f9c475876b01bb4d654b8f630f11219cc96198efe91d7f2602a97f0f3c86c3cb

Analysis

max time kernel
899s
max time network
747s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/06/2026, 16:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LICENSES.chromium.html
Size 14.4MB
Sample260629-trwpdsa18n
SHA256 f9c475876b01bb4d654b8f630f11219cc96198efe91d7f2602a97f0f3c86c3cb
MD5 bfb383dedf6aaeab3061c79362a85ff6
SHA1 e536a576ae468795949e3a124b7038d0a9c96510
SHA512 963a3f806237ca758361cefd5b836e51743d7b4c350b75286d8387a20040f9ea05fef0d8b83ab6f35e312309d96f33ae3c1cbb1eea99b6b9c28c6d5e7c212476
SSDEEP 24576:HCNXjZ6doVjZ6/O3jK6DTmwR0wuDGKjr61jK6yjr6gjK6ajK6XjK6QjR6pjr61jN:HYwBeXEn8mb
TLSH
T170E6A42F7B48037306C642A2AB8B65CAF31E903F3B561654345CD1681F6BA2583FF6D9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2520	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134272298885954169"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{88DC51B9-A1EF-4911-8085-DC52282547FC}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2740	msedge.exe
2740	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe
2316	msedge.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 2316 wrote to memory of 4508	2316	msedge.exe	81
PID 2316 wrote to memory of 2520	2316	msedge.exe	83
PID 2316 wrote to memory of 4476	2316	msedge.exe	84
PID 2316 wrote to memory of 4476	2316	msedge.exe	84
PID 2316 wrote to memory of 4476	2316	msedge.exe	84
PID 2316 wrote to memory of 3760	2316	msedge.exe	85
PID 2316 wrote to memory of 3760	2316	msedge.exe	85
PID 2316 wrote to memory of 2280	2316	msedge.exe	86
PID 2316 wrote to memory of 3852	2316	msedge.exe	87
PID 2316 wrote to memory of 2280	2316	msedge.exe	86
PID 2316 wrote to memory of 2280	2316	msedge.exe	86
PID 2316 wrote to memory of 3852	2316	msedge.exe	87
PID 2316 wrote to memory of 3852	2316	msedge.exe	87
PID 2316 wrote to memory of 668	2316	msedge.exe	88
PID 2316 wrote to memory of 4856	2316	msedge.exe	89
PID 2316 wrote to memory of 668	2316	msedge.exe	88
PID 2316 wrote to memory of 668	2316	msedge.exe	88
PID 2316 wrote to memory of 4856	2316	msedge.exe	89
PID 2316 wrote to memory of 4856	2316	msedge.exe	89
PID 2316 wrote to memory of 1072	2316	msedge.exe	94
PID 2316 wrote to memory of 3276	2316	msedge.exe	95
PID 2316 wrote to memory of 1072	2316	msedge.exe	94
PID 2316 wrote to memory of 3276	2316	msedge.exe	95
PID 2316 wrote to memory of 1636	2316	msedge.exe	98
PID 2316 wrote to memory of 5036	2316	msedge.exe	109
PID 2316 wrote to memory of 4600	2316	msedge.exe	110
PID 2316 wrote to memory of 1580	2316	msedge.exe	111
PID 2316 wrote to memory of 2128	2316	msedge.exe	113
PID 2316 wrote to memory of 2128	2316	msedge.exe	113
PID 2316 wrote to memory of 2740	2316	msedge.exe	115
PID 2316 wrote to memory of 4372	2316	msedge.exe	116
PID 2316 wrote to memory of 4372	2316	msedge.exe	116
PID 2316 wrote to memory of 4984	2316	msedge.exe	117
PID 2316 wrote to memory of 4984	2316	msedge.exe	117
PID 2316 wrote to memory of 460	2316	msedge.exe	118
PID 2316 wrote to memory of 460	2316	msedge.exe	118
PID 2316 wrote to memory of 2340	2316	msedge.exe	119
PID 2316 wrote to memory of 2340	2316	msedge.exe	119
PID 2316 wrote to memory of 2260	2316	msedge.exe	120
PID 2316 wrote to memory of 2260	2316	msedge.exe	120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffb8b6cc188,0x7ffb8b6cc194,0x7ffb8b6cc1a0
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1860,i,4994880076865205471,13585474313879833684,524288 --field-trial-handle=2304,i,12407431748275905530,10148415216686154622,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,18320409429604541692,148873450176983996,262144 --field-trial-handle=2304,i,12407431748275905530,10148415216686154622,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:2
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2344,i,14347680009267907731,16598116218880769371,524288 --field-trial-handle=2304,i,12407431748275905530,10148415216686154622,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:8
  2⤵
  PID:3760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3508,i,11272720079612974366,17445410462093551550,2097152 --field-trial-handle=2304,i,12407431748275905530,10148415216686154622,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3500,i,10177205080814510031,6745977964384719240,2097152 --field-trial-handle=2304,i,12407431748275905530,10148415216686154622,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:3852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4236,i,351841917696564987,8490982678768690380,2097152 --field-trial-handle=2304,i,12407431748275905530,10148415216686154622,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:1
  2⤵
  PID:668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,2914701608047822882,15301998230159251254,2097152 --field-trial-handle=2304,i,12407431748275905530,10148415216686154622,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:2
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3724,i,8906322346803229474,16580896098505308772,524288 --field-trial-handle=2304,i,12407431748275905530,10148415216686154622,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,14292421164723209963,4355858008790660991,524288 --field-trial-handle=2304,i,12407431748275905530,10148415216686154622,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:3276
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,5302072076887538940,11131748837669357393,524288 --field-trial-handle=2304,i,12407431748275905530,10148415216686154622,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,5302072076887538940,11131748837669357393,524288 --field-trial-handle=2304,i,12407431748275905530,10148415216686154622,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5956,i,11187799167871217919,7794547115288826718,524288 --field-trial-handle=2304,i,12407431748275905530,10148415216686154622,262144 --variations-seed-version --mojo-platform-channel-handle=4556 /prefetch:8
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6000,i,16318358362823487729,10363501760065819019,524288 --field-trial-handle=2304,i,12407431748275905530,10148415216686154622,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,9380459323269220252,6084646735900758152,524288 --field-trial-handle=2304,i,12407431748275905530,10148415216686154622,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:8
  2⤵
  PID:1580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5216,i,16445113902347732789,7008450322222543115,524288 --field-trial-handle=2304,i,12407431748275905530,10148415216686154622,262144 --variations-seed-version --mojo-platform-channel-handle=2916 /prefetch:8
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5164,i,14265894614606021130,126731399395642558,262144 --field-trial-handle=2304,i,12407431748275905530,10148415216686154622,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,15390046354091058448,2215704944569776564,524288 --field-trial-handle=2304,i,12407431748275905530,10148415216686154622,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:8
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,12260420456743474543,5694897004589476783,524288 --field-trial-handle=2304,i,12407431748275905530,10148415216686154622,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:8
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,1618292475323737815,6220054219960574301,524288 --field-trial-handle=2304,i,12407431748275905530,10148415216686154622,262144 --variations-seed-version --mojo-platform-channel-handle=3376 /prefetch:8
  2⤵
  PID:460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3416,i,13644610158490640374,11705345727928708757,524288 --field-trial-handle=2304,i,12407431748275905530,10148415216686154622,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:8
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4276,i,11153018068534985257,10409196647409452179,524288 --field-trial-handle=2304,i,12407431748275905530,10148415216686154622,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:2260

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 92b83a0e542b7bb3ed324c35b5f2a40c47a6351981065b804e4d9d80ddd6d7ee
MD5 9ea20a12d0c030ae7f84014f382662b7
SHA1 7912569189cf07c1ce092a268e67e9f391b7c8c7
SHA512 39ca414f13163c8479fe7650ae0dd1607b267fe3f319c09aec7bd5f68448e9ac604351069bf6b166b3f897d3afb5d7f35e609b9fc72b9debbcb05bad8fad7d81
TLSH
T132D02B20FF04E002D1072172540047100E0848902093C140E030441CDCEC804D395307
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7d64d2777f444a09968d6c155732e22d743fcf7c319c222bc06f6bb97808e489
MD5 89bc5edb6bd922f1cf8ec5536b066fa6
SHA1 c50aaf0fe1444780bb68ee7ab6e1c7468c2f303e
SHA512 77a1265c1484940562f1514202a0072e343efb323e1dcdb979fc9b7a2c69d85b814c076828b260c0b86a19e482ebb0a2df850f9b7c130a327861a7c56e26cde8
TLSH
T15CD02B20BF04E402D1072172540047100E0848902093C241E030441CCCED844D395307
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 f920b713ffee0e6d6781a29925fb46daa2aefe502a39eeb7ecd1dd8129d8a52e
MD5 f38620bdaa10161a8b3f3badb6b3de06
SHA1 b70fc806c337868043d50bb3fc75302f3afeedbf
SHA512 e12f6f7e96a58ea6ed23fb5fcac314339cfaa1176a6aead8a82435723efb28dac3851df37247fdac6ab0238cd2d0e6bc3f61901f56bca98898e5af2f7b7813a2
TLSH
T1C3E04F5D97C0E2B91911F587FD6C73778552710BD6CDD8AE3304FB86A941B008395794
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 e4531ac5a4708fc8d6b0fc6429cc76c3095d71f557b0e9db4c15de4da1f012cd
MD5 6efc5bbd9bce27b3fe43d92e8c6ab3cd
SHA1 cc2574521cd089341a7b212d3d6bca23a20e2c99
SHA512 cad03b86af1f7c329a46b765f286ed2c4c6b37502299277b3ddb7bb57a5f8463ee64eb2483bbcf543ac72a5a4ef3c2fa81606df720bbcdb9e40f9891571a986c
TLSH
T14DE0486C8380E6AD7106D447E06EA72D8950B54FF5C9D4DD330B6A451440B1193D67D4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 337858dd8868c2c152875da558aa1bc92f61d820a54370aa473be4ed4461dc41
MD5 8ea3dca0e47ff27c2956393a8a9e3871
SHA1 a2a8dfc5fb59a1cc2edee8a5ec8117504742384d
SHA512 bc63fe187616f038d229171923348e933857eea65769a5b89ff56f0f9c501615ad8106663f615dee1d91667d6b1dc293cb13c78237845b49574a98b52839b15d
TLSH
T139E0268C46CCE32EB21CB447917C530CC2A03A4F92CAEAAE970C84897405E40A3E3791
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 274B
SHA256 c39ed4dc1e0dd5270e05fd128a275effd56a2bfb04521b4438b1103b61b992f1
MD5 06ebfdd9fe152db487b4e0ea2b25e475
SHA1 7de7f120795e976af70aae3198a32425045d8650
SHA512 751ea8ba698f45f4e81de6eec3da57fba615d24855b1be9faabb6248d2dc901c3c799c8a09022388ef4638a63528aae2bf1aa9eddba83f0503506560593fe943
TLSH
T1B2D0C2F8A88C688FD3E52AFD8362B0400F5442D29416DE064129F98136959F01F52070
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b111eea53b3e3b66daa89d46ee9dbfeaad080019c92eb840dcf66f5e97ff342c
MD5 6d8bdbc3a8cc3789af776f27957ee0f9
SHA1 d0fbaa36433681ec476ca9d6ae182085415b70d3
SHA512 6a23308c3eceac9cccfad04edf64472fc61cd0b4b74ec850923c54c49400493ce39546020a8c7f8a91d47b83de757f395aae9902cb78fefaa031f16d141dc02d
TLSH
T1FD71553533108058E3620872DFD916EB763685E7FCAB3E8111F2BC749521F728666B4C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c1f3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58c1f3.TMP
Size 3KB
SHA256 5ff5b7527e4de370bb87339a28b1d04d0f44ac5165fa48bbce10041d297ada66
MD5 bc3e43fa3d69c7671aff13e7fd9301d3
SHA1 878ac8b61bd045ad1665a46328847153dbc0173b
SHA512 7605d2dd47e3a1e748b7fc50886735b16859a44222f6dc511880fe1952053d7c9419dd0dcb17f11cc502246f5e752e709fb653712f73429b463135528c71d968
TLSH
T15971333923118058E3260872DFD916EB763685E7FCAB3E8111F2BC74A521F728666B5C
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 2fb87333f2f75ebd74937662e21cb6beac6b84631c0f1cab222c81290f846560
MD5 744a5d1f35b40189d2b80650ded8c60e
SHA1 c3d73836b4e02fa34b350d7c97960b0eacab962a
SHA512 06c37b9ca1b64cb7a0f71473562c5a8139e4f2c2e7c038588a507858641887a8969ca477cacc0bac524b8ac8d10aa1000c5265afece973ebc99138cc153c44bc
TLSH
T17D21A0F383D585AEC91156F06E14BE1BCE1D0505432C3C1989E4EF17D3E3475E00295B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 563d4da763936f2d764703374c05ddc26d451e1d7cef545729f33a45c9d7c89d
MD5 e81fcc9659a24074db4da037089f3d5e
SHA1 496adf27bae19a0e705689ddf9eecd989875c423
SHA512 1181ec69d7d509638c734fcbc3ab947e1fe325e6d6f6d1c7db63234e20938674b2420d985a468fbe5031020b9bda7008284a6287698ce7f2c7eaf2f78b31d3ab
TLSH
T15221A0F783E1856ED91156F0AA18BE2BCE2D0505432C7C6989E4EF17D3E3075E006E5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 478f87b137e6152a25bf5e80cb32189beea91a3832da1e3e58f6d1f1f94e9764
MD5 f97f4a460e727b8ba424e63888d5b550
SHA1 19bbb5dfab5742ea5751e68bf7648021a8026e9b
SHA512 f4bec2654dc24a4f941b42daf6edfddea9a5b2f7615140ca5022f05d012783bda3e0626548d2241c587d6e74e1fe6164c8196e4a396f9f67660b048138284637
SSDEEP 192:sxZSlR0yM/jK1Ml8MkD/fIsreRVtIdpd1HW6+WNGYvrmjZatIgrJ:sxZSlmMD/fIsreqLHbGb09
TLSH
T19E42E8126A345977CCCBD209FA45BF53D6F50562A2940E44AAFCDB0C05EBAED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 cb2434265836f3d90c1b995b3bd6485d3133d25377327ae1ae55da08707bf4f4
MD5 de79742077f2e25fbe8f260aaf75c030
SHA1 5c571efdb92241ddac18c72c0b179390f0ac6a63
SHA512 53cdc297bae92dea3ee2e0b422003908d7e20d882bf1ab175fa676c71ae5c854a12961cbb78be9bd3e59bdc7bd23beacc107c4e8cb238318fe4195d3e0bd6eb8
SSDEEP 192:sxZSlR0yM/jK1Ml8UQdkD/fIsdCRVtIdpH1HW6+WNGYvWiJjZatIg5cJ:sxZSlmq2D/fIsdCqVHbGvG0y
TLSH
T1E552E7126A345977CCDBD20DFA45BF53D6F5046292940E84AAFCCB0C05EBAED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 3ff45fdb2c3471cdaa85bfdd5b917ea427ddababd86661ea430db1c00197fcfe
MD5 649ab07ea72700126ba1043de86ba32d
SHA1 3ee04f6930a684fc55b84819682cd59035a445d5
SHA512 53ce28797a3ab34fd5986dec9e07aa055a48e4b8df07b1bb7ece720a31be0583aa96172da5a3f5b1fb9727441afe2416f99c358df2dfd38585a03ee432c59634
SSDEEP 192:sxZSlR0yMqZjK1Ml8UQdkD/fIsdCRVtIdpH1HW6+WNGYvWiJjZabIg5cJ:sxZSlBq2D/fIsdCqVHbGvGey
TLSH
T1F352E8126A345977CCDBD20DFA45BF53D6F9046292940E44AAFCCB0C05EBAED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 e399ae5241bc3624fbd28a84839f5a90eba7f9a8a29500bba6c7b2457a7fd80d
MD5 f4c17e3cac6a7bb74bc461b49154e35e
SHA1 b29a0313d6a95b93a631c842dfccdd0a45cdbfc0
SHA512 be1261510ee72017cc05dec10a503b03c201009c394a2d81f7406f7d20605b1f992a7a36929131b2eac18b2cb06b9d2f305d67660e9e41aee6354aebf6087e4a
SSDEEP 768:uQseJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0ppdroLA:uQseJ3xWvhfynu1jaVcL88pWk
TLSH
T160D2FA2B680CCB7E4F844E6DEC266F966EE801CB57984D5487EA880C02C77EB51275DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c41e8016-acfe-4596-96f4-a749f543712c\index-dir\the-real-index
Size 816B
SHA256 285113f53f46eac1ccb63b60c1554aa9b9c6e97ac2625150e2a497c51f1daf9c
MD5 82e0bf770259e1dd1dc02e85ca5c3eaf
SHA1 7011e5eebf62f65f744418d15a47e01320adbd66
SHA512 be653105cbe9e816dbb148c888d293a269ef6f91527bccd15b00efd27dc4908d4c347bf34cfd579f5c8f069cf7b8cf33ebe780f2eb00e3c1c7ce69fae81afb95
TLSH
T16501024A5E924C6FD9980AB314B960F433B1C9EC1321E123883C2C2B2C3B3CAA807098
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d16e6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c41e8016-acfe-4596-96f4-a749f543712c\index-dir\the-real-index~RFe5d16e6.TMP
Size 816B
SHA256 16c0447e33cfa1b5149bd53951f14efa0653437e999adfaac4d6bf3199e0b655
MD5 9f1dbc3dda1802ae42633c2357f52a0d
SHA1 85e3ae0d43c1dd8463778952fc1069f6dfd352e5
SHA512 2f556225346f31370f911781051e2875dfcc2930abdc9886880125eac8b76b8494ca5f33b679961ce6b6418232cd4ef3633cef9aee51f70ee6a84022d68f173f
TLSH
T16101E1868B968E1FE85405B7048560F47331C9106322F7939079253E1C7A7C999070C4
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 ed9152744c1cfb8f1a162149c183f84503e3f1a992fffe7c249bded8e849a338
MD5 bb4a6dbea266cf2952680323428d3d61
SHA1 731de87d63355399e5ac51ec20a19deba9118d8f
SHA512 85121325da4fe8259ea6f3ddf97291c5bb0074a02b9425bf1e186aa2718f292f1ce7966717f2dd692de67b92e84038d906972db159ccb1280cbf9e9dbc27e713
TLSH
T1C5E0C6B62DD32810BEAFD3DA20308090064A78ADE941FC4EA42FF6C310B231530DBC36
MD5 SHA1 SHA512 TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe595b74.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe595b74.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 639b73b48e8f5d973c3f7d20e3baea0927cc97b64b05ceaa29cb6e06a6858adc
MD5 d4a10e84b6021ca2add27deb82aa8e77
SHA1 f7b8b4b535680a38fccbf1d94a1922ee1148dfbd
SHA512 e2600ebea02f4dc43c8475722fa6bcf31637ee3bf98a0e1128ef2eb33b7b365e4101c4e4859989d90eec1ddf302c4ffc8e4c85925e0f0825687e3215612cb12b
SSDEEP 192:unTSNWMsnMcPPQLz3XX9VofsNZlQ+6TM7yQpQmiU1MTMV4MTbt+FdLjv3mhT8z13:EtNn/s3n9SfsNZlp6A7fHY7Dd/NgJZin
TLSH
T1A8625C326C245D6B5AA2E585F54737075FF4816B97C42F94E9ECAF1C01DF2AC0307926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 17KB
SHA256 f404a45bb87beb67bdd2cd0c2c91bf97838504ebf83e0d495d838a75daae9e65
MD5 3b9c9293c8c4189eb2a80acc601ab240
SHA1 0685408fd1ba01a0dbbc2fc229e92a306ba61600
SHA512 1e2c56d0200e4f4978edac548098bf8dc18fac75d79713d9b0be412f6d59f243fc36c5480d6d1b4bf1b7670b431b729c89b552090faf56bf844f9e631bb34cae
SSDEEP 384:YiF1tNn/s3n9SvUzsN78TUNTUlIlkp6A7fHY7Dd/dgJZin:jF1j+932wg6c3ldgnin
TLSH
T144824B335C54897BAEB69A85F54A33079FF441ABC6C5AA94EADCAF0C01DF29C0307D25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f868cc2e9645955c83c7389a87efbb1c45111fddbb1095c1edb98c33928fdd4a
MD5 e245753ed0f46f17825513013ab442bb
SHA1 4653e54c142426ca699f0540edd320ee55de9e9d
SHA512 8655ac373e2763a531a27c86eb8f50ec42f1ed8f5515d516c50d6d925391a63a95832756264f3190b71c21ac3a1cccfa2f60493eb164aad7e1919726607defd7
SSDEEP 192:lONe6vMtPQmiUyZaThTbt+FdLjv3mR847gCajU/u:lONe6UtRPTMd/+gtU/u
TLSH
T12A02F935BC786C67AAB3AD45F48A27171FA4117FA9905B54EAE82F1C00D764C1303826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 e7b0025e1975e9ea1109e60ae3ed7c0d8ad25345a74e0934c97c9a8a5d6224d3
MD5 b7d6bfc190c2132e0ba598d8efa33cd8
SHA1 417f6c6ed040e8a9dc481e9e2cfb8266e7c33f39
SHA512 8d7604c7f9b0944365f01b03be7061bd32e27d8327138addae3ef645a63e8003b0f656cf2b24904b9d4ee0bd208009a31fa6e58b544a29cfc1f942f132044edf
SSDEEP 192:uLTSNWMsnMcPPQLz3XX9VofsNZkQ+6TM7yQpQmiU1MTMV4MTbt+FdLjv3mhT8z13:8tNn/s3n9SfsNZkp6A7fHY7Dd/NgJZin
TLSH
T15B625B726C285D6B9AA2E185F54737075FF4816B97C42F94AAECAF0C01DF2AC0307926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 33c5be25b423b048a79e27296ceca8271bb992c03cedd1ec017e28976aefa3b7
MD5 85fcad18aad4c223f543ebc91971721c
SHA1 774e0c60b5bbc541af43dac60bba4d6f1a4ade2c
SHA512 0da2a1d61172c21d7787df284042cf11bfe99bf2ecdd0d382db0c9c27c5087cb4861afcfb12922306240ecbb73f0b3d8ea6911ed7cda7721ea063c95215cb1d9
SSDEEP 192:vONc6vMOPQmiUybaMWhTbt+FdLjv3mhc80IgQq7ZU/u:vONc6UORHZMd/0gJZU/u
TLSH
T185121B71AC649C6B6EA3B585F48736075EA4816BDBC46F90EADC2F1C01DF66C1307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f2fceaa6-ce7d-4c87-8d79-0842059106ff.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f2fceaa6-ce7d-4c87-8d79-0842059106ff.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 6e2a36fbba753656668411ad41dae91892ba0d1ce378e752a5bda99cb44c4897
MD5 69d6a8586c1d3b47c120ac0eeb6599fc
SHA1 4decf8b5e4639744f7d0b260c877b8ef80bd29a7
SHA512 9c64f475c888c1a99800fef9bc6f1140fe22355be64925c7cd3dc7f86ca7dd10b522b85fbab04f8de9af2994ebc7361bae78f826f3ffc47b49e6d0c76a60cb22
TLSH
T18741F75CA6F91148B3B77F5AABF6A8AE487E7D372E06C45D00110E4F4A26A41CDA1733
MD5 SHA1 SHA512 TLSH

Submit Download