25fb23868ebf48348f9e438e00cb9b9d9b3a054f32482a781c762cc4f9cc6393

Analysis

user interaction
yes
max time kernel
72s
max time network
75s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/06/2026, 22:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SMlRxJFO0FQQJssBkIGEZ0VhCKYj8YRsLkC2HR6C.html
Size 548B
Sample260626-2f3mkafs2w
SHA256 25fb23868ebf48348f9e438e00cb9b9d9b3a054f32482a781c762cc4f9cc6393
MD5 4b074b0b59693fa9f94fb71b175fb187
SHA1 0004d4f82b546013424b2e0de084395071eef98b
SHA512 f928e9faa0bc776fc5d8a0326981853709d437b7b1c2e238894bfb2acbb627442c425cbb00d369c52d15876b6c795e67f7580341686696d569a908a6add4b444
TLSH
T1D2F0909B6F19283F2E238571F4C75168CF680A66FF9925E28748011F7ACA04549F2FAD
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4148	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134269867504616583"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{1210786C-807B-4508-B24B-75B1CDA6C55C}	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe
4040	msedge.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 4040 wrote to memory of 4556	4040	msedge.exe	84
PID 4040 wrote to memory of 4148	4040	msedge.exe	87
PID 4040 wrote to memory of 1428	4040	msedge.exe	88
PID 4040 wrote to memory of 4840	4040	msedge.exe	89
PID 4040 wrote to memory of 2456	4040	msedge.exe	90
PID 4040 wrote to memory of 1428	4040	msedge.exe	88
PID 4040 wrote to memory of 1428	4040	msedge.exe	88
PID 4040 wrote to memory of 4680	4040	msedge.exe	91
PID 4040 wrote to memory of 4840	4040	msedge.exe	89
PID 4040 wrote to memory of 4904	4040	msedge.exe	92
PID 4040 wrote to memory of 2456	4040	msedge.exe	90
PID 4040 wrote to memory of 2456	4040	msedge.exe	90
PID 4040 wrote to memory of 4680	4040	msedge.exe	91
PID 4040 wrote to memory of 2532	4040	msedge.exe	93
PID 4040 wrote to memory of 4680	4040	msedge.exe	91
PID 4040 wrote to memory of 4904	4040	msedge.exe	92
PID 4040 wrote to memory of 4904	4040	msedge.exe	92
PID 4040 wrote to memory of 2532	4040	msedge.exe	93
PID 4040 wrote to memory of 2532	4040	msedge.exe	93
PID 4040 wrote to memory of 3152	4040	msedge.exe	96
PID 4040 wrote to memory of 4448	4040	msedge.exe	97
PID 4040 wrote to memory of 3152	4040	msedge.exe	96
PID 4040 wrote to memory of 4448	4040	msedge.exe	97
PID 4040 wrote to memory of 1152	4040	msedge.exe	99
PID 4040 wrote to memory of 1516	4040	msedge.exe	103
PID 4040 wrote to memory of 1516	4040	msedge.exe	103
PID 4040 wrote to memory of 3500	4040	msedge.exe	108
PID 4040 wrote to memory of 3500	4040	msedge.exe	108
PID 4040 wrote to memory of 3500	4040	msedge.exe	108
PID 4040 wrote to memory of 3796	4040	msedge.exe	110
PID 4040 wrote to memory of 3796	4040	msedge.exe	110
PID 4040 wrote to memory of 3796	4040	msedge.exe	110
PID 4040 wrote to memory of 4180	4040	msedge.exe	116
PID 4040 wrote to memory of 740	4040	msedge.exe	117
PID 4040 wrote to memory of 884	4040	msedge.exe	118
PID 4040 wrote to memory of 4480	4040	msedge.exe	120
PID 4040 wrote to memory of 4480	4040	msedge.exe	120
PID 4040 wrote to memory of 4480	4040	msedge.exe	120
PID 4040 wrote to memory of 116	4040	msedge.exe	121
PID 4040 wrote to memory of 116	4040	msedge.exe	121
PID 4040 wrote to memory of 116	4040	msedge.exe	121
PID 4040 wrote to memory of 832	4040	msedge.exe	122
PID 4040 wrote to memory of 832	4040	msedge.exe	122
PID 4040 wrote to memory of 832	4040	msedge.exe	122
PID 4040 wrote to memory of 4936	4040	msedge.exe	123
PID 4040 wrote to memory of 4936	4040	msedge.exe	123

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\SMlRxJFO0FQQJssBkIGEZ0VhCKYj8YRsLkC2HR6C.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b4,0x7ffbc05ac188,0x7ffbc05ac194,0x7ffbc05ac1a0
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1904,i,17487689949266631195,9343758254958881893,524288 --field-trial-handle=3732,i,1386935001696618371,12651429184011051304,262144 --variations-seed-version --mojo-platform-channel-handle=3044 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,9208776239571421586,14591079851897457589,262144 --field-trial-handle=3732,i,1386935001696618371,12651429184011051304,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:2
  2⤵
  PID:1428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2352,i,2677551111453467887,17077745287296599570,524288 --field-trial-handle=3732,i,1386935001696618371,12651429184011051304,262144 --variations-seed-version --mojo-platform-channel-handle=4088 /prefetch:8
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3052,i,14150956809517984523,4836315075928359651,2097152 --field-trial-handle=3732,i,1386935001696618371,12651429184011051304,262144 --variations-seed-version --mojo-platform-channel-handle=4128 /prefetch:1
  2⤵
  PID:2456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3056,i,7138123522214871973,10156354126509089006,2097152 --field-trial-handle=3732,i,1386935001696618371,12651429184011051304,262144 --variations-seed-version --mojo-platform-channel-handle=4132 /prefetch:1
  2⤵
  PID:4680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=3268,i,659813113379258696,8418351652194504148,2097152 --field-trial-handle=3732,i,1386935001696618371,12651429184011051304,262144 --variations-seed-version --mojo-platform-channel-handle=4160 /prefetch:1
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=3288,i,16022205142915139724,8274805870483905060,2097152 --field-trial-handle=3732,i,1386935001696618371,12651429184011051304,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:2
  2⤵
  PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5024,i,16107642108027280745,6183264208077661130,524288 --field-trial-handle=3732,i,1386935001696618371,12651429184011051304,262144 --variations-seed-version --mojo-platform-channel-handle=5096 /prefetch:8
  2⤵
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5036,i,12334709332018703185,7260724587067404499,524288 --field-trial-handle=3732,i,1386935001696618371,12651429184011051304,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:8
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5692,i,8147200993605707109,12752750805152210311,524288 --field-trial-handle=3732,i,1386935001696618371,12651429184011051304,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:8
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5692,i,8147200993605707109,12752750805152210311,524288 --field-trial-handle=3732,i,1386935001696618371,12651429184011051304,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:8
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6220,i,2332581073474035374,511167014748510239,524288 --field-trial-handle=3732,i,1386935001696618371,12651429184011051304,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:8
  2⤵
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4564,i,14796315023885729065,16758078692066265854,2097152 --field-trial-handle=3732,i,1386935001696618371,12651429184011051304,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:1
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4652,i,1138621178932054369,12296088222440707998,2097152 --field-trial-handle=3732,i,1386935001696618371,12651429184011051304,262144 --variations-seed-version --mojo-platform-channel-handle=4624 /prefetch:1
  2⤵
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6600,i,10603163761110313349,12316112542770750784,524288 --field-trial-handle=3732,i,1386935001696618371,12651429184011051304,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:8
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4944,i,15087642720825511639,14322928017539723971,524288 --field-trial-handle=3732,i,1386935001696618371,12651429184011051304,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:8
  2⤵
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6612,i,12769875178513143578,2554080411608925204,524288 --field-trial-handle=3732,i,1386935001696618371,12651429184011051304,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:8
  2⤵
  PID:884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6680,i,9202727785119148243,11872934480943181809,2097152 --field-trial-handle=3732,i,1386935001696618371,12651429184011051304,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:1
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=4560,i,13091498961136894592,4747376486717958990,2097152 --field-trial-handle=3732,i,1386935001696618371,12651429184011051304,262144 --variations-seed-version --mojo-platform-channel-handle=3052 /prefetch:1
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5148,i,12696962714532081684,860404041429362811,2097152 --field-trial-handle=3732,i,1386935001696618371,12651429184011051304,262144 --variations-seed-version --mojo-platform-channel-handle=3100 /prefetch:1
  2⤵
  PID:832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,39988541825416487,16273531114560127667,524288 --field-trial-handle=3732,i,1386935001696618371,12651429184011051304,262144 --variations-seed-version --mojo-platform-channel-handle=2132 /prefetch:8
  2⤵
  PID:4936

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3984

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bf637ca0b28ebd6e948876848ccfe71d201158d460d4ad944f124f9d17ee5472
MD5 827e00d89fccbbde703c679b5c7ff536
SHA1 6d9e235782beb4e6b38fd4db2946f9bfc725110c
SHA512 1d18100db386f25678d8dabb492ab6e15d08e2c5a7d7e6c76bc253df648e2b5438cbc4fcb5a4033a1e14afbda93b271225eb5f545f12663d6bc35ca51239fcc3
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7X:fwUQC5VwBIiElEd2K57P7X
TLSH
T148B3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6d0f88884e23b1418c456620b79662feebdfd970ca9325ba2981c94b3b0f0b2f
MD5 7060eae8ec426d15de2849b1f7d261b4
SHA1 b252d90b9d7050d0b9b7c03141d9d3b7cae404ac
SHA512 8791005fae20dc1dc5dc5b0086efe814e0b1e36781ef1931cc1fc699fc4cb34d62ab3f9a83f4967824f3bb71aef6adc6ad457ab7a6addcba99f9e9b473eabb4d
TLSH
T118D01222BE08A415E65BA271A502C7141F5954A124938651E224D86CD9F84D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4d517b88a0fb88494276c126764235de9ee52961c86cc4d3abaf517b10a649a8
MD5 dde9ea8dd9c7e315ef614ab3476af02c
SHA1 e03e201e89770d15b4040d579c2cce8684959a2c
SHA512 410e016336529d709de957d44e67238e4f6592b9ce6646395a9e45ce592e7810b4cb6b1b6df5d8b26875a6aa235b77d41c0983ccc055556f8b8c02224093fdd1
TLSH
T16DD012227E08A415E65BA271A502C7141F5954A124938651E224D86CC9F94D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000082

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000082
Size 24KB
SHA256 2beefe7293101d64840c308506967e9e2a0b2a6c4500ccbb7871c1342f2894eb
MD5 dfcada20b4cda38d23f6fec8d0260763
SHA1 373ce141ff860592bfc61220e4b5c82480533d19
SHA512 d8b43808a8ad313a54f2418a2d74dcff9f02648519a7637d580e47fea6fa60e8a57c95e3f00643a33accd6479bf0fdba3a858818e38058775b9aa238761536b6
SSDEEP 384:3xbeyInNsrD5LZCzRFwiSmWR4a7tjVwlgtX/UC7duixIaILK7fjzUmcdq7+RCRHr:lRokgcvP7C7m3SBSIjsDkLYd9dL
TLSH
T1A3B2C6985582703CBA3B852167D8AB4C7234DC06DE3228EDF77B662E0FC67D642B3158
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000085

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000085
Size 70KB
SHA256 fb687d71a9090fd9b633c3653a29fd3ff5a0232219faf486fc7bef2442a2b0f8
MD5 457a06fdf8d4e3d90fe5d3f6666ad04c
SHA1 3f0907e5739b107188d38c2547a9bca8ba8c969f
SHA512 1333d720540ee69790ba13c32311775888e8018e5eb8c4af973133a68e10fb934465d98ff007bb79d40f31480bbb57dac100de1d427b6700b4379aeb69980197
SSDEEP 1536:Qdq4rH3xSG4yuk6NTmRH2Ma2mxKie56ckEcHhg8FimgmziZh6YoVLFPjlC/FQra:N4reyB6FmN8KqckEymWG/hFoLPjhra
TLSH
T1806312DC7216EB862B148A27F4E615C96B740947E2C9D9CA0D1D33EE1818E3F7FE2160
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000086

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000086
Size 64KB
SHA256 34013d7f3f0186a612bef84f2984e2767b32c9e1940df54b01d5bd6789f59e92
MD5 d6b36c7d4b06f140f860ddc91a4c659c
SHA1 ccf16571637b8d3e4c9423688c5bd06167bfb9e9
SHA512 2a9dd9352298ec7d1b439033b57ee9a390c373eeb8502f7f36d6826e6dd3e447b8ffd4be4f275d51481ef9a6ac2c2d97ef98f3f9d36a5a971275bf6cee48e487
SSDEEP 1536:Lm4AGqOak9IP5qOYV7SofryJiRB3xVcVXsIBGCrmQR:LITk4qOq2oDwuhpDCaQR
TLSH
T1C55302D5B8E93222BDA947C28B442085CC6F367CF53F3DD8DE31AD2AA5909DC41847C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000087

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000087
Size 19KB
SHA256 af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725
MD5 1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5
SHA1 6dd8803e59949c985d6a9df2f26c833041a5178c
SHA512 b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863
SSDEEP 384:/Und3PKicut4yiFkC9RWzlJpa2/CKYOyDJmCZyXJTW4PO821GyLjSoBwNeS:0UizQDYlJpaQCKYOyDJpI5Kx821DS3Nz
TLSH
T13692E1670BCE314E422EE25FA316A51733E41BE1EFE49640D6AA70D81C38DA243179D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000088

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000088
Size 63KB
SHA256 caecff4179910ce0ff470f9fa9eb4349e8fb717fa1432cf19987450a4e1ef4a5
MD5 226541550a51911c375216f718493f65
SHA1 f6e608468401f9384cabdef45ca19e2afacc84bd
SHA512 2947b309f15e0e321beb9506861883fde8391c6f6140178c7e6ee7750d6418266360c335477cae0b067a6a6d86935ec5f7acdfdacc9edffa8b04ec71be210516
SSDEEP 1536:tLQFdWY1+jAIuhc5s3JBP2ffX195jJqu1H5g60:qFdv+jA/cizOfTdRJ260
TLSH
T10E5302D829DC2DF4466490C19420E379C6FACED8E4485B6F5B2A2E0DF78DD7527C7242
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000089

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000089
Size 38KB
SHA256 4392ddde86f22a921269feaf788a13509946046047df6926017041ff33d0293e
MD5 04bd0131c5ce154413f71d20017679e6
SHA1 a83459180dca62eb56edee213409f83e12fa6172
SHA512 5818141afbbc45553e72fc106699d9357437f1c2751751dab4f51ad7127e92a6ff85fb67905073addfdec5dd581c8c22ffc8dd6b85919d6a1d72550ebda5376c
SSDEEP 768:hrGgBfBZrOcgLWz/irLn2nTXzHXP0JsdgCQL1/UAv73nWEjvvuUwp5:hrGA51OQ2naXzP0Jsdns73WEaz
TLSH
T1170302AD7D526331E7FB684CC972AA1340C424498063CB1FBEFF098E9D44A4FE056A23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 cae565c1c90464dc0e0677eefd215f51c433bba63c2dada2274052a219702b96
MD5 3dc054519d3e13952e3b04c00314fd55
SHA1 9f63ce224c2da19207704559e612fc64db128408
SHA512 61413abf5b7ed1807fa82cf266fa9608d01c45f4019a9a340c63d002b20553d557d510f0ecaa9900c11d6e9d0259de6924e2066657ad83cfffa3bbfb7d2f03fe
SSDEEP 96:fWFll73hyyhi9QNNxh/3O/iqvSHhduAs/FqeV4e1JWdjq3epAN0bywZtSnPCnfHS:eFll73E4i9Q/P3hqKHhduACFfV4e1JWE
TLSH
T195C170344D890061EB240A72D0F70536BBF1A2DFF61B5E47275E567CA50B38B8E9E09B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58da5d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58da5d.TMP
Size 3KB
SHA256 5c56350d01b5c6a9c46ecfe577c1eddd89cf266ae954442e08610e9235e4d137
MD5 8804ff3e0f08fd01bb3604db2a0f2df5
SHA1 60a6d0b6d0ebfafd9f660ede5b7b23494aaeb745
SHA512 1427daff413a2c9375a0bfc750fa3c7e4e88b22ef18991302a87ee6dda1cf67c754d3de017355cfad6f6a28110bf29974f7304fb3afdc3fd5e91a51d47fb56ef
TLSH
T1137127340E0900A1FF200A33D4D50239BC72AAEFF61E2E56235D66B5EA0234A139C55B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 450abaa1ed86f17072041a409770bc8b0931a698459d4f862edb56f641ee5c81
MD5 3650f7afc2dd89421c91dce373107eca
SHA1 a621ab03676fbaabefa8b91deb32662b3a5f8e42
SHA512 d4b598aab2708a802c3e3b3e5634215e2b4615b31d013aa880c990139420c220009dae1aed0020e9663d5768428fadff918dff1c600c3770ab9e7d1b77981f40
TLSH
T15C51CFF7C7D9861DC82152F1AA247E2BCE1D094893183C1EC5E4EF5F93E2471E28468E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 40234eb9e6204deb4b5b8548a26fe0580357379624210a6b9bafb43ad8d0d133
MD5 72202f2e7eb541db711925f20b1049c0
SHA1 7e0ddf063c258f2cf156e5a4bd4ca1691c6923a8
SHA512 768f42141d9e37a73d107de79a31304a832aa538590c6793d5e74de3b6f981a3d008a7be55c5359bb40fbc0429b65f0a4a40603fa1b99332063d08bdee8c0504
TLSH
T17AD022332A04B0B9BA5C7E82907AFC8EC73661240903EDDC20E0789A35365AE861B240
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 85c9655309bef8012d1e03c56f21d7310192d8b4954e0428abcce96649ab02d8
MD5 ecd0fabb18286297a44fbea64f75c0d3
SHA1 c369ed1c9c14a7d43c362c113f34996c2d1da7ee
SHA512 d57b8422c25e41aed7e77fa1ed512d6a06c4a25bef4e7640b61e7590d3afb1519e05f52eda91bdc5de44a3158bcb13b369758a08daa93cedb0b0985a5b1c124f
TLSH
T1B5D023572D0470B59F5C7EC1D176ED4FC33610700903EDDD10E07898253155D460F150
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 ddac7db440aab7e2931897be515646f226e561abb74d261da8354c7684a98a48
MD5 fc4cf156ac91bf8cb0e78ede113f5b09
SHA1 89ad504f8fe2b27b8204bc3b6ed590fe4a7ba473
SHA512 b427392fe1b61fc3f8c740fee7ff6373ed372a8eaa9198ae1be2f1d18a5112a2a7231f0d65e2e1f5b49e223425a5e854ef4cb405bf6e482adad19babc61d7f34
TLSH
T11BD022633E0570B9AA5C7F92D07AFC8FC33620200903EDEC24E0799825325AE460B240
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe588836.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe588836.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 8930393a86cdd89122e04a9638684e3695ce272cf66cedaa2b9f4edb23953f7a
MD5 ab6eae78e0e6a197f0b572d29ffeda25
SHA1 5ed87481e0bb71b45515bacc91f712807767bb1a
SHA512 35960d55ec91c61279e9cb0666c11d8a71014d070a36e03c0d4350542c0b18d21cdba02bef05855b6ab62dd4c5d7305affce96179dd518894f687f9d427e4b1c
SSDEEP 192:sxZSRVyM/jK1Ml8Mk5/fxspf++V7IdpdKHW6+WNGYvrT5SYIgrJ:sxZS/M5/fxspf+hAHbGEb9
TLSH
T15942D7126A349977CCCBD209FA55BF53D6F91562A2940E48ADFCCA0C04E6AED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 3d578607d812ba7f07f715c932726de2122ef75feafd47588bade0979724b3ae
MD5 eecf69d1662fc795f9e02ab2db2e20fe
SHA1 f42216dd463dd2c3f97dc7f2700d5c80193f5ef2
SHA512 b26b663c16619cbe96bdf35483ca535eba9509ba7ba582a2ccc011a0421340276595753dc76cb23ac163fd8bd6ded1fdc3ef8a67fc0ba8f321836254782c6408
SSDEEP 192:sxZSRVyM/jK1Ml8M0cB15/fxsvf+OVDdpTHJZYHW6+WNiwG/YvVT5SYIg5DyEMOv:sxZS/sm15/fxsvf+67YHbQ/EbkRw
TLSH
T10C62D7526624D977CCCAD209B965BF53D6F904639A510E4CADFCDA0C04EAAFD2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 2241b03f9bb56c2ed73570b00c334309724331371953975c09c543437ff15ee0
MD5 acd0db2d8eafe946ab02d54d96428666
SHA1 26b7534d1c4b47c5f5fc16d9ad3cc910d17f83ab
SHA512 377134f4ffc6b49416168bc7d984ae415eaecdc994d044277c50e8d7dbd8c97e820ec7ecb03c5d4bb28d636707cbdc8fd0d58fbedbea9fa59f51d9bbd6426d82
SSDEEP 768:hZseJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0pparoB2:hZseJ3xWvhfynu1jaVcL88pRA
TLSH
T17DD2FB2B280CCB7E4F844E6DEC266F966EE801CB57984D5487FA884C02C77EB51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 01f919181a4833710dd44d0b3d34977397186457e3b2f27669eb4ccf946f1a13
MD5 78c41a31d86ab8428a00bd1a7382cfe9
SHA1 e6c5a378846046888e4dcdc2c5eab92bce67f6ea
SHA512 7a3f3c6dab4e10ad5c5396a5b650b332472b82fbc092209608c796e4acee8540b8590cb1460e7c181676e4bc571812e4e13eae5ec6862ac2bf8b022d9a45d5be
SSDEEP 48:KYHIhKggkXyBAIDK1KcjylDI1KkUILyBeIvKLiww:KYH+KggmiAgK1KyODKKkU2yesKLif
TLSH
T102C1DB22313F02023C7F354CB2AAA6375E4135A33558A8BF7B7810A55E6AE116DFC8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59073a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59073a.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 746df3416d2f5cc659026c42e5a767d9aa6efb734c81f0dd2386596cb7f21dd5
MD5 877dc43f1b0a86a6b8dc8d91394795b2
SHA1 853c2ddcdd72c66a848abe9f18032397cd3a140f
SHA512 730054d5725239545d3e2e5b17b76852e7d2abd6d8bbc7fd96357193ab00e09af07e6e514fa96fbcc25e3abbce25214b45159e104f2da74aeedcf1dd73090fa9
SSDEEP 384:IiF1tNn/s3n9SkzsNG8TUNTUlIlOd7HX5rfsP21dyZdUG8S+:TF1j+9ffwgeJfO4kUG8S+
TLSH
T179B208F258D7883AD99E5B47F73D2E064EBCC067B5816954B7989A0CCC8A2BFC306C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1c99171f9f893fb9a9a4334217378d0d4c34f4da1d5fab2c32fd9fee1c7781ef
MD5 c8c149e51402d522fb8a4fc347929273
SHA1 fed57ce648a54ca2d1094363b122f216dbfd4d15
SHA512 ec8f18bb5287ec985f75283d6cbe50584e7cba190e871ae1059e878edbb2f402d55daae55a0f3356ec56805dd065ddbbb14bb3b5b82b52b12d33ebb923d52b0c
SSDEEP 192:lON06vMtPQmiUyQgThTW0+FdLuc847XbLU/u:lON06UtRkTudy+LLU/u
TLSH
T148020935AC786C6BAAA3AD45F48A37175FE4107BEAD05B50EEE86F1C00C769C1303827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 ae3aac0bb9a6569647c964f30ff3efd42da250e79e5e261317a847ab4adc3331
MD5 39a9ee55e172f3569d7aa273b2107c03
SHA1 9b024573225217f4cd3c8c3d41be8cde7f0749bf
SHA512 f207823ef89ff468de213d4e93ef41f31a9c32c305d2422c938442ce9378ff0f77a6d4dd72ca14994cac01ae887d7aa54ac0bceab7fa1a2609ff4b34bad34198
SSDEEP 384:CtNn/s3n9SfsNG/d7HXbrhsu1dyZdUQ8S+:Cj+9UvjhPkUQ8S+
TLSH
T119625C726C359C3799E2A585F44A370B4EF4906BAAC12E54EAEDAF0C01CE6AC1307D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 98c2ca496c7d8bb1d5f6c0620653224acc45874c2f16137c384f2c905d95e3d4
MD5 2608e98b1636dfd87d2e3da4d4d420d0
SHA1 d59fa61fd3306b27fbb3adef674c9db573448e51
SHA512 9c2e74da81e7c53b05d130538d8aca4ac2b5f8436dfd2c67b00e3b41f3d5a8d9f4580c70b80b7e692cb1276a4fb7a3ec50f3a9ac4c1151a9558d8182858430e6
SSDEEP 192:fONn6vMKPQmiUyDTgXhTW0+FdLuhpFd3EZu80IzrqDU/u:fONn6UKRcMXudyZdUl8U/u
TLSH
T16A122B726C649C6BAE937445F48B32170FB4912BEBC56B50EAEC6F1C01DE6AC1307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 908314c7c0a7f1667a41da13c219d44605ed78dc1cab312c00c8b150554bf203
MD5 e0c09e69e879af236b577e3587699f96
SHA1 128bbf622576f1b64c6ac038e3a69f8541237870
SHA512 f65652d0d1c2af10c10a12b617a6c2cc03441bb34bb79d7496b35396458a947ab8120cdfbe14ad4ed67434ba556fe5f0f014d147f2e0dee74be83f6dc902b5fc
SSDEEP 384:2tNn/s3n9SfsNGOd7HX5risu1dyZdUQ8S+:2j+9UeJiPkUQ8S+
TLSH
T14D625C726C359C379DD2A599F44A370B4EF4906BAAC12E54EAEDAF0C01CE7AC1307D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 f3c31830f57042dffe543bcc03d9eff15940979e19459f3b7420401ca4f1fe50
MD5 cadcb46bef7003bc757a07f16f124bbf
SHA1 f337413aa50cdff11dbc318ef14fc0417910a291
SHA512 87ad4e83c48ef9c5c740ad3b1edd64107797a82f02459f06cc9dfae118cb14072ad656def61ae9ede12d900fbd67b23a55b59e7ddda2f653a7d03469a907446c
TLSH
T18EE00441D300007FC01D073000C3151037F1C11403F301C45514157475137011531F40
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 4c10171033bb22a890f6db5252cf355fb54db6d4d41f7145729eb38877645109
MD5 7651ff7b05c97e336a2c33739ae627b6
SHA1 f044d5a85b48fb7cb869344037067e05748c0cfd
SHA512 f1c215219a044b31d3f467925463020e13c13310cf9f9f1d98791330c3929716317e3dd85d1aaf2bcc8dec636dfbeec26cf7727f2951e78f9bb16700b66e079f
TLSH
T16DE00142D300006FC029073000C31A203AF1912403B302855A14157879137012A21B80
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe589db2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe589db2.TMP
Size 392B
SHA256 4ffee3f97d39e230cff05ea771fd0e608fc500c31e1d2ab33dd843a3af276055
MD5 220efa564f8d6ddea6f1328dfc7a8bfc
SHA1 e85809a984859140a2be2d36e0538cd1ba25c493
SHA512 376d86d5bbf7023eeac7bd51e8199f27d86f6e822d44dde116b274afa4834d4efd22db24abb7b69b72043cd13cdd1cb0f6d2fea1519c90b1cccb98569c4e17f3
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 78d0cf66a67221ef5ad8a358d35f9a2bc3be626c359f781078f3bf7807f44db3
MD5 b2583b780f7b502655bdd7c8db32a503
SHA1 ade21146eaf487f36918a5da54f1765f1a27f000
SHA512 4578bdf3a5f3dcbe485c9d2f2f679984f7e81224d7a4a05613fde7cf93485f7197e6c960ff451fdd53c86b5f8abb7833d3c48d8c3358675e6d936e99541659c6
TLSH
T12D412958B6FD1108B3B3AF5B9BF2B86E447FB9772E06D55E10120E4F0626A40C862737
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads