hxxps://gallofreadministracio-my[.]sharepoint[.]com/[:]o[:]/g/personal/ricard_homet_gallofre_com/IgCFQsFDnzTNTZjz8buthA7TAVl62x5aHXBuSx6xLKwN3x8?e=LUerzL

Analysis

user interaction
yes
max time kernel
149s
max time network
148s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/06/2026, 17:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://gallofreadministracio-my.sharepoint.com/:o:/g/personal/ricard_homet_gallofre_com/IgCFQsFDnzTNTZjz8buthA7TAVl62x5aHXBuSx6xLKwN3x8?e=LUerzL
Sample260629-v17cxsax21

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2488	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134272277235460831"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{E9D728BD-24A6-49CA-8BCF-FCE3B9822FAB}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4216	msedge.exe
4216	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe
1120	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 1120 wrote to memory of 4300	1120	msedge.exe	84
PID 1120 wrote to memory of 1456	1120	msedge.exe	85
PID 1120 wrote to memory of 2488	1120	msedge.exe	86
PID 1120 wrote to memory of 1456	1120	msedge.exe	85
PID 1120 wrote to memory of 1456	1120	msedge.exe	85
PID 1120 wrote to memory of 1600	1120	msedge.exe	87
PID 1120 wrote to memory of 1600	1120	msedge.exe	87
PID 1120 wrote to memory of 3156	1120	msedge.exe	89
PID 1120 wrote to memory of 4344	1120	msedge.exe	90
PID 1120 wrote to memory of 3156	1120	msedge.exe	89
PID 1120 wrote to memory of 3156	1120	msedge.exe	89
PID 1120 wrote to memory of 4344	1120	msedge.exe	90
PID 1120 wrote to memory of 4344	1120	msedge.exe	90
PID 1120 wrote to memory of 1520	1120	msedge.exe	91
PID 1120 wrote to memory of 2588	1120	msedge.exe	92
PID 1120 wrote to memory of 1520	1120	msedge.exe	91
PID 1120 wrote to memory of 1520	1120	msedge.exe	91
PID 1120 wrote to memory of 2588	1120	msedge.exe	92
PID 1120 wrote to memory of 2588	1120	msedge.exe	92
PID 1120 wrote to memory of 4076	1120	msedge.exe	96
PID 1120 wrote to memory of 1616	1120	msedge.exe	97
PID 1120 wrote to memory of 4076	1120	msedge.exe	96
PID 1120 wrote to memory of 1616	1120	msedge.exe	97
PID 1120 wrote to memory of 4296	1120	msedge.exe	99
PID 1120 wrote to memory of 4388	1120	msedge.exe	115
PID 1120 wrote to memory of 4388	1120	msedge.exe	115
PID 1120 wrote to memory of 4388	1120	msedge.exe	115
PID 1120 wrote to memory of 2932	1120	msedge.exe	116
PID 1120 wrote to memory of 2932	1120	msedge.exe	116
PID 1120 wrote to memory of 2932	1120	msedge.exe	116
PID 1120 wrote to memory of 4876	1120	msedge.exe	117
PID 1120 wrote to memory of 4876	1120	msedge.exe	117
PID 1120 wrote to memory of 4876	1120	msedge.exe	117
PID 1120 wrote to memory of 4020	1120	msedge.exe	119
PID 1120 wrote to memory of 3152	1120	msedge.exe	120
PID 1120 wrote to memory of 816	1120	msedge.exe	121
PID 1120 wrote to memory of 1048	1120	msedge.exe	123
PID 1120 wrote to memory of 1048	1120	msedge.exe	123
PID 1120 wrote to memory of 1620	1120	msedge.exe	127
PID 1120 wrote to memory of 1620	1120	msedge.exe	127
PID 1120 wrote to memory of 1620	1120	msedge.exe	127
PID 1120 wrote to memory of 4216	1120	msedge.exe	129

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://gallofreadministracio-my.sharepoint.com/:o:/g/personal/ricard_homet_gallofre_com/IgCFQsFDnzTNTZjz8buthA7TAVl62x5aHXBuSx6xLKwN3x8?e=LUerzL
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ff92152c188,0x7ff92152c194,0x7ff92152c1a0
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1724,i,8278700590901913862,7258997299427418569,262144 --field-trial-handle=2288,i,10420754259789488780,6300151617383128349,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:2
  2⤵
  PID:1456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1936,i,17513628443682294602,7888965083750316021,524288 --field-trial-handle=2288,i,10420754259789488780,6300151617383128349,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2548,i,15406355374932479342,11029071725865722500,524288 --field-trial-handle=2288,i,10420754259789488780,6300151617383128349,262144 --variations-seed-version --mojo-platform-channel-handle=2568 /prefetch:8
  2⤵
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,17549555480102866260,12692975762018957267,2097152 --field-trial-handle=2288,i,10420754259789488780,6300151617383128349,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:3156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,8515521644364263297,18317358311049182290,2097152 --field-trial-handle=2288,i,10420754259789488780,6300151617383128349,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4244,i,8464929061123832249,8018451567243256938,2097152 --field-trial-handle=2288,i,10420754259789488780,6300151617383128349,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:1
  2⤵
  PID:1520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4272,i,12697726925509051555,14706539157302899259,2097152 --field-trial-handle=2288,i,10420754259789488780,6300151617383128349,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:2
  2⤵
  PID:2588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,9193015814508229809,3813335559193678947,524288 --field-trial-handle=2288,i,10420754259789488780,6300151617383128349,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:8
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,2316179292170558135,4699194524930659661,524288 --field-trial-handle=2288,i,10420754259789488780,6300151617383128349,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,12370287805947654349,17433376889999048319,524288 --field-trial-handle=2288,i,10420754259789488780,6300151617383128349,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:3708
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,12370287805947654349,17433376889999048319,524288 --field-trial-handle=2288,i,10420754259789488780,6300151617383128349,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4332,i,9230318094576270075,8420799918545179880,2097152 --field-trial-handle=2288,i,10420754259789488780,6300151617383128349,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:1
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6284,i,13978287654203699951,16168025511743544132,2097152 --field-trial-handle=2288,i,10420754259789488780,6300151617383128349,262144 --variations-seed-version --mojo-platform-channel-handle=6324 /prefetch:1
  2⤵
  PID:2932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6468,i,5309671002615764487,866026943476894748,2097152 --field-trial-handle=2288,i,10420754259789488780,6300151617383128349,262144 --variations-seed-version --mojo-platform-channel-handle=4780 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6580,i,7275838106835007903,10293171766895172147,524288 --field-trial-handle=2288,i,10420754259789488780,6300151617383128349,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:8
  2⤵
  PID:4020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6612,i,339712379316798014,5967181570107514807,524288 --field-trial-handle=2288,i,10420754259789488780,6300151617383128349,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:8
  2⤵
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6584,i,17959152410950104939,12428585604343188182,524288 --field-trial-handle=2288,i,10420754259789488780,6300151617383128349,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:8
  2⤵
  PID:816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=992,i,4008532329850863981,29130253472980428,524288 --field-trial-handle=2288,i,10420754259789488780,6300151617383128349,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:8
  2⤵
  PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=560,i,6368297588855096788,7227194193302407651,2097152 --field-trial-handle=2288,i,10420754259789488780,6300151617383128349,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:1
  2⤵
  PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6616,i,1040724181355670464,5400052864886950432,262144 --field-trial-handle=2288,i,10420754259789488780,6300151617383128349,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4216

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

21056730-37e5-4d28-a60e-3d36601b532a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\21056730-37e5-4d28-a60e-3d36601b532a.tmp
Size 8KB
SHA256 f277fa71e746053563c147ccb94d1a2039b271b2ffe7369cc93a370256a38a14
MD5 a92028045323e9c41bd4c0d2396b4ee4
SHA1 484b3c3112386b2695811d7e1f10cf47f2d24fec
SHA512 455790b4b2f65771f8625b7bd11e8f13983bdd78e6739914b8460a18e34e02f778756847633320b775ccb25e9fca06dad849aa21c363f8e682c3819579cf9805
SSDEEP 192:tON06JkRtQmiUysQW+RN5+Fd107sh35RHJU6:tON06UrwW+RNmd28PJU6
TLSH
T19402B935AC386C7B8FF26D09F58B37135FA4116BBA952B84DAE81F0C01D765C1307926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 994380ffd288a5f1a9acc9eb76a487a55b12cc1daec839d811240f6cbdc4da3a
MD5 f5ed4946834be586ac6410ed88740a7c
SHA1 6108ce368e8b3bb8012956bb25606c3b16835c7b
SHA512 76bf60b37c50422ab125edd3da70629e685408a106655a9b7e5cb6aa7b6a9000c76d8ac2f5dc85e58e893b61bef9b539b9488ac894f1fc1338a58944dc9f4711
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P77:fwUQC5VwBIiElEd2K57P77
TLSH
T1E5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cc11c2ba3ec4cb292b61dd36af338e083bb0ce5868e654b17f3c58ecf3c8fdfb
MD5 22bfe5ff5070c92c37e54f6f278efd25
SHA1 2fc94025f3a738879f1fcececb95937cbaa0cdd1
SHA512 b57abd220e674cf733b39ea299fc66d6fe964ab448ae0758482efe80597e3678909cd989b9635acc0317001af0fe6dbbbccfd3cf110ec5ad1b9e4c084de22188
TLSH
T16FD09220B719A2C3E24704BA94A6AB52A916C57AA0B7F7017232640CAE65089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 201729318e073e437978c4f830a6df095e397d14193bbab8cb94016e3e0e1540
MD5 038903102cb76ddedd18207430e00005
SHA1 e694b970e01eb43fddfb00d36857e2b64f8c931b
SHA512 bacb50167c8d736bccc259f2ffbffff915c7c6dc188c6c2c1476ded8cbd822ff968f690173d1b8e35c352ec62f9ace3913a556b80bc1a59211be000ee9ea7447
TLSH
T17DD092207759A6C3E24704BA94A5AB52A916C57AA0B7F7027232640CAE66089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 050b90cf2be753261743f38fea6c2f39ae7f0344d4aa72e42ca6afb05472e072
MD5 cf4d32bf7360733132ed0dfcea1a52ca
SHA1 7210fda875cac455763963f54f3d5ffb31dacbae
SHA512 6419c46a14e40d0e6f23e91a8e9ace87257070971f6adebf5a9c334b889df17ae3955346c36660a7d4ade00fc5bdea3f8f54d0ed100c449eb117698f199be712
SSDEEP 96:/TG5CQcuoojaT//h9BcchKIjGYlco2tiUHbBMdnn:gCQHooK//h9eFVecHi3Fn
TLSH
T148B17F3149E9178AFFA10E7052E02950A3725ED6FC2BAF8B1F13B5799D63FD44095348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 5da3712098f39938368481fc82d7fc65ef573d7b4f40cf5e456bd7489d2cec1d
MD5 7a4532a20f754ce496ead9c293ca7a53
SHA1 18d2fdb23618acaac76702353b17f081271e060b
SHA512 55d235069e77dd386a204e7e098acf64963f9d043e6d92ca918415e3cb56207a9a0285a947d111688faaf1be2304dd3471efe239c3554f33dcd0e630526fe267
TLSH
T11071B634551653DFF7E6027290C12255F6328DEAFE273E412F2375B45E01FA0816A389
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 131f5e4e4a88aab3ad9e1027baa421f5770087be8ae8507648b853c93d79ce90
MD5 8f8ab9d68b10928a58f5c7a62d3e30fc
SHA1 8549ea87fbb5bdb341fed4f16d74e1cf699fcb99
SHA512 0fa86f4e442f109d2c906c6534cb0633312a7726d669ab3b1e41258a33ef31a11195f5f997bcfc58308e8b0f814d1b38b7a12eb90a3844765b43e0b8d39edb6e
SSDEEP 96:KaTzj15CCEaceJbo0p2niXwTPqGcK9co1QfvO04G:K+CCHfJbo0siICGH9wnb9
TLSH
T17EB16F3108E9578AFFA10EB052E02950A3B15AD6FC2BAF8B1F13B6789D63FD04095348
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5828e0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5828e0.TMP
Size 3KB
SHA256 99266e59f961f70144ef11b14996c97ecc860d685c9e94250349486fc4f95a71
MD5 1286564a0d9612470ead9c565a1336e6
SHA1 fb7fbe98ecf88333961dc3a1c697444176aeaef3
SHA512 5294670f4d1012e63a3b7c735c3f8e1c8387a16dda2fdf844c262169b1b3dcd497e7f07eeb6f324097cd7c39c07d9349dcbdfb3870382194eae1e4c71e08910e
TLSH
T116719334551657DFF7E602B290C12259F6328DEAFE273E412F2379B45A01FA08169388
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 f49044bbc75b92f713ac1c75ea5001e34a9ac02748e2bf9fb27dfe33d8157a12
MD5 0b20ccba90cce286b45f24ab32fcf488
SHA1 291cdf1076519ac3c58dddc3f298469941afae3f
SHA512 ea2368fc5cbb719598a6b91fca64cb4c9f326b22f5a5061250ba8fd069e9523819e3b45698dd8e272d48e88ea1471c7958b5205e7ec8f8d586baa0349991178f
SSDEEP 192:DCS2hZR32/L1kj60fVtwfReOe5PaRGmO5vpaIEFyhkadyUXu8dUE9OEu4ql:DCS2hZR32z1kGaVSfcN54GmO5haIwyOB
TLSH
T168F1BCB7C3E8862FDA1291F5A7157D2ACD7E04651BA8386385E8EE8643E2473F24150F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 d78efb5658c54fea6db2e048629b08c05434e5f02040ef4ca3e678d7ad79c31e
MD5 512b25859afaf337fb0889d9e3d85212
SHA1 cd45bd3a7a49d5068d93fec247438735a86c7380
SHA512 13bf2d956b96c1a35291ac9a258d08cb406d2ed4c8e187398f36b8649f76ecb7b8599910101389345d9ded43b96b9f0f6489a8ae6d6c212e849cb5e7710ddcac
SSDEEP 192:DCS2hZR32gQkKL1kj60wfReOe5PaRGmO5vpaIEFJkady18dUEFfVGrXXuun6TR0c:DCS2hZR32gQkM1kG1fcN54GmO5haIwGQ
TLSH
T11712CCB7C3E8862FD91291F5AB147D1ACE7E04650B68386685E8EE8743E2473F14160F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 6bc9d8ddf735d2bce3e55ba41285aed78f42500342cd4bc7c34ab098d0777c39
MD5 5ea0fd2f12ba017e2390cdd18485cee6
SHA1 6f02a4ea214ad6a5fd2754a349862f1f1098e4bf
SHA512 dad71498388859dd383f4f19dfa9b58f8fd059b16f2fd225926eeee50fa8be639838895bff659f74e02ee3cc55af23feca958759d9f2b3a21df2654410534d74
SSDEEP 192:sxZdRsyM/jK1Ml8UQskR/fnsEhQu4SIdpWiZHW6+WNULIXYI0oKaSIg5nJ:sxZduq3R/fns0qbJHbPXYX
TLSH
T1FA52E9126A345A77CDDBD209F940BF53D6F5057292A00E84A9FCDA0C05E7BDD221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 926f57722c20e76d95ab1d4878ed8d9296fe28cc374f394f165de4f2af10c8ec
MD5 8c35e2f96af7c816e472f17a150734e6
SHA1 b98418e4bd64e24cf649d1794aaecfd0d6a7fd2d
SHA512 30e7b45ec2cd5f535a47cebee7936bd1308b68e40ece741b521ec1e3f217c8d03bc3ccbb79947124e8e67cef29f0fe61b85024064394a060cbe0b2759e03b7d4
SSDEEP 192:sxZdRsyM/jK1Ml8MkR/fnsEhQu4kIdp/ZHW6+WNUlC/YIefoaSIg5nJ:sxZduMR/fns0q9hHbT/vX
TLSH
T15652E912AA345A77CDDBD209B941BF53D6F5057292A01E84AEFCCA0C05E7BDC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 8825a5e936f63c981ba4121a1c9dc5c0d4cd05809f5dec79e3f4ab02de1b8abf
MD5 095896430c1d34c4c290a873974f430c
SHA1 a2d9b390e74824b0a0f39314e3ed4f5819794b88
SHA512 9e05a508e4c29083372c49b1b07a8f8c763f2582894dfe7e1322e1b7fbe900edcba805d56b74418bf52e1202ac90a3910782de61e0bc240f464fc4f26af74c12
SSDEEP 192:sxZdRsyM/jK1Ml8MkR/fns/Ql4vIdpJHW6+WNGYIwxoaSIgrJ:sxZd2MR/fns/hAJHbGF9
TLSH
T11142E8126B349977CCDBD209FA55BF53D6F41572A2900E84ADFCCA0C05E6AEC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 4e92e57c585785aaf728e500e8420e09501efc91b26fcf45aaee0c4fad9addae
MD5 56279930d145a3559786fd9a00e81475
SHA1 6facbc060f6ff9946ba1f47b7f65a0fadcdecc98
SHA512 42936b2c2dd63a863edffc39a829cb1de71c9bb3c49e484c0df7b25b5950066efa98cf42b94f384939a714d5a57bfc7b28fcef3261a18e7c81da59c0e006ca7a
SSDEEP 768:kesqxXlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR9Qro1VA:kesqxXlWvJD6Tu1ja54LAs971G
TLSH
T1C0D21B3B694CCB7E4F840E5DEC266FD76ED801CBA6988D4447FA890C03CB2EA51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 4559e3ef55ab0cb28b9325f1f05ba2475f2e276a1a5dd1a643fdc0242a961700
MD5 35534b268e71ae6aa4e59e109c075ca3
SHA1 36bf9dd16451f12403d3e8a4d2b8e692e81c5916
SHA512 1635f381d2b3109dbba9861b9aec2d83f46b9208f12728c4fd6cbc8a226feed82e5d16e662c2e920c4902596329ffc9adc72b030bc9731c4082713ab709dd2f1
SSDEEP 48:KPYNs4iCiac6vpI9IaKGveOaS4K7H2oTy3JMdIdKegIvyNHIFKMkoHH4HpHkHYH6:KYbaKYIKvdCKegCeHuKMkGQ9kwSp
TLSH
T19791231A357A0212387D28A8B266D93B5F413A63701CE46F3FB850A60B67E110DFDDED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

850585e8-071d-4e7f-82e8-4b832b098f08.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\850585e8-071d-4e7f-82e8-4b832b098f08.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 c88c4c6ca19c1adb7579f633f14da497b39de2d50c7105d725db17f8ebec8c11
MD5 89e7dddb7dc4dd48fc43d9b0fc8c0ad4
SHA1 daf9b19291366ead03de2ce9da37b239b4148c72
SHA512 f8cbbff98c028b6ffe071b9dd34de7e48825126065cd3acd60e106cb25830de51d99020ef147ad3bbe261e22571a627a2cf63a1a5165d9895319e41efe22ca5f
SSDEEP 384:PMiF1tNn/s3n9SUzsND8TUNTUlIlPmChbJqC4VRNmd2OYovFmn15wbAjEJDr:/F1j+9/2wgECKCuHmRnFmn12bfJDr
TLSH
T188C239F248D74936DAAE5B47A73E2D034EBCC067B5842950B7A84E0CCD9A2BFC306D15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 c55d62051e07c481201f73c4c1cd44eca4a7c162a5b4f4a6852f3edc8936bec0
MD5 d2ca3560f872f53e05677a02465a736b
SHA1 8ed1ca024bcbec27471dbc81077bf9fc08452e9c
SHA512 04dd9bfcba544d3d7da99e04b0d83cc60968dc5a4e7e7ab7d26656eaf7eb866f67e6a155f5665cba3236def34d7753ac99e52429753e5fec587c6bed052dc204
SSDEEP 192:uFLsNx3QUgCukRbhJrQmiU1BgGCn4VRN5+Fd107ptpefPwoUXFkSR7qfvGU8:asNx3mChbJHC4VRNmd2OYo2FU8
TLSH
T14A32193668786C675AE2B905F44736139FB4902B9AC92F80D6FC5F0C01DF6AC131AD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 211a58c401e76e4d960356cb44dafd262beccf847ee389a9a2638d61f6d56ad8
MD5 848459c0677b3fb16e063f65d3abd8a3
SHA1 f29c33f30cb5c9b2dc201e4afabc158d3ca7ddb3
SHA512 99c6897ae5e02678cb74915bda08941b4dc2e642905db4923e03f75a499d4982d3c5bc8ffba1f7c95da503d5c28be9f187dadbc5fd4357e860fcd6795fc162fd
SSDEEP 384:2tNn/s3n9SfsNxPmChbJQC4VRNmd2OYo2Fmn15wbAjEJDr:2j+9UDCwCuHmR+Fmn12bfJDr
TLSH
T17A927D369C385D275EE36949F54B32075FB8816B97C92A9085FC8F0D02EB7DC131AE26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 607fe5e18a788c67a4bb757524ddb7e90f065477f93c97f9426f4eefb43735a9
MD5 68e4294e765e3d72cb7d62178f1b86ee
SHA1 81ec9e960aa01bfa0b260d2bfcf756e20a1b6ad9
SHA512 112a46a241c7dd373c275787668f577f7a7d5380f7800d8fd68ccf29ba037f3f5e50d2e242da9260f719701afdc50027fa644bccafb8275def784c59ad03c928
SSDEEP 192:NONE6JkRaQmiUyd4QuG+RN5+Fd107ptpefPwoUXbVc7qfvGU6:NONE6UWMx+RNmd2OYonFU6
TLSH
T196120936A8686C6B5FE27805F48735135EA4512BEEC93F8095EC1F0C01EF5AC131BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

492f654d-c2d3-47a3-a332-64a1a137e40c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\492f654d-c2d3-47a3-a332-64a1a137e40c.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 a17c051f64605c04a31572ab806ac14201b1ef1577baf2d65941982919250a20
MD5 4b7d5926642e4fa6e387f43c290d259a
SHA1 9a1b5b9ae3d80dafcb991fc38cfaf5750576cc2b
SHA512 0d546feaa997a70534f8f7737036e5aac97407cad2f250bc4e50db1c4b1cd99e79af8191aed0ab51651c584c92da9f5ccfbd4b21ed040c15e63afe297a6a685f
TLSH
T16341256DBAE91108B3B76F5A9BF6A46E487FB9772F0AD05D10110D4E0A73A00D861B37
MD5 SHA1 SHA512 TLSH

Submit Download