4040	msedge.exe

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	msedge.exe

Enumerates system info in registry 2 TTPs 5 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134268777984349983"	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2894455325-857903158-4263030270-1000\{E6E7D652-10F9-4906-9CC0-98C465778EC3}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2894455325-857903158-4263030270-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2894455325-857903158-4263030270-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2894455325-857903158-4263030270-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2894455325-857903158-4263030270-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2894455325-857903158-4263030270-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2894455325-857903158-4263030270-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2894455325-857903158-4263030270-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
2816	msedge.exe
2816	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe
3596	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe
2456	msedge.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 2456 wrote to memory of 3596	2456	msedge.exe	88
PID 2456 wrote to memory of 4004	2456	msedge.exe	89
PID 2456 wrote to memory of 4040	2456	msedge.exe	90
PID 2456 wrote to memory of 4004	2456	msedge.exe	89
PID 2456 wrote to memory of 4004	2456	msedge.exe	89
PID 2456 wrote to memory of 5280	2456	msedge.exe	92
PID 2456 wrote to memory of 5280	2456	msedge.exe	92
PID 2456 wrote to memory of 3980	2456	msedge.exe	93
PID 2456 wrote to memory of 3980	2456	msedge.exe	93
PID 2456 wrote to memory of 3980	2456	msedge.exe	93
PID 2456 wrote to memory of 1552	2456	msedge.exe	94
PID 2456 wrote to memory of 1552	2456	msedge.exe	94
PID 2456 wrote to memory of 1552	2456	msedge.exe	94
PID 2456 wrote to memory of 3052	2456	msedge.exe	95
PID 2456 wrote to memory of 3052	2456	msedge.exe	95
PID 2456 wrote to memory of 3052	2456	msedge.exe	95
PID 2456 wrote to memory of 304	2456	msedge.exe	96
PID 2456 wrote to memory of 304	2456	msedge.exe	96
PID 2456 wrote to memory of 304	2456	msedge.exe	96
PID 2456 wrote to memory of 3684	2456	msedge.exe	98
PID 2456 wrote to memory of 3684	2456	msedge.exe	98
PID 2456 wrote to memory of 4044	2456	msedge.exe	99
PID 2456 wrote to memory of 4044	2456	msedge.exe	99
PID 2456 wrote to memory of 1432	2456	msedge.exe	101
PID 2456 wrote to memory of 5460	2456	msedge.exe	105
PID 2456 wrote to memory of 528	2456	msedge.exe	106
PID 2456 wrote to memory of 5384	2456	msedge.exe	107
PID 2456 wrote to memory of 3192	2456	msedge.exe	108
PID 2456 wrote to memory of 3192	2456	msedge.exe	108
PID 2456 wrote to memory of 2816	2456	msedge.exe	110
PID 2456 wrote to memory of 5300	2456	msedge.exe	111
PID 2456 wrote to memory of 5300	2456	msedge.exe	111
PID 2456 wrote to memory of 5300	2456	msedge.exe	111
PID 2456 wrote to memory of 5380	2456	msedge.exe	112
PID 2456 wrote to memory of 5380	2456	msedge.exe	112
PID 2456 wrote to memory of 5380	2456	msedge.exe	112
PID 2456 wrote to memory of 1376	2456	msedge.exe	114
PID 2456 wrote to memory of 4688	2456	msedge.exe	113
PID 2456 wrote to memory of 1376	2456	msedge.exe	114
PID 2456 wrote to memory of 4688	2456	msedge.exe	113
PID 2456 wrote to memory of 2016	2456	msedge.exe	115
PID 2456 wrote to memory of 2016	2456	msedge.exe	115
PID 2456 wrote to memory of 3920	2456	msedge.exe	117
PID 2456 wrote to memory of 3920	2456	msedge.exe	117
PID 2456 wrote to memory of 1292	2456	msedge.exe	128
PID 2456 wrote to memory of 1292	2456	msedge.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\SD&Ops_SOPs.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x274,0x7ffdd3a5c188,0x7ffdd3a5c194,0x7ffdd3a5c1a0
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious behavior: EnumeratesProcesses
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1576,i,17278642544862985364,11405678512324547655,262144 --field-trial-handle=2068,i,475592530667690399,13695979919665300722,262144 --variations-seed-version --mojo-platform-channel-handle=2064 /prefetch:2
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,9659230964931074611,4985733574677965497,524288 --field-trial-handle=2068,i,475592530667690399,13695979919665300722,262144 --variations-seed-version --mojo-platform-channel-handle=2120 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2356,i,5474022386713681438,1114929246721097953,524288 --field-trial-handle=2068,i,475592530667690399,13695979919665300722,262144 --variations-seed-version --mojo-platform-channel-handle=3284 /prefetch:13
  2⤵
  PID:5280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3580,i,4634710896669206369,6959442405622319221,2097152 --field-trial-handle=2068,i,475592530667690399,13695979919665300722,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:1
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3528,i,4241284805297328377,12214558664655028850,2097152 --field-trial-handle=2068,i,475592530667690399,13695979919665300722,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:1
  2⤵
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,4781629111352130808,1075585737524081394,2097152 --field-trial-handle=2068,i,475592530667690399,13695979919665300722,262144 --variations-seed-version --mojo-platform-channel-handle=4868 /prefetch:1
  2⤵
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4296,i,13549408160522708907,18397957273821695792,2097152 --field-trial-handle=2068,i,475592530667690399,13695979919665300722,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:9
  2⤵
  PID:304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3700,i,12050388769047502135,9109325679751584638,524288 --field-trial-handle=2068,i,475592530667690399,13695979919665300722,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:14
  2⤵
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3712,i,9168249531421058381,5399355388150788058,524288 --field-trial-handle=2068,i,475592530667690399,13695979919665300722,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:14
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,7089758882598069420,18234757142242618035,524288 --field-trial-handle=2068,i,475592530667690399,13695979919665300722,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:14
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,7089758882598069420,18234757142242618035,524288 --field-trial-handle=2068,i,475592530667690399,13695979919665300722,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:14
  2⤵
  PID:1432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4964,i,2460591812544308351,2458524871492906922,524288 --field-trial-handle=2068,i,475592530667690399,13695979919665300722,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:14
  2⤵
  PID:5460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4228,i,11274726957635180062,7962933470292444487,524288 --field-trial-handle=2068,i,475592530667690399,13695979919665300722,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:14
  2⤵
  PID:528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4296,i,8512519652126471365,12918519392360328704,524288 --field-trial-handle=2068,i,475592530667690399,13695979919665300722,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:14
  2⤵
  PID:5384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5552,i,10931714807533050408,11809971732176456921,524288 --field-trial-handle=2068,i,475592530667690399,13695979919665300722,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:14
  2⤵
  PID:3192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6472,i,992549511764952379,8026221370118693841,262144 --field-trial-handle=2068,i,475592530667690399,13695979919665300722,262144 --variations-seed-version --mojo-platform-channel-handle=812 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6112,i,15612309292547260588,7022772394434852055,2097152 --field-trial-handle=2068,i,475592530667690399,13695979919665300722,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:1
  2⤵
  PID:5300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5484,i,10644397019342852266,15487259515682052577,2097152 --field-trial-handle=2068,i,475592530667690399,13695979919665300722,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:1
  2⤵
  PID:5380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6664,i,7045847383690513203,4271591715077903849,524288 --field-trial-handle=2068,i,475592530667690399,13695979919665300722,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:14
  2⤵
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5764,i,4837247472965211103,12887172946179545111,524288 --field-trial-handle=2068,i,475592530667690399,13695979919665300722,262144 --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:14
  2⤵
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6936,i,6531082870631136557,17049861892051184268,524288 --field-trial-handle=2068,i,475592530667690399,13695979919665300722,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:14
  2⤵
  PID:2016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5200,i,10733565875466201041,16655337328970219332,524288 --field-trial-handle=2068,i,475592530667690399,13695979919665300722,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:14
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6804,i,10357481184082106355,15447819212673088136,524288 --field-trial-handle=2068,i,475592530667690399,13695979919665300722,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:14
  2⤵
  PID:1292

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2892

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3888

C:\Windows\System32\oobe\UserOOBEBroker.exe
C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
1⤵
- Drops file in Windows directory
PID:1436

C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
1⤵
- System Location Discovery: System Language Discovery
PID:5396

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3604

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:5800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

metadata

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\metadata
Size 114B
SHA256 f39a75ee98e151ac11cc4e39f01e7b2ba6db16e57f054681192b98efb78e736a
MD5 4e726d6f33e7b805424556b09ac56d24
SHA1 a1c0f3485d5ad390c0dfe028239d38822c6e906f
SHA512 2936579ef5f4cf770fbbf12773e210716e2498c2236c12b23a0e81f0db99e0f2d9d116cc400819ab2a443c1751c1b1b6446b33c76efcb585969845c8a6cbf93a
TLSH
T190B012B53B442109C412C4F140488B232969C7BDE612028075061DC11D415CD4C960C4
MD5 SHA1 SHA512 TLSH

Submit Download

f6a74ce2-8a54-4c76-977d-ee0de7ee5b05.dmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\reports\f6a74ce2-8a54-4c76-977d-ee0de7ee5b05.dmp
Size 8.3MB
SHA256 d8f5c7c3a200f1824e5e1305649b8cd2973ab1970144cad8af6b03ed9f0f57fa
MD5 b57f4fb27fb6ab37170404ad4adb38ee
SHA1 c28b5a9b6f1a50ea4c3f248ebc0b571844c571c9
SHA512 2f5925c8e8b2552377df5aa636c332642fe5db2b858cecf53c9ad6b7a1dc1166d64c7a36a6c2829be02eb0dcf4ecc53d95b7bd2f0b896c2342e2df09ef0d5688
SSDEEP 24576:rug88i80e9Rb7Tm4u8CnUb+EsOAA+YPyMLHICX/:Sgo8r37UnUJP/7X/
TLSH
T1E496E825B3D2C59AF00982BD469BB7456BF3FC904BC28B277111B75F1D7B2486E2BA40
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4921dac989a582c68ea2ce6e44eb3bfcd7f8bf3d87dd155763734d09e46d6684
MD5 6fe58dba083868c4939df3729856b544
SHA1 2946fc6a531247a5afe5d20c0abec1329e76da1f
SHA512 435b892e3c3ced9c341bcad7627e98220f381783f6c0d232345dd92e9cb28357bd93211262aa046fe541f6bd0686d5084ac7e92c687fc72829288aa7d9c823de
TLSH
T1B7D08034FB45B745C78605F2D514A720637A864534C2C60DB1A2D50D98681D0B7E79F7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 db527a753fa1b61c1784c7e59df5ec18881ced2d5206b75096d75bd1aaab39da
MD5 18bd661cf22857144a33398357bf42e6
SHA1 3e264f95e623055c7c7483e5d23fbb942ee082aa
SHA512 d5c779c90686c1eb63e30520d2d6a02b002ab9c6178d9cfac791717faff5ca9bd60abe1bc6c7a38d6665f83ba6a7411aec3777dac3cc18ada53e1d3395db2451
TLSH
T190D0A730BB15B7D1D75501B681205620627A554735C28609B291C90D88780C0A7E7DEB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 51eea118857f6a426095c9f145f0393dc3d76deda04cc8d6d4d776deba2e00b8
MD5 0118e81da4957faac1eb97d02ef430b3
SHA1 85511eca6ad6f56caf2ed10c4df0d4cc51ed1774
SHA512 303f7e5b7b10498f898696e1289499975a5b37fcbe245a4abe7c025a04cd8fe49581e830b41fca964115c2b03882bf9ebb32c822bea1877854c5d38d23e04054
TLSH
T157D0A734FA257BC2C73511B2D12047107579659636568246B281890D8C3D0C55BE7EEA
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 29d917a100dd42bc4b76d62ef10fe6a885e74a7c8b300a11bc2602bb9001f76b
MD5 0b3f4055e89c413f5d8325410b468087
SHA1 c11d3475b0626251d279bd86a74e9533f273fe48
SHA512 eb0051aa861ac65dee707fd2d7508086545c0ac858c878277a30052670d426d11ae851b1328bbdc9b8d26be5e0a95ab111a73b89fe7900c4d7af0a9a3529b66e
TLSH
T115E0D84CD390DBB92188A5CB847EE319C250B26F968DCC7E3205A28D74435407364690
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 a62db77d23725769442001d68c71b54e4d6935089f3aba1ad2dd9c120e064a65
MD5 113ec05c05e2f2a01b75744a9a27d4dd
SHA1 8e8741846502e3117a29eb7e36f9f0b0d45e0d9c
SHA512 cfe47ddc80b91c84b87fff1a270850e6309add394edab9f1ab51f92516050b23a563bb97f027a587988f3bc0383dac0a559d7ad736e31acf87248221d503fb3e
TLSH
T18DE07DC485C9CB6EE249B6DB416C670CC3D0376FE2C97D1E2B0489887147294F3D2694
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 274B
SHA256 80623a57124b3732ab2ff9b2889ed038782792c459140d589f3e066d2205c972
MD5 3faa2f1fb4c4c25d92850a5ea762ebbf
SHA1 d27efb4eb86d00dcca30094bc8254464e881ac4d
SHA512 c6702221b7e8c23c90f0aa0ba8191953fe0e9eb41b56d648f9786667a1c984113c611186bf4815d10de6ff218dfb53d662deeff0da712b1175cd65ed80e63b40
TLSH
T101D0C2E8A88C684EE2E01BFD5662B0500F5457D244269F020310B9C136659F01A66035
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 e85f3d57ba6f9c6ec22edca52606100b2156b0a905e6ebba62bc783e52c4de05
MD5 45c3782c97d21d5752327b3bce659430
SHA1 fccdc3ac485f822e8c3785b9beda99cb7fb5fad8
SHA512 0bca29ed6e480b4a21864c655a06730048d4356a5f9c2006f9c484e7277f4294a01d8b15238651df89bfcad3097f495486b8c8ed94c3a0dd391c61fd81ef26d4
SSDEEP 192:YamsUpXnULa/RJ/Mxh/hTmj5zeBB/F/E//y/8R/zMvCU/Qm/zQ/x9tZtW4km8d/b:YamdXneM3MxZhihe/l+/U8pzSCuQQuxe
TLSH
T127E1A29D54EE0D94DF490D7A01E20CD877328F8AA27B5F97A48C34B83AD37CE805909C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 45a30c1489496c7b8e4938b43ec0d3047b5d02a249881c2dc08fcb534dd35a48
MD5 884350f94910d305d7718f2795feca05
SHA1 953c56f5c3b1ea6c25fbb9ea1e3f665755036ea6
SHA512 675e934f117ee17609610f54400feb0463d9ac7bc08f81e391992aa5fa4a67dba1e1188d94c34923dfe6972676898c6387dc733e19795d1f469d831036a48a94
TLSH
T1DC61B49A12F25C65CBA94C7F40C718A93372DCE97B3B2E29B08548B87EE1B07D45D0D8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe599ea7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe599ea7.TMP
Size 3KB
SHA256 d6a6519e0eb2dd12e22ac41b340bcfcbbddc360d38ff869639c34b18c06165ba
MD5 64e06009fe5dae78880cddb4ceba02c7
SHA1 a7c3b124ade0f42729009f8459db841f769a7c32
SHA512 783dd8f6dab9d16f2aea8abce868a3a5008b9a427f40300ba0d7a5f55cde0ef133bfb8d618f7e77f1b9c2ad58dd8a13a64ca5900d24babb84a39a7c3ced0e871
TLSH
T1D161B69A52F25C55CBA94C7F40C718A93372DCE97B3B1E29B08548B87EE1B07D45D0D8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 57bdc83c1c8c0b0e34ae9a86e7f111e1979dcba308d723a32f115aa08b14cf79
MD5 e363992433cbd0f773840e1d5f3ba2cd
SHA1 e6c22966cb2e17ab82be11073e08d17ea9fe3175
SHA512 c88806fcd200d6073031dac23b731214daf54348e99991c498561e83241f62732b4ce37165dbaad631e7aa23dd5564f76a5e45dcf4236d8948d85a98f35ac94b
TLSH
T1C041BDF3C3E8856D991146F4BB183E2BCE1D0954436C3C5AC9E4AF5BA3E2871E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 3092e535cf1e41443507a59b46d787f832e75a34f1efdd21ff654699267f8c55
MD5 2b5a4e3c28595cc80853477f182d3109
SHA1 b18f51c8b2fadea314843cb9087f85517c7fbd28
SHA512 27457bd04322f30bae1b95b79a3d163931bc03e60096e0f73f3ce0df65f8eb6523157e7deb0166175244dea33b7d7398f7948b5d7ac47aa81c5f3065bb2a2511
TLSH
T13A71CBF7C2D8C67E891196F1BA147E6BCE1D095943283C0AC9D4DF8B93F28B5E20154E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 4d2ff486d7ef1a7bea86089407b69f19b2006b5e6e069beeb1ff93f1a2964505
MD5 080865b8286b887dac98e3df213d2d5f
SHA1 aa79ec11c2a78a416db2416712156283a1e76b20
SHA512 ebb1b17c3613ffd99efe7f0273c7517ee673f0b0158837439ecab47b9be01225c64f8add6ae284577d22c645cbe03a467b8b28f15c668e135ebdb029ba213bc2
TLSH
T1CD71B9F7C7D8866E891196F0BA246E2BCE1D096942283C0A89D4DF8B93F2475E24654E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 bb5d439e74637cfe087a05dcb4723bc20666abd06a950ce3fe82379425c917a2
MD5 975bc8a6a676a15a9bc4b1e9266f2e59
SHA1 00ae3a8728b74023cabf510055c03ffd34abb5f4
SHA512 b983db17c84ac483165ba60bfc31fb1067c040359db78f442b03e99262892f0976fde7dcfa4c212b292db1954715008932e311c17d39404124c5930f253fc94b
TLSH
T17861BBF7C2D8867E891196F0BA146E2BCE1D096943283C0A89E4DF4BA3F2875E24154E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 5d969fe783ef0c501d90b49aca7d0e05730ab6128909c88173b45431c9c624b2
MD5 0e3e8fdcbc2e4fceabf2e257012b3c88
SHA1 a6d0d0ea68e23d7a6004357412260425250fc5a1
SHA512 abbcead4eefe8ed3ca9487e53e3b831794df09da60c718d55f99bb72b8bba9ac8d823deeb4f529c421e6a517c7a9fa530cbdd70dc2cde0a58400eefef9eb193c
SSDEEP 192:sxRrRJyM/jK1Ml8wFi/fdsUH3Iy6zoA8p4o/g6+WNIYPPU4GbizIgD6J:sxRrxbi/fdso315/5IL3iLC
TLSH
T11B62C8166638593BCCDBD209FA557F53D6F81572F2941E48AAFC8B0C00E6ADD221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 d2063ffc71406852792077c4372940653f40c67c20278653f999ff8bc6e24cc8
MD5 e007fd8b12eda034f281e30212c4e781
SHA1 1f404f830c926b07ef96b78af9633b6b14335931
SHA512 1792668c73f0cfd113ac60879afcd9faa29710abef6502a675cf7ecca3e2d8133b7e9912c2197240815300a13054d314e5a5bbd54cd83aecb274ad750fa75d56
SSDEEP 192:sxRrt0yM/jK1wl8UQKDi/fdsUHcIy6zoA8peo/g6+WNIYPdU4GbizIgDgJ:sxRrWqci/fdsoc1//5Iv3iLw
TLSH
T15662C716A6385977CCDBD21DFA557F53D6F81562E2940E08AAFC8B0C00E6ADD221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 c9e656e8a2bb13eac32fa72f1b2d619b8e73adab1d4ea01e954c8f517f13a83e
MD5 5af577506949833fc84b7b65afeab91c
SHA1 faea5bae3d4301ddd7c8ef6c6fc1c4f3b34213f3
SHA512 08d54236010fdd61158ef08b3acf1f7b1e0e69cd0e2ce38f7e1819f9d9436836d2ec5e04ada611480d156b207941fb18d74dd28ed037bb39098960f1f4274615
SSDEEP 192:sxRrRJyM/jK1Ml8UQKFi/fdsUHcIy6zoA8peo/g6+WNIYPdU4GbizIgDgJ:sxRrxqwi/fdsoc1//5Iv3iLw
TLSH
T1FE62C716A6385937CCDBD209FA557F53D6F85572E2940E08AAFCCB0C00E6ADD221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 2edfb22581c8dfa48b72cba13ce793dd699193b979f98e4766a3c1fe593c0e1a
MD5 bdba0de354d09769ad1deefe51facfa3
SHA1 9e4a8504f3c0ea6cde163043f53472ffca69b180
SHA512 9a9d4c69f34ec5210af25ccabc2893913fdbc90e1f6996cdd599d11957e18190568647a57c47d999bf9186ca3b2816644afceaf5f694fdf066c2b6af3fc19bb5
SSDEEP 192:sxRrtNyM/jK1wl8UQKDi/fdsUHcIy6zoA8peo/g6+WNIYPdU4GbizIgDgJ:sxRrzqci/fdsoc1//5Iv3iLw
TLSH
T13162C716A6385977CCDBD21DFA557F53D6F81572E2940E08AAFC8B0C00E6ADD221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 fc52b4e11e09d8fd2a29cd8a97f3877c369033938512a160efffb8a4d55825ca
MD5 7b7547381670d6609c8201a134146fec
SHA1 93534f0a5c29c31c36080a9670c6e33a46bb685b
SHA512 6363c167f69db6ce7c72da2278157e3ca51b518caac92a430e21759f2d9bd6b50de33579dea62f560e5c0a556afa4bcba3d067a1843885087c5870910f6c2279
SSDEEP 192:sxRoRJyM/jK1Ml8wFi/fdsO3Iy6zoA8p4o/g6+WNIYPPU4GbizIgIJ:sxRoxbi/fdsO315/5IL3iLs
TLSH
T10C52C81666385937CCDBD20DFA557F53D6F91572F2940E08AAFC8A0C00E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 831907e867871c94fab7f4c214b81ccbd2ad69b1affbbbfdfcd02f9ce3ca0842
MD5 ab1faa5294f9f00f3de47459ac40161c
SHA1 245ca4178da94f8e9ad4f448488f79bb07e75c70
SHA512 9a9de764c0b7ab93700ec12ee31b0797bfe600c123e28bedcbec7ccbf786099f1cffe25818796abb80995030ab5e712157f352e05b4f162429079b865161091e
SSDEEP 192:sxRrt0yMqZjK1wl8UQKDi/fdsUHcIy6zoA8peo/g6+WNIYPdU4GbizIgDgJ:sxRr9qci/fdsoc1//5Iv3iLw
TLSH
T17D62D7166A385977CCDBD21DFA457F53D6F81562E2941E08AAFCCB0C00E6ADD221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 cf286b9057afd2fe79bc5bd37099c5faa18d9725fa3c44751a543e7e72269df6
MD5 a35aa1535814b1e6dc1ec15a6450b29f
SHA1 4c0a9240b2a987d232224900fd80aafdf4dc8a94
SHA512 170d2c21ea52067e8bb301a027f70b1d00432914dbe68f5be870cd60820087b30ec4d31ace642ee95d248a18cbe836c47819039898799279c3527853ccc05c31
SSDEEP 768:LKKg6xWgdVf7k8F1+UoAYDCx9Tuqh0VfUC9xbog/OVJ3nYfrouevdWG1zm6:LKKg6xWgdVf7ku1jaY3YMuevdWG1m6
TLSH
T186C2FB2B240CCB7E4F844E9DAD2ABE976DD801CB97584D9447EA880C03D77EB521A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\282bd428-4e5c-4c05-b718-2afb1fd38274\index-dir\the-real-index
Size 552B
SHA256 61fb9906d3490e34caac8153ac60d5b1d1f74180a6b07c2c5e88b67b01d02d1b
MD5 82365a954c7f0cc90a0742c7cbfa7bd7
SHA1 028c2de90102e387f339b06a9d172e202bb8d65a
SHA512 ab02f52d8fd8adecf822a5b96a2b661b11a73b37f8c2344ce11981073915813e51f828bc402dde26823f878934d14e510eaa2c063b9baf56df16eee684ead6bb
TLSH
T143F02B76BDE02686CA61187C65B0740C23374AFC5A185847A09CB4FCCD67B792A516D1
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5de0cd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\282bd428-4e5c-4c05-b718-2afb1fd38274\index-dir\the-real-index~RFe5de0cd.TMP
Size 552B
SHA256 2f8e2ed13dfd58e091feec2da3e65513090539d7a72f241a4fc875a880463345
MD5 b07e8ee5f33d1e8d509cbef85aab7493
SHA1 01f94e98a0c89a4ae1aaf98a3f8c9c2cb2b7457f
SHA512 51e1a683a05c438e21967270b5a0e3355263d9ca87a0c147d9b5adbc38679aa22df505627a6f6ac5f45bd159a312bceef87ec78812dc43e4b3d1c9076521cb0a
TLSH
T1C5F061F1A6E12FD6CD1115F86590D00C337B8D206D088E1BA0C0A27CDD9777426512D5
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 e4c449c09e7ddf06266e25c841dcb206562ffb100bd0da124f5b9b59b441adf8
MD5 83909da50deba4717c5d93598d866e82
SHA1 d69075b4fd913dedada071f2979d4e5be10e7f86
SHA512 fe2cb950c871928ffd4aa44fcce41621be1c065e7f3b0b2b12a371e3048c8d87812abaa9bc9dd4d025f148431baeb330f52383cfc98202fc10542088d232439c
TLSH
T11DE068B63DE23528FD6FC7E114724CA401407898A108ECAF102AA6C384B23282886C22
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\af755c0a-c4dd-44e4-af26-8778060b5cc7\index-dir\the-real-index
Size 72B
SHA256 076fb66e9951678ba86268547bc9c2052a9ab2a128cc933a40c62e3e01fb78a2
MD5 bece7a8c54fe59722dde3ed5d2677dca
SHA1 df893603a40bdde56401a7ba851d3e781bc83162
SHA512 284e42142d9e29abe5924b5e5fe712ef4b3625a7a93a43b03da4c7379fed5462e1eaf960bc731b665365ea24d1ff782b0b42cae33dec461f532c8158db16015a
TLSH
T15CA00260CD58E954C0408570DAA341D776105CA9D3616256419D24948C985644582604
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5c55c8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\af755c0a-c4dd-44e4-af26-8778060b5cc7\index-dir\the-real-index~RFe5c55c8.TMP
Size 48B
SHA256 b1eb986fa21c5d098a0574c044f908e90d23f82bac8629e2f54c8136d9240d18
MD5 132dee477cfa8de08f921267ad34ac81
SHA1 64da397e1fc7af49ac8c0db6b44458a276928422
SHA512 385b8a23425857eb584a31b3d89e6cf0b9d67c9a978a177b9ae79c26edad3f93045a20ad62fe1fff603a6e0c72b21be415fbec77aa56716617543e0fa54f3ead
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 379B
SHA256 e4cddc3dfee6cdd50280a086b78970c73a9503d87fd61405f49dff18ea83cac3
MD5 c79e6c55d775cb1cd135601a65b24f8c
SHA1 8abc85f1ab5ee0d00261c866cdba90fd7eab31e7
SHA512 b206f2ef69b318068a96f952143aee9650755958a60d8a702068d309a1f425af9eda6ce7734cd0c0d6914e790f3d723a47bbad8d13950ed31d8d1c0c49a597a6
TLSH
T145E06891B8C6C01B3B77BEC96821D024DFACF5C64E60ED4C8802050614A7F4B4D13E60
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 385B
SHA256 909e8c2892deeca599e881eca9c8ce61b509a108110bd6cf923c4b97daf3be24
MD5 4412210c4dcd074771f8959ba7c2149d
SHA1 bb356c30e02e823f873f5599b7678e1ae3568f28
SHA512 40c24011c1449758da131bfe00773fbf0fb2ad7e03a7453d094355015d3ab3268eb2ec52a1dd1d767bad1cf6296d21353d3e6d45fcd4acb4ea3fe507ebcc6126
TLSH
T1E9E0D892B8D6C12B7773AEC96821D024DFADF9C64E60ED4CC80225165876F9B4E13E60
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 378B
SHA256 1475b589e638dfec90f5e10154d9278cadf5c8da981ece4b0f18890803bbd52d
MD5 6e19c9f5a9424a976743f27ae3a94d26
SHA1 1f4c9b249a54d49491b17467debd66b867c457e3
SHA512 a94f96d91193027ffe7f95cc11c1336bf16be72ecdf7cbc5992bdf4a46042e02a45f6b12dd6bc92a9156e8cdfc22da3e268393d1e8d7a5d2416ba0e940e2d31d
TLSH
T17AE0D891B8D6C11B7777BEC96821D024DFADF5C64E60ED4C980205165867F5B4D13E60
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5c0372.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt~RFe5c0372.TMP
Size 244B
SHA256 9efffbd5c484ba97305dd0c4fc0811522bf2c9edca6bbb18090ae8166c7d62fb
MD5 24da14c4bbb9429bd0751d274b6c3b16
SHA1 114727636f2042cb9eda37850ffdd534d8f24fe1
SHA512 f655d0b5739f962cd5559c890e4693ae3a2d0e03842d4e257521c322512b10d690aefd8f6673b38a7bb45d082c3ed2964c9808d8492515f7135dd277eefa207f
TLSH
T139D097203882C00B3B73BAC46400D024D7AEEAC38C10FD8C840322145873A9F4102F20
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a3932.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a3932.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 5faedb0cfa3d7cbc7f3d35830c84b0a7a9729cd5a3e249452f0db5d67292c619
MD5 4f5e90bcf01d1188a9236f5d24aa20e3
SHA1 7e769441cfc47e36951b988843b96f3951966dd6
SHA512 80102d79e5a5c980da5fb8b93c99d119b31e1612063a71d04c08b20f158f75681cb073f9c6d069c08bba17b72a602a44a9bdf5fb19f09279505aee24830f99f1
SSDEEP 768:MqjaeqD4MlshiLdMmm3TPncO+5tJdkQ75riXYUsZUgb9eHcdzn12bf2DTl:MqqcjhIdMx3GiIUsZUgb9swByI
TLSH
T1A113C079DDB89C674CF3A6C5B25672476FB500A386C9299C9DCC5B0D06E32DE420FC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 863ec684f42992beedc6a653beede32e7e808adf2fb0e11f9f039ac5ac89c3ff
MD5 19f7988fed438c5b1605ae4c71dd6d76
SHA1 3d5232496399813fe929709b7dae6d396bc7cddd
SHA512 d7dc75798695b85874902b44b584c7f8db983beef04e09a1f94c57e1fbe4e39f3a147ba9d215849bce8c6c2ea0d3dbf66918fc7699e3ef4baf7d2808c27378a6
SSDEEP 768:UvF1j+9135wghPncO+5tJdkK75riXYUsZUgb9eHcdzn12bf2U:UG913GiIUsZUgb9swBy5
TLSH
T14603BF769DA8CD6B9CE39BC9F22A32076FF50163C5C56998AACC9A0D01D32DD430FD25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 44KB
SHA256 ba20da9b93a5fce819930db5fa82f580cf2bd3464fd068aaf05f4e59ebaaad68
MD5 af2c7957420496e08316d0493f3ce19c
SHA1 c68bf597dcbc8fa4776fb165ff3a6d6781c5aebd
SHA512 c9c12bfc55d2bb29ed60cdb518309ffc16ac23ee0ed32b9cf345fa3a7682400e8b9c8644d1ca423e3138580fefad9053ba224b9d8924152025d996445014e43b
SSDEEP 768:UvF6jaeqD4MlshiLdMmP3Xwg7PncO+5tJdko75riXYUsZUgb9eHcdzn12bf2DTl:U8qcjhIdMA3QiIUsZUgb9swByI
TLSH
T17913B07A9DA8CC6B9CB39BC5F25A72476FF500A3C5C56998AACC5A0D01E31DE030FC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 88d466de7c9361641790f7609060104f52c5034d20ff02685201d2e76466abbe
MD5 c90ddf0b8d4d22d970059918c6996e33
SHA1 767d1be8ca1d4c58cb40385d227ec6f899dafa2c
SHA512 314cbad420492cc775b3620dddc5af6b211484c8aef6b75e12fdd6b3e1910f891f07fe5bfc5181a7c30c88d31f6fb8467fc85c8f98f6b205281a51b9afc58b61
SSDEEP 768:ZkjaeqD4MlshiLdMmJ3TUIcO+5tr75riXYUsZUgb9eHUq+ApXTcHT+:ZkqcjhIdMG3TYiIUsZUgb9sD+KXP
TLSH
T14303C07999B49C678CF2D6C5B36766472FB5019386C52ACC9DCC6B0D02E35CE530782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

eb9ab12b-98f0-417c-90de-7b9f0f63614b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\eb9ab12b-98f0-417c-90de-7b9f0f63614b.tmp
Size 41KB
SHA256 d42f9f99c429986673b85eb0d510fad6a0ecab6c82621e087e34e2ca7fc41845
MD5 1d83803680e07708fcdbf1fe6012bb07
SHA1 49bab7669995faed6e95f258471571ac4a94aefc
SHA512 ab0f099ce11abba7659e853fc565e79739789cc595abe7d9c9a086093c192e49608ab5ae78cfef11bb43f736b4efb054cbda88b548e4a33661cfa9e77b8c0a70
SSDEEP 768:LqjaeqD4MlshiLdMmm3uOncO+5tJdkL75riXYUsZUgb9eHcdzn12bf2DTl:LqqcjhIdMx3piIUsZUgb9swByI
TLSH
T13B13D079DDB89C674CF3A6C5B25662476FB500A3C6C92A9C9DCC5B0D06E32DE420FC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9220f2c4-1f5d-4ce6-b409-8f3b634c56ea.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\9220f2c4-1f5d-4ce6-b409-8f3b634c56ea.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download