6b73c0a42d138d1f05b527c7b936e79af9f44a55d52e35f912da15c0dea43d30

Analysis

max time kernel
898s
max time network
736s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/06/2026, 04:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Quasar v1.4.1/3rdPartyLicenses/BouncyCastle_license.html
Size 1KB
Sample260628-etwpvafs2k
SHA256 6b73c0a42d138d1f05b527c7b936e79af9f44a55d52e35f912da15c0dea43d30
MD5 bf8d5a737e70dd3493a475b8672f14df
SHA1 01d35be1b65293f7ca43ee1045424599923ab54a
SHA512 ecc23ef88b80944ed135233118db167bf5dc161b0392af25ae846010f9993673bbdb62f88bf6de24dc060a48a0cfe96be261d30f5dac2705ed0f01d987fe24b8
TLSH
T1A5415278BA632F0305B3D7F4B885649851592205721A9B006BAF92333199129F2F3B8D
MD5 SHA1 SHA512 TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5316	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134270936933541187"	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2289519114-2956110270-1748446682-1000\{6D973F37-9FE0-463F-AE4A-213D6457B445}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2289519114-2956110270-1748446682-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4944	msedge.exe
4944	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe
2112	msedge.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 1040	2112	msedge.exe	89
PID 2112 wrote to memory of 1864	2112	msedge.exe	90
PID 2112 wrote to memory of 5316	2112	msedge.exe	92
PID 2112 wrote to memory of 1864	2112	msedge.exe	90
PID 2112 wrote to memory of 1864	2112	msedge.exe	90
PID 2112 wrote to memory of 5556	2112	msedge.exe	93
PID 2112 wrote to memory of 5556	2112	msedge.exe	93
PID 2112 wrote to memory of 5220	2112	msedge.exe	94
PID 2112 wrote to memory of 5220	2112	msedge.exe	94
PID 2112 wrote to memory of 5220	2112	msedge.exe	94
PID 2112 wrote to memory of 4980	2112	msedge.exe	95
PID 2112 wrote to memory of 4980	2112	msedge.exe	95
PID 2112 wrote to memory of 4980	2112	msedge.exe	95
PID 2112 wrote to memory of 1776	2112	msedge.exe	96
PID 2112 wrote to memory of 3736	2112	msedge.exe	97
PID 2112 wrote to memory of 1776	2112	msedge.exe	96
PID 2112 wrote to memory of 1776	2112	msedge.exe	96
PID 2112 wrote to memory of 3736	2112	msedge.exe	97
PID 2112 wrote to memory of 3736	2112	msedge.exe	97
PID 2112 wrote to memory of 1528	2112	msedge.exe	99
PID 2112 wrote to memory of 2120	2112	msedge.exe	100
PID 2112 wrote to memory of 1528	2112	msedge.exe	99
PID 2112 wrote to memory of 2120	2112	msedge.exe	100
PID 2112 wrote to memory of 4332	2112	msedge.exe	102
PID 2112 wrote to memory of 4156	2112	msedge.exe	106
PID 2112 wrote to memory of 4140	2112	msedge.exe	107
PID 2112 wrote to memory of 2676	2112	msedge.exe	108
PID 2112 wrote to memory of 4900	2112	msedge.exe	109
PID 2112 wrote to memory of 4900	2112	msedge.exe	109
PID 2112 wrote to memory of 4944	2112	msedge.exe	111
PID 2112 wrote to memory of 5960	2112	msedge.exe	112
PID 2112 wrote to memory of 4836	2112	msedge.exe	113
PID 2112 wrote to memory of 5960	2112	msedge.exe	112
PID 2112 wrote to memory of 4836	2112	msedge.exe	113
PID 2112 wrote to memory of 2640	2112	msedge.exe	114
PID 2112 wrote to memory of 2640	2112	msedge.exe	114
PID 2112 wrote to memory of 6040	2112	msedge.exe	115
PID 2112 wrote to memory of 6040	2112	msedge.exe	115
PID 2112 wrote to memory of 6040	2112	msedge.exe	122
PID 2112 wrote to memory of 6040	2112	msedge.exe	122

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Quasar v1.4.1\3rdPartyLicenses\BouncyCastle_license.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x27c,0x7ffed25fc188,0x7ffed25fc194,0x7ffed25fc1a0
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,4766329065827062452,10679358503099217242,262144 --field-trial-handle=2332,i,15892919133589773437,5836790543496851591,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:2
  2⤵
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,11961157028074797808,2080136228780698128,524288 --field-trial-handle=2332,i,15892919133589773437,5836790543496851591,262144 --variations-seed-version --mojo-platform-channel-handle=2356 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2448,i,8518946978137857861,6540049817890792385,524288 --field-trial-handle=2332,i,15892919133589773437,5836790543496851591,262144 --variations-seed-version --mojo-platform-channel-handle=3308 /prefetch:13
  2⤵
  PID:5556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3576,i,17262043171332621654,13933664426805972835,2097152 --field-trial-handle=2332,i,15892919133589773437,5836790543496851591,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:1
  2⤵
  PID:5220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3580,i,4230742076527464579,11349775568635342622,2097152 --field-trial-handle=2332,i,15892919133589773437,5836790543496851591,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4248,i,12134170825860420139,17126855351240643802,2097152 --field-trial-handle=2332,i,15892919133589773437,5836790543496851591,262144 --variations-seed-version --mojo-platform-channel-handle=4584 /prefetch:1
  2⤵
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4260,i,17690157257366623895,16337809939533739812,2097152 --field-trial-handle=2332,i,15892919133589773437,5836790543496851591,262144 --variations-seed-version --mojo-platform-channel-handle=4588 /prefetch:9
  2⤵
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5352,i,14859609816975635646,16313894997724279258,524288 --field-trial-handle=2332,i,15892919133589773437,5836790543496851591,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:14
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,7071545453489282993,18379477936175815494,524288 --field-trial-handle=2332,i,15892919133589773437,5836790543496851591,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:14
  2⤵
  PID:2120
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,11106679493841862002,11796534793784701049,524288 --field-trial-handle=2332,i,15892919133589773437,5836790543496851591,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:14
  2⤵
  PID:720
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,11106679493841862002,11796534793784701049,524288 --field-trial-handle=2332,i,15892919133589773437,5836790543496851591,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:14
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4648,i,15271446965931881889,1203627071787985527,524288 --field-trial-handle=2332,i,15892919133589773437,5836790543496851591,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:14
  2⤵
  PID:4156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3560,i,8063972297867545045,15169615614925538197,524288 --field-trial-handle=2332,i,15892919133589773437,5836790543496851591,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:14
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4620,i,17009253850529826610,10906204561398562806,524288 --field-trial-handle=2332,i,15892919133589773437,5836790543496851591,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:14
  2⤵
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5504,i,10595360185420774620,5611066915005543661,524288 --field-trial-handle=2332,i,15892919133589773437,5836790543496851591,262144 --variations-seed-version --mojo-platform-channel-handle=1048 /prefetch:14
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6352,i,9653464115021036968,15114547152317737787,262144 --field-trial-handle=2332,i,15892919133589773437,5836790543496851591,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3796,i,9402438186464181109,4380589937493767117,524288 --field-trial-handle=2332,i,15892919133589773437,5836790543496851591,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:14
  2⤵
  PID:5960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,7899402325496509239,15148056061957644017,524288 --field-trial-handle=2332,i,15892919133589773437,5836790543496851591,262144 --variations-seed-version --mojo-platform-channel-handle=1096 /prefetch:14
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,1650594258913025598,10513716927374998448,524288 --field-trial-handle=2332,i,15892919133589773437,5836790543496851591,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:14
  2⤵
  PID:2640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3900,i,6844325012713665827,15938915324134976816,524288 --field-trial-handle=2332,i,15892919133589773437,5836790543496851591,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:14
  2⤵
  PID:6040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3700,i,1407985702500109610,14386800388607615028,524288 --field-trial-handle=2332,i,15892919133589773437,5836790543496851591,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:14
  2⤵
  PID:6040

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1360

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3500

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:6064

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2b471d5790d1e8ac94438a5662d0ed854761db5162e9ed715d3f950974387da2
MD5 f3139b9e55fe18feb36cb00db002d273
SHA1 755162342b8e0f46c67a7ca7edf74a3293cdaeb7
SHA512 d229aade54d55576064d540cb4f4250cd3d32106eb04bcac5449501aba91bfbfe3857ca0457eab714fad16945c3e3a00e1b408afe8edd04cdf8574cf34450a48
TLSH
T17CD0C02437457610C40D05704410CE02C133C803B0C3DA003032C50CC5158C0FBCD0EB
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b842906cea16d7b3aa3205573cacb7d4d1d2364d11253f46244aaa1a7745db30
MD5 aff0d41e14c14a0f33ef71eb300b3517
SHA1 1b323ae2f9d64108caaa43e8fc26a953c57942d4
SHA512 7d91f5d419c8dab3b5c13b763160d5c782dae9d50314591afda7d0f4db293ab075d234d6ab8602002e921be583a3c7b2c7977545c7522af94ab7cfae1e8bd620
TLSH
T1FAD0C02037457510C40D05704410CE02C133C80370C3DA003032C50CC5158C0FBCC0D7
MD5 SHA1 SHA512 TLSH

Submit Download

000004.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000004.log
Size 1.1MB
SHA256 7eeb7f7ca5a1072ea17371dc051d71494fca35936a705cd409a4debfbffeb3a4
MD5 58c099cff8e4605d422d064cbeccf742
SHA1 a4cb84e2850bed60da0201cede9221bd70950929
SHA512 331d87966c15c319ceed52bd11e2b0f8ff56ebcbb35d73135710a46ab8359a8a7196efe169eaed22ce44eb26b8acc34558cbcbdec7b1c72495ecc3ec57c8fdbb
SSDEEP 3072:ledQsm0MuQImDgJiS79JawtdwdJfx9sEeD1eXen6ARW:ledQvruQBgoS79JaCCd1SOenPRW
TLSH
T14335A81A8447FECF22347CBB00A6F5C5E95843EB0BC4BD5AB9FD89BC9B7669C0842154
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 495B
SHA256 fa5850be1e2420f38b454515bdedd476ae608bf2a57d9cf983af1876947146c7
MD5 f99a0058ebf6ee00bf00e00253c27cf9
SHA1 ef073ca5294037cc9334291c4ebeb39de67cd995
SHA512 f098de91c3d306db195f1175a30b185108a8b275dfccd7233ea8d6803893acb1120801ec37d16da24c2d129fc686a09e45d8c6dabb8f40603871641192b5c1bb
TLSH
T180F09E93FBC2D3AE9520A047846BA30CC342B24FE2CDE88E670997CC314063093C51C8
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 50b0a479359417a836c54b1320101a47226102086a341cac705a90d0cf95727c
MD5 4c648aecbab457d13cad27bcbb41c16d
SHA1 7dc6b9e722dd60337f644f7fb8359b9dfd80d72e
SHA512 c3dfe7faa6946ad45c5cc008824bca435439cef5c32cfd88bc390df72c7990ffacef8177c1c87dc9e290644108d81c093002087fba9392ed36d8f0cb30323688
TLSH
T163E0203E5AC2E7673104B406C77B4314C752710F928DECDD3308729D364069073E139A
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 679787b5596b64b5d8d1b1e55aa6644c3ec24b2fdf5acb3119f3adbdfddb9550
MD5 f7e3b9bdf5c741ee21411b7f54d5f6e8
SHA1 87bcac784607dc2851673795ab11f5be8b864f99
SHA512 f9360dda4f569425ee10869451e3077612cdfe4b329145d09931c67d9953221650143e5ca770bf196a8c3820ce8eea8effb16d8b48cf10f8861ab2f55cfea828
TLSH
T1E6E02685D8C8C32FF220B48B86A9434CC3803A1F92C8B98E170085DC3301290F3DA5A8
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 e68e3c524284c98894e0c1395cce289e00b87254c438be41fc163f18661d955c
MD5 168e2f08eed69f9a409491a8bba9d265
SHA1 c5625d73abe4ef33da4b140f8c0c46005bc9e3ab
SHA512 3d32dfd392fe26b1b8b8db5a36b76fb16e80f2d5bbcae4e5fc68c4b94f5d6bfc66a337c82f9febf1a18c437b66ad947622239c78669b91895212e8306c2a8902
TLSH
T17CC08C4DFECC869DC3D4083EA33AB0410A8901A2E80FAB930820BDC030907B01D3A820
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 274B
SHA256 7e6ca9411216cbcb5387131152b15369a9410f48be664480407d2f96ac570d82
MD5 ab126df0bc36a2c77697f0a66ffa5199
SHA1 8e4d63b194855b662b43c9dcc73a532a8f3c357d
SHA512 e0e03bcff8bda9f14bf3c0eb345a8a0e327e8dbdc99196100190f97e5428b2bb7ad25df720f5a9b42379861732b153b594f7a33c7051da09244fde3a3d969ca2
TLSH
T1FDD0C29DBDCC588ED3E44BFD6279B0400E4402E2940BAF030020B98030B56F01D62030
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 d426fe9427151c2c259101236e1d90a75a20c137b96bc15d984f568a519f8d90
MD5 06887948209cb5145bb3baaa5518b445
SHA1 fda1e56666473424d7e6284ff83e0838be0eca9c
SHA512 deb1b68941397986435983647bc119abbf77e366628742ff6439de27533bbcec3439538ad80e1edf4239110dc8058a25ac017b2091357b28039e6a5d59160805
TLSH
T1F2711B5DCC6239B2DB2141B900D134B57BB42C429A07EE26185950FCFF8E78C63FA568
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5946f2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5946f2.TMP
Size 3KB
SHA256 53e91046ac347bd0478eee142e6f12f95212aa283d2a1babf6ce09a991f501f9
MD5 fe693905be6e1d5b01935c00bf573772
SHA1 4d2e00bbe5b0dee983ad49cfff4d9d2448c66aa7
SHA512 b45dcf58194db10ddb6093434cb1ccd403e7b5e453c16cd014331f0a3e930b3fb3f3e01184b0f250cd36a12a0b1a34a7f6bfe146b406bbf2148118d404a0a368
TLSH
T100711B5DCC6239B1DB2141B900E534B57BB42C429A07EE16185950FCFF8E78C63FA568
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 63a2b7fe4a050497b0699ddd209d5232da6cceb6564e86bfdd4ea4f8ee7b78cb
MD5 d2fa2744b3f33a6386ec2b5099fad687
SHA1 5d1549eec7932c7a2b94bfad2b0913395bc6378d
SHA512 f59c5b2ccbc6df3f38f71c3d7f8d79eb9e11ae6058924c82f0ee3531151bf5ea7ff120fe7ad97b285a85ec3a06fe94988ea11973b395c2d36d76c89207082a34
TLSH
T16741AAF3C3E4866EDA1156F0BA186E2BCE2D0915432C3C5A89E4AF1B93E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 a510754e3fc35313ce00d29f676084600958e68a69659acca1dbec80a39d4f1d
MD5 18a27c8edfb814e106029fac6473b5f3
SHA1 6ff53b7073e4d0c9fc7b14df32626cbdb0fca24f
SHA512 09c25a235cd0c0e76ec8339f272e43a367f7fdbc634fbf7924b2abd6db5aa3cc863d58ca4f5f7511aadff301a46858b10f44afe61a69a97db0a7b6120c31a874
TLSH
T1BB418AF3C3E8866DD90146F4BB186E2BCE2D0915832C3C5A89E4AF5BA3E3471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 48e1ff744cc66ad7426d71820de2fd59a7c7b97ef0ea9775364a66d9d162ea5f
MD5 2145b6b5913e27c9914efda2f35af151
SHA1 3486ab1278baeb67208c9fae1dfea5cb39c382ce
SHA512 84f65f94df87febc179852faecd4446d274fa16ec0001fb4817d4855ba465a07572ae867e7a4eab3c66312d90b43227198b4f7dde4127ba5f2c2246ba0b01790
SSDEEP 192:sxRExRryM/jK1Ml8UQDF5/fXs5xAaDVB9pr6zoA8pen/g6+WNIYJ7OGcIgDYJ:sxRefq55/fXs/AaBB9pr3g/5INA
TLSH
T1C962EA1696245A77CCDBD20DFA517F53D6F81573A2941E04AAFC8B1C01E7AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 8ce93e9099b072b01cca5a1a69beb176237833de1ebacf88b61152b9605fc4a4
MD5 29f82275216e6f285949d34e70d13624
SHA1 2e2e2a46eff72d6e1ab0de615f8019c74fedc472
SHA512 1f85ca1d61cc166e783d4e494530b983f88d5cf2b63e7ce4b3da6cbbb8cdaf4d90c8bdf4afdc50e45a563d96275d0baee0a9b78d7d46169355e401dfe113816c
SSDEEP 192:sxRExRryM/jK1Ml8wF5/fXs5xwaDVB9pr6zoA8p4n/g6+WNIYJOOGcIgDiJ:sxRefb5/fXs/waBB9pr3O/5I0S
TLSH
T1DC62E916A624597B8CDBD209FA517F53D6F80573A2941E44AAFC9A1C01E7BEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 d3770598bbbff3ed476dc0efbbc6819d2cc4e9628079aaae7f0e04a2813c814e
MD5 15e4f8aaa5d7b09fb54eef2c60cfcad7
SHA1 82064b75d3d100e7bae514b18366246668d216ba
SHA512 21c2d22c1e04f7d18340c519274f052396fddf1abf0ffc041377314f28e011688535824ec41568cfd50fb3a3dd933fd54221dd22ef42e6d1ade4b2b252a09779
SSDEEP 192:sxREuRryM/jK1Ml8wF5/fXsswaDVB9pr6zoA8p4n/g6+WNIYJOOGcIgIJ:sxRhfb5/fXsswaBB9pr3O/5I0s
TLSH
T14952E916A624597BCCDBD209FA517F53D6F81573A2941E44AAFC8A1C01E7AEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 8173ee83e444440dfad36728490a7efc676d70d24709c44cee92673d71d7d635
MD5 67c79c5939ecdb9b538f65c8d37c226c
SHA1 2c7bc6462b46188cad29ee7442da9509aaa07b29
SHA512 ace3c2d79cf9cc27213535237d9d98ae49eb5b74f1d2c13535b59e631e35a2a35a3086dea52e009036e954d51498287e119cb6d7f689cdbdf76c59b544ebbf9e
SSDEEP 192:sxRExRryMqZjK1Ml8UQDF5/fXs5xAaDVB9pr6zoA8pen/g6+WNIYJ7OGcIgDYJ:sxRe4q55/fXs/AaBB9pr3g/5INA
TLSH
T17062E91696345A778CDBD209FA957F53D6F81573A2941E04AAFC8B0C01E7ADC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 e7110b717167a4ce99a8b09be6ed2138e4369e556f0f1db69945928a5a95973a
MD5 7c2ab78b1bcce0ad3e194d2883c172b4
SHA1 44865072f2712a521865882e359d1365a4f957bc
SHA512 25477ed99c671093e8e66435a6d6b503772745914f60e5b2d02b2ff30cbc3cdb7f65b574768f9f2f96d9ca6cceb5699617438478034bdb06576925df9cb40540
SSDEEP 768:v1D847WgeEftq8F1+UoAYDCx9Tuqh0VfUC9xbog/OVpDZhnrol2ZFU:v1D847WgeEftqu1ja0Nh05
TLSH
T10BC21B2B640CCB7E4F844AADEC29AED66DD801CB97984D5447EE880C03CA7FB511A5DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dc076244-dd34-4789-8226-722e2b72a998\index-dir\the-real-index
Size 528B
SHA256 caed23159ebced34490a856d502df19638203b47805d7c3f065ffc4774beadf5
MD5 c153b2b441eb126aac9018878a0c84ae
SHA1 e5a7afdd74b92f26ebbce642dc00a127ce4e5153
SHA512 3a5d9d425527c3ce4f4ce1a22ed1070f93abdc254c57bb5a5779e44a490d438731b7351dec6272da02e9b5e5ec597bac516b3ebbc77ed8f028827ddd6cb35edc
TLSH
T1BEF0AB719DA02781CA61287824F0740C27330AFC56104403A09CB4ECCD2667A2611591
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d8995.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dc076244-dd34-4789-8226-722e2b72a998\index-dir\the-real-index~RFe5d8995.TMP
Size 528B
SHA256 9ffa2d787bf992fb310db1e58d6d03f163b8bef8744f22e669ff160e1bc26a2c
MD5 85bd897477868f7a6e67206779ad5817
SHA1 02cad0665f3af7919f3ae7f28713e9a03caa749f
SHA512 f030ff3671987e2f6ab1afffad984ef09def38570234f0d9421e7ae52deaa4fbfa76064b1e8925710ec633c6ef8f99e71b01e3e989957da3ebfe88d20ed8e3a2
TLSH
T1DCF068F196E13BD5CE1115F4A980A40C337B4C207A048A16A080F23CCD5736826952D6
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 f2b088b7d8da95d88bec347826f870bf41785a2fed47ca2f188486bf6823e9bf
MD5 7fbb56ca53f6f9e1404b915f4eee1a92
SHA1 4396fefcaeb1f3c43b8d916c98530b5fc184986d
SHA512 3b3837b2e011a9b0139d250d3e0808a6df880b6641bcfaf1aa3df7f2fde38d9f37b9c6224ba2c6d2d00d79dce366aa7eaee42a2020b1dc415c0a63bacd570475
TLSH
T153E020F71D9B7814AD6F83D120B554AD41457A548949AD8E601B63C710B1354349FC65
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59e100.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59e100.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 d40951534cd05bdeb7270fa750670711499813f3a0e2f8728092bec9fa7761f5
MD5 6c66118f498543be3850c56be5069b92
SHA1 22e04c190ffda27ed1a9ea1e0de6f7423aa1e6fd
SHA512 50dc5bc23f5e98dbe768b4a41f3072e0401c41f58ed32164c8022721f091ea2ef97adc91d9948fb4bba5b96a87d3f1e22ad1929944523907ed0472d2a72e7232
SSDEEP 768:Yj+9c3zc5GUtoVCgZSVCKPFECrBhpjcNmzn12bfZqT:H9c3Yo8gs0KPF1HRckByZqT
TLSH
T103F2AE31B8A49E734CE7D698B107724ABEB843A792C91E4889EC6B4D46C73DD1317C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 055ccf922ec723eeba360484c536c4e90ff01952896d06dfbaafbf6a5a3f6a64
MD5 37dfe5c1cec1b472b0c8bde2caf21024
SHA1 8407b31bba5ff2b9c8c74a17dbb386328f56ea92
SHA512 6559f136f8d44e68930e0b56013b62d7c2b89aea00a20ebb9102629194a62ad8301edd34630657e046317151b593d182ff29d37182d007a0205d5ab9c4057397
SSDEEP 768:fj+9c36c5GUtZVCgZSVCKPFECrBhpjcNmzn12bfZqT:S9c3tZ8gs0KPF1HRckByZqT
TLSH
T17AF2AF31B8A49E734CE3D694B107724ABEF847A792C91E4889EC6B4D46C739D1317C1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 742b67f1b02ec854ddd63ab25fce33c89eae82c96260da88de52292295f6fba6
MD5 8d97342e89cef5fe99f464d5e7b3a7d3
SHA1 098811e47715ba651442f1c657e141004d79cd90
SHA512 b22584b6cff5e000f50f2c7361ddb6c8f38cd4ff79aefbc8d8d191eeba6f97ab2fec3f6187d5ff5939274dc6f0c0c17a0195c919245caf8aa4f1e11e227ec6a4
SSDEEP 768:ZF1j+9h37wgec5GUtCVCgZSVCKPFECrBhpjcNmzn12bfZqT:o9h3jC8gs0KPF1HRckByZqT
TLSH
T15A03AF32ACA48E775DF7CB94F5063246AEF442A7C2C92A58D6DC9A0D46C73DC1347C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 17a51521bd9eaf0f7a270ebbe806362d6f1aac26bec5778e981362675cbe73f2
MD5 cb28077fabe74a987eac791f9fd4de82
SHA1 82ff87e9b709ab0748126aac53cbb7b5fa80eea8
SHA512 f7d9be7b5580fc6059f840fbf1abb205fcc5f05e925e672a8b208de152de4e8b0d4d099418c41e4408144ff1749407487f2b403ba4b02c6eb162c5773455a1bd
SSDEEP 768:bjaeqD4MlshiLdMmu3if5GUuVCgZSVCKPFECrBhpjcxd4+ApX32TB:bqcjhIdMB318gs0KPF1HRcj4+KXk
TLSH
T11E03CF7AA8A45EB38C77D645B207B1466EB842D7D2C92F8CD8DD6A0D42D72DD1303C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1d7eb172-dd69-4ba4-b5f7-0fb8ec103cd6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\1d7eb172-dd69-4ba4-b5f7-0fb8ec103cd6.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download