d311a4f486e2f81d1ffb11b37782d8bc1325b1df96ff21ab3b3de818ae3d5d84

Analysis

user interaction
yes
max time kernel
899s
max time network
738s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/06/2026, 12:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b6e3ui.html
Size 11KB
Sample260627-pgfszaaw71
SHA256 d311a4f486e2f81d1ffb11b37782d8bc1325b1df96ff21ab3b3de818ae3d5d84
MD5 c229b9d23420402bdea979bae2d31dde
SHA1 cf5cb6cd0c16a3cd252c792a13907df48fa2f0d4
SHA512 bdabdc88c2c5f8c1b6e4730801ad263d8f0172f9cbc19d80de98acaec7d06218f830366b5c10a63cf589de17ed23dd3b84542ab2183f93fe383f9fa3bd6f6fb8
SSDEEP 192:zMilLhIJhKYX5kerCNRupjQ4vYJkTcOHsU:zNOJhda4s4vYJk4OF
TLSH
T1BF32764A1EF280E701E785A97DF2FD0DAD85864BD219FC4832BC80A90FD7D468DC7995
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5912	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134270362973735451"	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2289519114-2956110270-1748446682-1000\{D959F6A6-7BF9-4CB4-8BB2-6CF44582ACFC}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
772	msedge.exe
772	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe
5100	msedge.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 5100 wrote to memory of 5252	5100	msedge.exe	89
PID 5100 wrote to memory of 3780	5100	msedge.exe	90
PID 5100 wrote to memory of 5912	5100	msedge.exe	91
PID 5100 wrote to memory of 3780	5100	msedge.exe	90
PID 5100 wrote to memory of 3780	5100	msedge.exe	90
PID 5100 wrote to memory of 5124	5100	msedge.exe	92
PID 5100 wrote to memory of 5124	5100	msedge.exe	92
PID 5100 wrote to memory of 5248	5100	msedge.exe	93
PID 5100 wrote to memory of 2604	5100	msedge.exe	94
PID 5100 wrote to memory of 5248	5100	msedge.exe	93
PID 5100 wrote to memory of 5248	5100	msedge.exe	93
PID 5100 wrote to memory of 2604	5100	msedge.exe	94
PID 5100 wrote to memory of 2604	5100	msedge.exe	94
PID 5100 wrote to memory of 6004	5100	msedge.exe	96
PID 5100 wrote to memory of 5820	5100	msedge.exe	97
PID 5100 wrote to memory of 6004	5100	msedge.exe	96
PID 5100 wrote to memory of 6004	5100	msedge.exe	96
PID 5100 wrote to memory of 5820	5100	msedge.exe	97
PID 5100 wrote to memory of 5820	5100	msedge.exe	97
PID 5100 wrote to memory of 2252	5100	msedge.exe	99
PID 5100 wrote to memory of 2252	5100	msedge.exe	99
PID 5100 wrote to memory of 3448	5100	msedge.exe	100
PID 5100 wrote to memory of 3448	5100	msedge.exe	100
PID 5100 wrote to memory of 3144	5100	msedge.exe	102
PID 5100 wrote to memory of 468	5100	msedge.exe	106
PID 5100 wrote to memory of 5716	5100	msedge.exe	107
PID 5100 wrote to memory of 3948	5100	msedge.exe	108
PID 5100 wrote to memory of 4836	5100	msedge.exe	109
PID 5100 wrote to memory of 4836	5100	msedge.exe	109
PID 5100 wrote to memory of 772	5100	msedge.exe	111
PID 5100 wrote to memory of 3320	5100	msedge.exe	112
PID 5100 wrote to memory of 3320	5100	msedge.exe	112
PID 5100 wrote to memory of 5440	5100	msedge.exe	113
PID 5100 wrote to memory of 5440	5100	msedge.exe	113
PID 5100 wrote to memory of 5324	5100	msedge.exe	114
PID 5100 wrote to memory of 5324	5100	msedge.exe	114
PID 5100 wrote to memory of 1872	5100	msedge.exe	115
PID 5100 wrote to memory of 1872	5100	msedge.exe	115
PID 5100 wrote to memory of 3936	5100	msedge.exe	122
PID 5100 wrote to memory of 3936	5100	msedge.exe	122

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\b6e3ui.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x274,0x7ff838c3c188,0x7ff838c3c194,0x7ff838c3c1a0
  2⤵
  PID:5252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1688,i,2628747827959961906,11223457132777012704,262144 --field-trial-handle=2272,i,9985283844420520227,1424702718268587287,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:2
  2⤵
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,1127489715851561471,9728791951668683741,524288 --field-trial-handle=2272,i,9985283844420520227,1424702718268587287,262144 --variations-seed-version --mojo-platform-channel-handle=2504 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2556,i,5491961280395865300,3302830412928319130,524288 --field-trial-handle=2272,i,9985283844420520227,1424702718268587287,262144 --variations-seed-version --mojo-platform-channel-handle=3356 /prefetch:13
  2⤵
  PID:5124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3584,i,7037861978108329771,6001815726449735905,2097152 --field-trial-handle=2272,i,9985283844420520227,1424702718268587287,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
  2⤵
  PID:5248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3608,i,6936377170928447411,14365018820905594731,2097152 --field-trial-handle=2272,i,9985283844420520227,1424702718268587287,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:1
  2⤵
  PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4236,i,8562827407393630193,12473058688796305186,2097152 --field-trial-handle=2272,i,9985283844420520227,1424702718268587287,262144 --variations-seed-version --mojo-platform-channel-handle=4676 /prefetch:1
  2⤵
  PID:6004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4304,i,13530556380356448323,1676225845777227810,2097152 --field-trial-handle=2272,i,9985283844420520227,1424702718268587287,262144 --variations-seed-version --mojo-platform-channel-handle=4680 /prefetch:9
  2⤵
  PID:5820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3772,i,11000769651989408377,14463668267298738406,524288 --field-trial-handle=2272,i,9985283844420520227,1424702718268587287,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:14
  2⤵
  PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3776,i,12841089182664070574,14878327610426648526,524288 --field-trial-handle=2272,i,9985283844420520227,1424702718268587287,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:14
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,1856351557708990601,14492313529567362195,524288 --field-trial-handle=2272,i,9985283844420520227,1424702718268587287,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:14
  2⤵
  PID:5720
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6120,i,1856351557708990601,14492313529567362195,524288 --field-trial-handle=2272,i,9985283844420520227,1424702718268587287,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:14
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4740,i,17866042859770493476,14496163166494671294,524288 --field-trial-handle=2272,i,9985283844420520227,1424702718268587287,262144 --variations-seed-version --mojo-platform-channel-handle=4732 /prefetch:14
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4284,i,5565523515776431297,10908778388799520612,524288 --field-trial-handle=2272,i,9985283844420520227,1424702718268587287,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:14
  2⤵
  PID:5716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4668,i,17197900773767917037,4644101814140618810,524288 --field-trial-handle=2272,i,9985283844420520227,1424702718268587287,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:14
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4304,i,2761445193319889538,9244453523327622624,524288 --field-trial-handle=2272,i,9985283844420520227,1424702718268587287,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:14
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5464,i,17001826390885666609,5405615381753304271,262144 --field-trial-handle=2272,i,9985283844420520227,1424702718268587287,262144 --variations-seed-version --mojo-platform-channel-handle=6048 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3224,i,18046435449144403377,16354859502073923032,524288 --field-trial-handle=2272,i,9985283844420520227,1424702718268587287,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:14
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5528,i,14793968991572391194,4037641816433824796,524288 --field-trial-handle=2272,i,9985283844420520227,1424702718268587287,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:14
  2⤵
  PID:5440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2140,i,15302815003961701006,4626840362289262944,524288 --field-trial-handle=2272,i,9985283844420520227,1424702718268587287,262144 --variations-seed-version --mojo-platform-channel-handle=6896 /prefetch:14
  2⤵
  PID:5324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3684,i,6593651758601373570,17150322924784237140,524288 --field-trial-handle=2272,i,9985283844420520227,1424702718268587287,262144 --variations-seed-version --mojo-platform-channel-handle=3748 /prefetch:14
  2⤵
  PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6016,i,10828019508028601292,9892237349281721606,524288 --field-trial-handle=2272,i,9985283844420520227,1424702718268587287,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:14
  2⤵
  PID:3936

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2580

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4796

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5908

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:3976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2b471d5790d1e8ac94438a5662d0ed854761db5162e9ed715d3f950974387da2
MD5 f3139b9e55fe18feb36cb00db002d273
SHA1 755162342b8e0f46c67a7ca7edf74a3293cdaeb7
SHA512 d229aade54d55576064d540cb4f4250cd3d32106eb04bcac5449501aba91bfbfe3857ca0457eab714fad16945c3e3a00e1b408afe8edd04cdf8574cf34450a48
TLSH
T17CD0C02437457610C40D05704410CE02C133C803B0C3DA003032C50CC5158C0FBCD0EB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b842906cea16d7b3aa3205573cacb7d4d1d2364d11253f46244aaa1a7745db30
MD5 aff0d41e14c14a0f33ef71eb300b3517
SHA1 1b323ae2f9d64108caaa43e8fc26a953c57942d4
SHA512 7d91f5d419c8dab3b5c13b763160d5c782dae9d50314591afda7d0f4db293ab075d234d6ab8602002e921be583a3c7b2c7977545c7522af94ab7cfae1e8bd620
TLSH
T1FAD0C02037457510C40D05704410CE02C133C80370C3DA003032C50CC5158C0FBCC0D7
MD5 SHA1 SHA512 TLSH

Submit Download

51dfb7e9-ed55-41df-a7cb-f580e7a2ff39.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\51dfb7e9-ed55-41df-a7cb-f580e7a2ff39.tmp
Size 13KB
SHA256 e341328c0982130f811c76d4f11de663f22ba2a6482d71d57c2f088db0469507
MD5 4775769759af0a261f46370a1fed7686
SHA1 138370d7e9c623d0fb2726722e6f429223bca582
SHA512 d3fe09ed5b9a1b4eea8b309ea2a712b593cdd5840883e3a827c884c59c26b3a3624fda94747bcd2b7bdfab07e11d9c640fb49794cfedddb618cdad21981a0fb4
SSDEEP 192:sxRT/yM/jK1Ml8wFY/fEsSML9+aDVB9p39zoA8p4y/g6+WNIYJOFGwJIgIJ:sxRT5bY/fEsSC9+aBB9p3wb/5IX1s
TLSH
T15952EB1696385977CCDFD209FA55BF53D6F81573A2901E44AAFC8A1C00E7AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 27f1587753e8589cb4e6eca47c3197b1e9e51a9e3b48cfa4e06082d2fc76defa
MD5 1a4d0414f7e769cd4f9382eee275d5e3
SHA1 464c32910d060a8362e62b508931124644ffb263
SHA512 74f6259006fcdf717c910400009d9ad1aa4332707c4236e0ea3eb93cc7931e4910d8363ffed128696632e0e9a96bed16f1c3dae91f5fa0b12c82b2024a4ab96e
TLSH
T156E0269445CCF36EAA60A49B41BC638DD2C1B68E97C8BA1E5B0488887383684A7C3690
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 d45e661bc83f89d616064bff175a0ebe87cdb43186c1edfc81a2f87b6b5a63a7
MD5 a12f3f355f59f5aefe3dc1c3cb6c274e
SHA1 983244b9886622b755b59ecf773d9e62a2a11f3e
SHA512 e1faa972c8e763441680197fff2bd440aed18500d3252c8615873520dd56915ee875cc1491b6b183e6d707ffdf973f25a17c708c0744f2d19fc6a782cb5e3c33
TLSH
T1A0E020CF82E0F3E90904D447804CF757C912F00FD54F86DD3A05729939C1340A179894
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 274B
SHA256 153b0cdd5638a2793932ffdb5d820b38f6a3a2d83c1c9fac97d7949aa54ae9d3
MD5 1a265cd888d9d6ac5be4a2153dcd00a8
SHA1 58ee6dc768e9a385af9cf4410d6ee6ea38f3154b
SHA512 523b87517b1139c7b6e2f4ddfbaffed83926e8e819d71da5d3760e58e483778eb7c5c86d8b99ee448f760c95bc1ad523cee7b05fa4902cca915c94552025dd60
TLSH
T196D02BE8B5CC684FD3E41AFDAB62B0400F5057D24426DF030220F8C236659F01F67034
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 7275943d745e3e10a21f519900e66077db1078d4102cbfb8bb8779fcb78676cf
MD5 65e31cd945f3dfc90432e94c122997ec
SHA1 61746407a9fff29905a7798fdeeaa860342058d7
SHA512 a596876274a07399f18aef9b4b0976f8970751664c4e269f47021553dff4a4e4b300dd39c9adc673ab6b6b761cf8e953561a6e2026d3074f7f705e44935b9819
TLSH
T1865139284262102ACB25CDB930D1A7C933745C467E47EFCA874C023BBE12BA8D2F24E5
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58cb4a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58cb4a.TMP
Size 3KB
SHA256 247bfeef64b98c49565c0392b404c6876abb50e2749e94d76ca7ffeb50410ed2
MD5 f4710ee9e578daaa24089a31245af8f8
SHA1 7e0bbb3cc54b5940054d9a395934d281c956ae7d
SHA512 bea56e76af5961227c662080ad7eccbe6adea6a8db316e5151a65f87f302c9ed9161bb69d2471e613265cd5117cdb78705cb602da76856d42ee1d5984addb197
TLSH
T1C6514B184261102ACB25CDB970D0A7C833745C4A7E47DFCA874C023BBE12B68C6F14F5
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 fbe80a1e0f06ae0a7e0bebb06dd4dbde0a2f634f98716a6b36f642f99a780c36
MD5 8439beba724cdfe153bc0c0e87e6bf71
SHA1 f1cf76dc38bc39525b2c974213cef904ae462b1e
SHA512 68545e617d82998467ad9b9b0aa96b2176e6053e78b1d64ef01172f5c3e07369f28132e0f04530888a45315b0bb2251e5b5e00fb0756416f9a8d67f716873ff9
TLSH
T1F141ABF3C7E8867DDA1145F4BA183E2FCE290914436C3D5AC9E4AF1B93E2461E14199E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 8ee90ae86059cb03c01095b90c9fd2eb08a04144ddcb70b754e598bd5813a299
MD5 c5b1391dff7c0b10ac2fcb042b97ec19
SHA1 fcf870b57628981cae3a0da53f543e047a1ed054
SHA512 fd396648025cbbb4f9fa059f7622e475ab3a1752a0612144cfbf9fe1218c4dd498b17c6f88a0e056e910d280f032e3ae7375e542ffab07479e720123cb643ff3
TLSH
T1C731BDF3C2E8857D9A0185F4BB183E6BCE690814532C3D5BC9E49E1F93E2860E14094E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 219a98caf4d6f8b33bc9738320a7c0899f7c8ce70e36cdb4faecb9afd703394c
MD5 432eb956b183515cc470f92016670205
SHA1 d729d2fbf93ff262d142e99f1e9fbe05b78ca306
SHA512 22b5cb937ac63f5bcf0d36ea81cdafe8ba0ce7e2ce23af12fda635a627360956cc89305444cfed05ac4c2cd25e819a58e383bede3447e82c7889b0e7e2e590bf
TLSH
T13031ABF3C3E8857D9A0185F4BB182E6BCE690915432C3D5BC9E4AE1B93E2861E14094E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 fd7034568f90fcd2a9ce4251e0f93b4667d2912e0d7c27686b86d359f4133816
MD5 4cf2c0a8e658c45b0b32fbd41a8f0393
SHA1 172bcb90a6eabf1dc2ac5741e4c850be02dd4e35
SHA512 391feeb77b7258d5166575e8953b50f65345e54841ddbadd7a006b06685b74059d97217da94488d2609d9822f7fc76b0560030980865428564c6e9670f66dcae
SSDEEP 192:sxRM/yM/jK1Ml8UQTFY/fEsCML9SaDVB9p39zoA8pey/g6+WNIYJSFGwJIgDiJ:sxRM5qJY/fEsCC9SaBB9p3wp/5IF1a
TLSH
T1C162DA1696385A77CCDBD209FA55BF53D6F81573A2901E44AAFC8B0C01E7ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 3e1a01992385e907a6f64d59a3183ba1fe68d744eec2edcff7e32a04620e2d51
MD5 b7e20145db416052ccb1a00ab2def7d1
SHA1 2d6fbbd6c339b70965177edea1a7b71711c73d89
SHA512 aa95c001a86e0a8a64489d9aa3155179a7f9e7dd76bc7ea626584b923c6dce8f56d295744b9e0763322728edc185bbb0278cc697c11c0c23a5a600a4a1bd7e36
SSDEEP 192:sxRM/yMqZjK1Ml8UQTFY/fEsCML9SaDVB9p39zoA8pey/g6+WNIYJSFGwJIgDiJ:sxRMWqJY/fEsCC9SaBB9p3wp/5IF1a
TLSH
T17B62DA1696385977CCDBD209FA95BF53D6F81573A2905E44AAFC8B0C00E7ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 ab8fa6d861edd793a45aded8e1a4b7be7b756dc1cdf0b0cd83fbce074349edff
MD5 95bd03fd69dabf3c03a2b4f9bd24bacb
SHA1 498e9feae5527bd96fb594ed7b49a501da62e80c
SHA512 6f730fddbbaa6a86543946639149ce31af968dc1d41486daaeedd860719d43a4e13ceb59d36950b979b8a3961ce95169551810d602f06c3b68ce80d59770e4a6
SSDEEP 192:sxRM/yM/jK1Ml8wFY/fEsCML9+aDVB9p39zoA8p4y/g6+WNIYJOFGwJIgDAJ:sxRM5bY/fEsCC9+aBB9p3wb/5IX1Q
TLSH
T19C52EB1696385977CCDFD209FA55BF53D6F81573A2901E44AAFC9A0C00E7AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 fe4cf42e46101d67e9886e96a1c35935fc2bb4be0f587d7a5b5edbd9ae368779
MD5 37811e04dd353ae649ab9eca10cf32ac
SHA1 7e3547b67951bda56f49a588c35e682c5efe7764
SHA512 f7989eadedfa7fd4cea6267e307ac8c75818b3beb22cecac5fb79e612992c9f866bd33030228992fdecae75d7e9246d23b41c31047454aae61551595731ab978
SSDEEP 768:v1D847WgeEftq8F1+UoAYDCx9Tuqh0VfUC9xbog/OVpDZhbrol2ZF1:v1D847WgeEftqu1ja0NhoU
TLSH
T18DC20B2B640CCB7E4F844AADAC29AED66DD801CB97984D5447EE880C03CA7FB511A5DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2f548dc5-e50d-457c-a220-a2bac5d60c20\index-dir\the-real-index
Size 360B
SHA256 9f60160bf8c2cbc3ac31d863cb719c4240194ec52fe188dfd9d77bdc9fc7e8ef
MD5 286891146fee98f05a8fd739f187091e
SHA1 59ca7d0b9da7cc6f352d7bb7e4382ae440fa21da
SHA512 0f3c4f5eac6610271bbeb8a11404684e3c892c3619a88704c243af835b97476e8b8a43cdba405940389bb6aae7762bd38e2fd3363d9729aecf485f83ce24bb3f
TLSH
T120E02B92FE802699DA1118701CF2641C237395FD56245942709C60AC8E76379261930C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d0988.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2f548dc5-e50d-457c-a220-a2bac5d60c20\index-dir\the-real-index~RFe5d0988.TMP
Size 360B
SHA256 0c51ed02d6ee2591449c6406505e67f86d2d29d756c4a2bbfe44b7ac96743384
MD5 5e477e8a9977464a837d469b5f1e21e4
SHA1 db14fcbead38341c930fddfc7cb82c9a0fbd47d1
SHA512 01408eaf4dcb526431925e49cc3122f4b7697961da6f20487be25366b0ee1c6b3e2094726ac7563c7427e34673f23fd5cab9e6a3cc4c924c62640212a92ae037
TLSH
T17BE095D1EBC02FEDCE1156719C92542D3373C92415348E1220D0E06C8DF333C2A54258
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 114177b633fe7ac2b7ac2ae19eb25714d97bdf7593d3d676ce0799bd63a5c7ed
MD5 56d8ca3b37cd2d60807a5ada6e06d7cc
SHA1 0d4dc46a62ce4a297fbd9d1540cc0c5d056cb1c0
SHA512 7a6237471474cac3e68ecdc2ab1504f693e63969f9bd15654060f6da3cc4c1d9348ad7f115611f88fbac1ee2798d331b5fb4ee63a4d8b5e02a77b60aad264a3f
TLSH
T193E068BA39F71420EC2B83C61430D4A04101BE28C944BE4E145995C720A1301641ECB2
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 316167b7c4f4c82bb704d4786427e907cc1649fbb84f4dc5678a05c73bbe6eb2
MD5 9d9ecbf0234c8078e6d2c31f2d407287
SHA1 055da21207209b4311abe382ff0cfcb2d4a29885
SHA512 c074574f3a76662c17f90f53d4fb3dae640f2ded99c0806ef15f632f3e36a51f9b600578b23f4f6973c60c321c07f079b44707a2b3af32bb0d528421d29ed617
SSDEEP 768:Cj+9D3f6Ue5G2z4ZVCgZSVCKPFECrBhpjcNmzn12bfT:x9D3Sc8gs0KPF1HRcIByT
TLSH
T12EF2BF31A8A85E234DF7C698B507724ABEF44793D3C92A4894DC6B4D85CB39D1317C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 5fee058556a73e01f79793a8e85589a4ad44aaad28b3a38827cce74863c78173
MD5 41430f4cf7accc58e168c8fde1d68fd7
SHA1 81218d91e571093e56b203d870511c7682823137
SHA512 812096a7883f0b652d225aa7b1642b9be842edacaa3512a606ac4eae1c1a1256663095a9d19ba57ee894f0b63be91f493a5e1297f3a547c981dce16d465e64ee
SSDEEP 768:tj+9D3Y6We5G2z4ZVCgZSVCKPFECrBhpjcNmzn12bfT:I9D37+8gs0KPF1HRcIByT
TLSH
T143F2BF31A8A85E234DF7C698B507724ABEF44793D3C92A4894DC6B4D86CB39D1317C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 38512bad6862092ce1bef37ac7bccb2bf42568218f8812d61402093f90abbb91
MD5 f48bd39d1a10013a2a2ef0846b035947
SHA1 b77a7e9aab63cfd719a0d64db394e52987d69cdf
SHA512 de6cd0ea3cb2c30ea21db602be9a022780cc8ce6701d9c79e683ad5aad33bc9b2857c45076fca96f5e353610da22b7d8cca9b231cace0ea975a0e2049e453a9c
SSDEEP 768:Zj+9H3Y6We5G2z4RVCgZSVCKPFECrBhpjcNmzn12bfT:E9H3748gs0KPF1HRcIByT
TLSH
T124F2BF31A8A85E234DF7C698B517724ABEF44793D3C92A4894EC6B0D86CB39D1317C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 4e39dc1f27fcea918915dd2b2388e8a91bf06f4584136e8a7efde3ab1e857136
MD5 2f27b2df146874d58800bb352a4608b2
SHA1 9a3713609c225d59fa19d09db69b08ece865bdb7
SHA512 70aa7276d5faf9da191a0782f460dcfd789b8b55fc7206199c5d987b99361906465c4a63c137e17634cd55c27383b552ae17a950fa7407a4c8e85781d01cd92e
SSDEEP 768:bjaeqD4MlshiLdMmu3Cf5G2z/VCgZSVCKPFECrBhpjcxF+ApX32TB:bqcjhIdMB3k8gs0KPF1HRcn+KXk
TLSH
T1DF03BE79A8A85E738C77D245B207B5466EB84297D3C92B8CD8ED6A0D41D73DD130382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

80b39ea0-3311-4bd6-a6fe-15ea08b8346b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\80b39ea0-3311-4bd6-a6fe-15ea08b8346b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download