hxxp://www[.]weg[.]net/pe

Analysis

user interaction
yes
max time kernel
268s
max time network
270s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
01/07/2026, 22:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://www.weg.net/pe
Sample260701-12leqsgy21

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3468	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134274173387884059"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{A5F9D6BF-B81C-45A4-85E8-E07053D86D6B}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4932	msedge.exe
4932	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 4304 wrote to memory of 1736	4304	msedge.exe	84
PID 4304 wrote to memory of 3216	4304	msedge.exe	85
PID 4304 wrote to memory of 3468	4304	msedge.exe	86
PID 4304 wrote to memory of 3216	4304	msedge.exe	85
PID 4304 wrote to memory of 3216	4304	msedge.exe	85
PID 4304 wrote to memory of 1492	4304	msedge.exe	87
PID 4304 wrote to memory of 1492	4304	msedge.exe	87
PID 4304 wrote to memory of 2852	4304	msedge.exe	88
PID 4304 wrote to memory of 4732	4304	msedge.exe	89
PID 4304 wrote to memory of 2852	4304	msedge.exe	88
PID 4304 wrote to memory of 2852	4304	msedge.exe	88
PID 4304 wrote to memory of 4732	4304	msedge.exe	89
PID 4304 wrote to memory of 4732	4304	msedge.exe	89
PID 4304 wrote to memory of 2352	4304	msedge.exe	91
PID 4304 wrote to memory of 2352	4304	msedge.exe	91
PID 4304 wrote to memory of 2352	4304	msedge.exe	91
PID 4304 wrote to memory of 3348	4304	msedge.exe	92
PID 4304 wrote to memory of 3348	4304	msedge.exe	92
PID 4304 wrote to memory of 3348	4304	msedge.exe	92
PID 4304 wrote to memory of 1312	4304	msedge.exe	98
PID 4304 wrote to memory of 1312	4304	msedge.exe	98
PID 4304 wrote to memory of 1312	4304	msedge.exe	98
PID 4304 wrote to memory of 1936	4304	msedge.exe	99
PID 4304 wrote to memory of 4848	4304	msedge.exe	100
PID 4304 wrote to memory of 1936	4304	msedge.exe	99
PID 4304 wrote to memory of 4848	4304	msedge.exe	100
PID 4304 wrote to memory of 1100	4304	msedge.exe	102
PID 4304 wrote to memory of 3320	4304	msedge.exe	114
PID 4304 wrote to memory of 4292	4304	msedge.exe	115
PID 4304 wrote to memory of 3864	4304	msedge.exe	116
PID 4304 wrote to memory of 3864	4304	msedge.exe	118
PID 4304 wrote to memory of 3864	4304	msedge.exe	118
PID 4304 wrote to memory of 4932	4304	msedge.exe	120
PID 4304 wrote to memory of 992	4304	msedge.exe	121
PID 4304 wrote to memory of 992	4304	msedge.exe	121
PID 4304 wrote to memory of 1588	4304	msedge.exe	122
PID 4304 wrote to memory of 1588	4304	msedge.exe	122
PID 4304 wrote to memory of 2284	4304	msedge.exe	123
PID 4304 wrote to memory of 2284	4304	msedge.exe	123

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://www.weg.net/pe
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffe392dc188,0x7ffe392dc194,0x7ffe392dc1a0
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1868,i,8233653224411666664,13711384970232579882,262144 --field-trial-handle=2276,i,14644018055839332184,2935933229324119927,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:2
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1972,i,18020028815092167223,8812352405272784601,524288 --field-trial-handle=2276,i,14644018055839332184,2935933229324119927,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2564,i,8559604413847783696,1744265149331727703,524288 --field-trial-handle=2276,i,14644018055839332184,2935933229324119927,262144 --variations-seed-version --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,18081644380715437414,15670779690124813514,2097152 --field-trial-handle=2276,i,14644018055839332184,2935933229324119927,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:2852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3420,i,1227968439893755950,3563174414812795280,2097152 --field-trial-handle=2276,i,14644018055839332184,2935933229324119927,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4156,i,7365075260647096409,2673265526628038718,2097152 --field-trial-handle=2276,i,14644018055839332184,2935933229324119927,262144 --variations-seed-version --mojo-platform-channel-handle=4452 /prefetch:1
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4168,i,8359688480859885344,11199760419181450747,2097152 --field-trial-handle=2276,i,14644018055839332184,2935933229324119927,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:2
  2⤵
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5004,i,968193262088809939,4818125899378320607,2097152 --field-trial-handle=2276,i,14644018055839332184,2935933229324119927,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:1312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3568,i,4486320033853740938,769897308162527368,524288 --field-trial-handle=2276,i,14644018055839332184,2935933229324119927,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:8
  2⤵
  PID:1936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3564,i,602654753774322092,9255994143361280268,524288 --field-trial-handle=2276,i,14644018055839332184,2935933229324119927,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:8
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,7964410003977797471,5062413734533152828,524288 --field-trial-handle=2276,i,14644018055839332184,2935933229324119927,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,7964410003977797471,5062413734533152828,524288 --field-trial-handle=2276,i,14644018055839332184,2935933229324119927,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  PID:1100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=120,i,6049332913743010075,7186238565085288703,524288 --field-trial-handle=2276,i,14644018055839332184,2935933229324119927,262144 --variations-seed-version --mojo-platform-channel-handle=4604 /prefetch:8
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,13615026705222452612,3578035704050817407,524288 --field-trial-handle=2276,i,14644018055839332184,2935933229324119927,262144 --variations-seed-version --mojo-platform-channel-handle=4968 /prefetch:8
  2⤵
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,15969421079240869225,2268343950077245167,524288 --field-trial-handle=2276,i,14644018055839332184,2935933229324119927,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:8
  2⤵
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,7541121393899056560,15066795022236846779,524288 --field-trial-handle=2276,i,14644018055839332184,2935933229324119927,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:8
  2⤵
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4176,i,17764455669322615511,8385500460496812789,262144 --field-trial-handle=2276,i,14644018055839332184,2935933229324119927,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6092,i,17356506954302533845,3099419903218344732,524288 --field-trial-handle=2276,i,14644018055839332184,2935933229324119927,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:8
  2⤵
  PID:992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3628,i,16093183826885665344,16808160096024917162,524288 --field-trial-handle=2276,i,14644018055839332184,2935933229324119927,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:8
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6512,i,12456725597601260834,14229963065275277163,524288 --field-trial-handle=2276,i,14644018055839332184,2935933229324119927,262144 --variations-seed-version --mojo-platform-channel-handle=1836 /prefetch:8
  2⤵
  PID:2284

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2768

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 994380ffd288a5f1a9acc9eb76a487a55b12cc1daec839d811240f6cbdc4da3a
MD5 f5ed4946834be586ac6410ed88740a7c
SHA1 6108ce368e8b3bb8012956bb25606c3b16835c7b
SHA512 76bf60b37c50422ab125edd3da70629e685408a106655a9b7e5cb6aa7b6a9000c76d8ac2f5dc85e58e893b61bef9b539b9488ac894f1fc1338a58944dc9f4711
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P77:fwUQC5VwBIiElEd2K57P77
TLSH
T1E5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6d0f88884e23b1418c456620b79662feebdfd970ca9325ba2981c94b3b0f0b2f
MD5 7060eae8ec426d15de2849b1f7d261b4
SHA1 b252d90b9d7050d0b9b7c03141d9d3b7cae404ac
SHA512 8791005fae20dc1dc5dc5b0086efe814e0b1e36781ef1931cc1fc699fc4cb34d62ab3f9a83f4967824f3bb71aef6adc6ad457ab7a6addcba99f9e9b473eabb4d
TLSH
T118D01222BE08A415E65BA271A502C7141F5954A124938651E224D86CD9F84D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4d517b88a0fb88494276c126764235de9ee52961c86cc4d3abaf517b10a649a8
MD5 dde9ea8dd9c7e315ef614ab3476af02c
SHA1 e03e201e89770d15b4040d579c2cce8684959a2c
SHA512 410e016336529d709de957d44e67238e4f6592b9ce6646395a9e45ce592e7810b4cb6b1b6df5d8b26875a6aa235b77d41c0983ccc055556f8b8c02224093fdd1
TLSH
T16DD012227E08A415E65BA271A502C7141F5954A124938651E224D86CC9F94D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 7948a97eef1387cbdbe98d0face12a438c64ff6ae309eba0962cc93ab25fdd25
MD5 1a0df1dcfeeb8d787d69815059c0bdef
SHA1 a688971e8b3b28048bf3bad4f308c14d7a849c58
SHA512 a700e7deba8a42a905d0c3acb00dd63a64454dfc422c47f74623896d960f4a32da25150b31945bf9576b144f377f26cd6439c1f705e2e2d0134e7fcf13596fc7
SSDEEP 96:Ena1McKZDVS2TvgpngaKtt5vyVnCH9nlF64RXiXLQztzACiVahRjgrvQXTD2OZ0d:gdFxvL5iXLtVuN2d6Bw
TLSH
T1C4C1A7B441A62A94DFC84F31D0CE0E063F7019E9FEFB6FAF8C94247A9726785580B425
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 7d91aad1e8b3b5f171919d2220843f97d9b2766bd0c6a6040e516cbe8551ee95
MD5 95fee89cf14d2cac31adab5c81f9509d
SHA1 b961af86aa6d53fc01a939b9132aa6580132c442
SHA512 842cca948432d5ef0e89898aef536b5c9035c078f6827ad73e86624940338f268850cc5f527b26bb9f51e04d254b3d0895e14f226bc0010fc329b4c6d535d186
SSDEEP 96:SUeE7bXmKsDVCt2HgpnCQtt5iyVnCPKnlOM43XRXLQFtznBiVaqRjgrHflpi20m5:Xn3iokRXLHVd32rN0S
TLSH
T192C1D77449A628D4DBD80F31D2EE0D063FF019E9FDFB6F9F8C8C24BA5226B451416815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 7ea341df567778a6b2a4a8ad2022ff7bdaa0db9bfa22a315429431d9c8478c46
MD5 6b1f3bf0f30aa072c205f4bc67bc3bce
SHA1 cc93329903a6bed37342832177cc6a05f1f6c68b
SHA512 26373e4a98812a18211785b56cf85aada2ae8ae6292bb8c531293beab94a6a0f658bdd5c5dafe73531f00e6a9ec7a7ddbd3a6a80c0aedc2130bf9c0cd2ba65bc
SSDEEP 96:KBugLz8vK6V4VPiVanahgonZ8jgr/JttcWy8Ou2Anp9FV5XCVXr2acJyprB2h:jpVE7WL7LzPypM
TLSH
T11391A3B4414B31D8DB888F3090CA0E093B301AE9FEFF6F9F5D8424BA9739355045A868
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5895a4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5895a4.TMP
Size 3KB
SHA256 050f85feb6f51b3e9ce13dc03159c7aae0ac518747b0bc271ba3edaa752620ca
MD5 4da826a2cbdb0178067037d705bc7925
SHA1 09886a135db8def8ae3b56bb92184639607d0296
SHA512 bb11bb21d6157bd4bc3aebf84afe85aaef2f1349a913b1c2132e516d13ebac9936b99627867354a875d71ace1759ae6aafd303e3aaafa6111da7ce1109a94804
TLSH
T1AC81E6B4820B35A9EB0C4F3190DA0D5A32306AE9FDFF3FAF5D8424B98778355052B468
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 9dda64d2fe1deb708a02c9eb397c2960499190f279ddbb753254fe0a417e9627
MD5 4ddb3567e45efb7e9fbc0866948c4f91
SHA1 7f2f3132085a92276dd28d30f4aa92ae30c78f9c
SHA512 2b39200663d32cf75d7f495ac6cdf110d348080c1c36972a74ed3fafacc89b4e2c7fc078fdba6f95552475ffd441d1a0a1505dc4d61abbf68eed06571ff4b3e1
SSDEEP 96:DzO+ut2eYvDXBTxbzlKx6cZRxSGwDowxFJihjNUR3xuOS:DKrt2eEDXBTxbBKx6cZRxSG6owxFJihN
TLSH
T1D8C1BCB2C3E5426DCA1152F0AA542E2FEE5D094743343D5A88E4EF5FA3E1571E211B4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 4f4df7fc7d042a22f7ffe970f3359fc03ec6b8a00d4166805337bc196441415f
MD5 193418d74cea1166112e356f687e97bc
SHA1 1895dc2b93c7de7bb6a3415d9a51c87cf5fcce85
SHA512 09f53a4c57c0ce3e01ca77a6df7f0080b89e9d0aa68f3ad027709a6cfad51b65241de0af24a5e82afd77cef81534ab99edd7315ce3ec31b872017c162e001685
SSDEEP 192:DKrt2eEDXBTxo+x8BKx6cZRxMoHpRVhpx+15RT+UoxuOPVfkj6px:DKrt2eEDXBTxo+x8BKx6cZRxMoHpRVhF
TLSH
T1DAE1CCB2C3E9426DCA1112F0AA543E2FEE5D084743343D5A88E4EF5FA3E1571E252B4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 e3823f18069f75259d362563bb9dc7446716ec113f16fd1e37b583c22b04a7d1
MD5 423390597f035053537471ccb9adb368
SHA1 21eb02bcf5221c85fa06fe2b8153a02cbe4d273f
SHA512 bf117596976a6b1003cfb429a170bcd309f1595e5ce441f90e59eae82b0c462aa063170d3cf0a66e57bb2897761753b35f4508c7c0b04c7ba22078af2a3914d8
SSDEEP 192:DKrt2eEDXBTxo+x8BKx6cZRxu6oHpRVFqpx+15RT+UoxuOPVS:DKrt2eEDXBTxo+x8BKx6cZRxu6oHpRVJ
TLSH
T1FBE1CBB2C3E9426DCA1112F0AA542E2FEE5D084743343D5A88E4EF5FA3E1571E251B4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 7b68c8a6ea798f9e47007bc515263ff1bdd8adc8a7f13fcdabef767062ac3ccf
MD5 0b7934a48600c5d8ee7d7426f8c4d2d6
SHA1 49baa1720670698357efcd720c0e90b8d4c26db1
SHA512 5c6ff4233c0d59e98127ad467d740b03f692510a20a75c979ae3b0310f9c0d8263c14a9681e50dc49d3deb563bb945a85d1bbb421dd2a5eb0df76eb54c39a3da
SSDEEP 192:sxZgRCyM/jK1Ml8MkH/ffsuJ2YKVBIdpvFHW6+WNZk9/Yv1sjHXxIgrJ:sxZgAMH/ffsukYfdHbu/F399
TLSH
T11A52D9126A349A7BCCDBD209FA45BF53D6F51462E2901E44AAFCCA1C05E7BDD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 79fba7dff3904589a96a1419c26c1139c7b4d861e7c8687349355fa33a015746
MD5 8fae6cd7524d062c0acb1f41ac9a1680
SHA1 83635739bf21a3221a0155d8c02d385483f6bf00
SHA512 ee5ec6a83640b2b97257572ec20c84cdeceb7c0310bdfa1b0c0d84d9f6ba5647cafc1027704504f1c0ac01da43c36f86731e095c706e82f5006552d376903377
SSDEEP 192:sxZgRCyM/jK1Ml8UQzckH/ffs0JtYcVBIdpl4HW6+WNZsDdYv0LjHXxIg5lHJ:sxZgAqznH/ffs0HY5GHbWdp391
TLSH
T1CB52C6166A349A77CCDBE20DFA41BF53D6F51462A3901E44AAFC8A1C05E7BDD220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 46fff5a1d077eeebc3cce711b8fbfbcc9b7417ce42228c76864990da6a0b116d
MD5 622fe7946d7b1d79c5d8acd5bb9571d8
SHA1 d67c1da18012aa7b690e2c185f11a6f7ebdababa
SHA512 b869484503d02122d875167ddccdf51e2df529197af42802e18cc1cb90924ffcae6c206084c2c0abec89c58faf1f388fb5257bbbd9950c7c2d50feba2f200f0d
SSDEEP 768:8qseJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0ppPro3jO:8qseJ3xWvhfynu1jaVcL88pc36
TLSH
T148D20A2B280CCB7E4F844E6DEC2A6F966EE801CB57984D5487EA980C03C77EB51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 4927225490f50b4f078c18d553fb1e78815ff5f32281c2ee1855ac200243150b
MD5 f7ff4fc6501bfa76ce9dd6bc8e24771e
SHA1 3a83d2d4566d01d36f338c0e42f023ec59e211f8
SHA512 9be8ae9c175d8b0daafc5d6e524af2072e46d2845d7b71ba25e3199d6c9abd50b0e8673950f15f8a88df827e8ab2f4498b66c120d5d4022266db1d82e939f246
SSDEEP 48:KYHIhKggkXyFjIBKEYcXyBuIXKTagMklQUuSz:KYH+Kggm2jGKEYGCusKTaZklQUuSz
TLSH
T12E91F457343F0202387D294CA6A5A9369E4271A37454A4FFBFB845624E27E224EFCCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 1KB
SHA256 0f1a8a59be0bdd0debb9d8d18d790dfa41f6863d8b96cd212c7ebf163bdedb50
MD5 c82229296b50615f5669ce3733a49800
SHA1 a41cbeaf8a712b46bc825764f7684acf3881328a
SHA512 717dfe30cffff34f99b0fe0f5ab591c6add3d14f48f2314e919e3b1c19f2dc0ea1f67e700f72cc909e3219e84af6f7f89ddc93627e9c78d7c241f02b3d66844f
TLSH
T1C521A5D1A3EB14546E8AAE41C20EA403DCE53FA7210D28712BBF46F21F84C164F2FE61
MD5 SHA1 SHA512 TLSH

Submit Download

ac7bc633-0f00-407d-8ed8-6994c9eea763.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\ac7bc633-0f00-407d-8ed8-6994c9eea763.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 36b58633c2a23f2b19de48f9b63d373ff9f84b64a55603e12a4a67ef00a3d989
MD5 225fb4c184af97e6e2ff8b4071226929
SHA1 6bf209e2327916c8168f1859f30ad70a38e4e97f
SHA512 002362cd7d2d9d6cda6e7fdd85ee28ab2101054ac9c5438b339ebcf730394bce82baedd3e3a057a24ee1045d1405870b098af2ea70bdadb8949c22859fc9d2c4
SSDEEP 384:1iF1tNn/s3n9SUCsNx8TUNTUlIlim73fgFJI5KGATlLXw:8F1j+92cwgBrAulATlLXw
TLSH
T1FEB208F358D7893AD9AE9743B77D2E024EBCC167B5805A50B78C5A1CCC861BFC30A915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e7d83b96bc0140103a6099965c1b143f922b073bc230d4b0f3096bf9bd52685a
MD5 8a6ab657fc6bc28bfa3b5c816ef6201d
SHA1 0c0ea6452c778a7ec400cd2a83e635a8c4bd273c
SHA512 9f125c05875671b09fec24fdee55d16c090dc571060ee787af45b3e78b385fd789c2ac12f71efc651a8abe9832caa4d5374ab2be238b8ff4050c6acb2a04fbdd
SSDEEP 192:lONny6vMtPQmiUykvThThcC5KZ847TztU/u:lONny6UtR7TD5KhThU/u
TLSH
T1AB020976BC786C7BEAA3BE45F48E27171FF4516BA5905B40EAE82F1C00D765C2307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 2b8625130685b61e16dc7c8d51508a72fddbd0de48a8a0767d38024ae4ce2dac
MD5 ad48a83f5ce994d217d71f255c36b0d3
SHA1 dd3d332ee34da9ab6bf08b2aa5cd16b43740599e
SHA512 ccd2a57bc2dacb740683cfa2fae49c997194620c74c13c12b11f28a54f70f88edf86a62780267014035ba7f900269c8315770d5d3fee992229b72849c498e7a0
SSDEEP 192:uTTSNWMsnMcPPQLz3XX9Vo2sNPjQLqoLKEmM70afgQmiU1uq0G4MThcC5Kopr8zI:ktNn/s3n9S2sNPjm73fgYJI5KGITlLXw
TLSH
T17F625C726C286D2B9CA7E195F58A37075FF4916B92C46F40E9DC6F1D01DB2AC030BA1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 76a0e714a86e2515b445251fb9c56b0b38de62673b7d0ddfe80de169815f79cd
MD5 2990e87da92876c328d1ac3a42cb21eb
SHA1 fdfa319e1a66f84895bf0226112ebd24b745525a
SHA512 11f1697be8b06120d440e5c55b53ab41262993d92382e6d4d9dda6247b2c408f7a959067478b1b4fe9630a1ad70f87e7e4ca125b34ef4ee3928da80efe3d981a
SSDEEP 192:ugTSNWMsnMcPPQLz3XX9Vo2sNPiQLqoLKEmM70afgQmiU1uq0G4MThcC5Kopr8zI:ltNn/s3n9S2sNPim73fgYJI5KGITlLXw
TLSH
T1B9625B726C286D2B9CA7E195F18A37075FF4916B92C46F40E9DC6F1D01DB2AC130BA1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 539fdd1d186894fa3e5731cfcee18368e9b5aac9abae4877cd7eb26817fa7e23
MD5 5e0bdb5367d159da45fe9eedb2f84415
SHA1 2c8f3cdceb6fbaabd84659a1cb08c7109bac12c4
SHA512 7eecd0aa32277d2f9d5cabaadb536d6992dfae242b7c4019805648c0765ef8264b325b33cbb62378563be374a0efa295edb392cd3c94e0547e6bbe48e1339b23
SSDEEP 192:tONK6vMkPQmiUyPvrhThcC5KopN80ITlqmLU/u:tONK6UkRCrD5KGyTlLU/u
TLSH
T1A1120A72BC64AC6BADA3B141F48A32031FB4916BE6849F50EADC3F2D01DF56C130B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 b8382f84704d7681a2086f585a0178b4a32e74a45acfbad494b51279fbce64c1
MD5 9b8d2953a495335ab30b8916bcb16233
SHA1 5e02dd94c155ac2d31f15dd719f2d289cd07b3bf
SHA512 e8eb0b539bad19b08df52fd336b69c8b42e5eef3ddfcc1293e9282121c45545f96c4e535eceb93df38999539518dc75bcbc0349ea400cab798333e988d2174a6
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 c60d9a2baa9a12649eeca4ac27439ac7f745c78ff931e894c6e8958d090e2457
MD5 97f8354848fee78b25fa1c72998d98f4
SHA1 0400d17abb28e13112b8e6c527bdafa1d421b929
SHA512 64a2d60a8aa397445cfa6d397b0ef0668bd81c861d11d319925b98c84c42364596e94ea5309c0c1937e27a05dcba91590d07b3fa4192b5ecc1e1598a87e971a3
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe590332.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe590332.TMP
Size 392B
SHA256 d44d91fca72057a23241dda04749731376d5c43e9a3284d49e3cfcce10abdf00
MD5 863969e04907da685ecb25ffb629cde7
SHA1 1f442b04e3f1578ead52b7965f1a0f73ae098648
SHA512 bcf84d048020c66474a67153cbca43392020d072159ff8419bc6e1a4c207b12506c22fe7b902871290cb4234f5a514662cc8635ceabe0e79501650b187b4d738
MD5 SHA1 SHA512

Submit Download

VariationsRuntimeSeedV1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsRuntimeSeedV1
Size 479B
SHA256 df971de1d83c4ec8d8a5317c7da912d8feaad9129307ead7cac91d8819c039d1
MD5 60aeec055cd3bd04b686b14115275140
SHA1 226ad5a7a3c53e4dbc2166906cae70250583b691
SHA512 0567a6078a9f2c06a9054f75a9bf6b745ad3e3735d4b341e44089627a2e31febb2df182dfc3b521cc3bc180bae5d381bff6248f2806a7339a8f3037dff530336
TLSH
T115F0544E8C2EC994FE0955F500D5C3732415AC408EB55E7D6D0856D364861684CC9752
MD5 SHA1 SHA512 TLSH

Submit Download

VariationsSeedV1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsSeedV1
Size 2KB
SHA256 f834ed40bc36cdadaac75a52ae8f4c164177f2f259148e3bc8f3c2d0b9a80d2d
MD5 170d8c7d4128e1aeccad388389d7601f
SHA1 22220a956abc19bd5a9205921526924d038c05e0
SHA512 15b9be8785926e129f69bfc6dca43a43c6f3cf433055151207ed86708dab1947ca1af740e11dcdbe3e6f324e1d3197d7482d8ed1e91bc4763d4c0a62c0c730b2
TLSH
T101514A0B1E7316BFC6C4EDA004866E5AF27A4F480D4AB5E855C7AF3A9970238CA8440E
MD5 SHA1 SHA512 TLSH

Submit Download

d57bb2ec-3c4d-4555-84de-c9cde10ce833.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d57bb2ec-3c4d-4555-84de-c9cde10ce833.tmp
Size 11KB
SHA256 fe261eb026654c8d85168999f8017f1bb4096a3643324b5567bba6cda75bba63
MD5 e13cdcf033909bf507154a4c3d6e8e35
SHA1 8fa354ad2c007a7af6794bb4b6e9dcc5033f84b0
SHA512 bee0191cf87554ffb55fd3bbc1aaf2a9bd81c24f98f97c59f520375285ba07d08f3bd55cb15517645b9c18fb0977267684cdb8c214ef17a9d1658f2f0c372e35
SSDEEP 192:uTLsNPmQLqoLKEmM70a4QmiU1uq0G4MThcC5Kopr8z1TlqmLUMZ:MsNPmm73YYJI5KGITlLUMZ
TLSH
T15B423B72AC685C2BADA3F191F08A36035FB4916BD6C45F50E6DC6F1C01DB6AC130BA1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e457bdc7-70ef-49b6-bfaa-9fe679f979c0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e457bdc7-70ef-49b6-bfaa-9fe679f979c0.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 8c5195f22cba03945b2c21d54e624f4515ff59d72a8e08776b0982c6699edbce
MD5 96eeb77e70aea05721f673b0c3584524
SHA1 4fe575a76ffcaa5a17f6505fa20121090876fc4c
SHA512 4c8500aa50638d20aa3792760a166df9a0f973e53d239a12c251f98f682cb5ae6507843b375925235b023c9eee94737c3e8a1a9325705acdaac11a370d4e9525
TLSH
T17641485CB6F91108B3B76F5AAFF6A46E487EB8772E46D85E10100E4F0A62B00C971737
MD5 SHA1 SHA512 TLSH

Submit Download

memory/1100-312-0x0000016A6D900000-0x0000016A6DA49000-memory.dmp

Download

memory/1100-311-0x0000016A6D900000-0x0000016A6DA49000-memory.dmp

Download