hxxps://html-classic[.]itch[.]zone/html/17969337/index[.]html?v=1782266244

Analysis

max time kernel
899s
max time network
730s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 00:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://html-classic.itch.zone/html/17969337/index.html?v=1782266244
Sample260702-ag5prshz3s

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2144	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134274247330509722"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3047816590-610495838-277027736-1000\{3E512591-8679-4F06-A68C-4412F1C0A58C}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3047816590-610495838-277027736-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5048	msedge.exe
5048	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe
2668	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 2668 wrote to memory of 2372	2668	msedge.exe	88
PID 2668 wrote to memory of 4996	2668	msedge.exe	90
PID 2668 wrote to memory of 2144	2668	msedge.exe	91
PID 2668 wrote to memory of 3748	2668	msedge.exe	92
PID 2668 wrote to memory of 4996	2668	msedge.exe	90
PID 2668 wrote to memory of 4996	2668	msedge.exe	90
PID 2668 wrote to memory of 4908	2668	msedge.exe	93
PID 2668 wrote to memory of 1076	2668	msedge.exe	94
PID 2668 wrote to memory of 3748	2668	msedge.exe	92
PID 2668 wrote to memory of 4908	2668	msedge.exe	93
PID 2668 wrote to memory of 4908	2668	msedge.exe	93
PID 2668 wrote to memory of 1076	2668	msedge.exe	94
PID 2668 wrote to memory of 1076	2668	msedge.exe	94
PID 2668 wrote to memory of 3412	2668	msedge.exe	95
PID 2668 wrote to memory of 3412	2668	msedge.exe	95
PID 2668 wrote to memory of 3412	2668	msedge.exe	95
PID 2668 wrote to memory of 2996	2668	msedge.exe	96
PID 2668 wrote to memory of 2996	2668	msedge.exe	96
PID 2668 wrote to memory of 2996	2668	msedge.exe	96
PID 2668 wrote to memory of 3256	2668	msedge.exe	98
PID 2668 wrote to memory of 3256	2668	msedge.exe	98
PID 2668 wrote to memory of 5524	2668	msedge.exe	99
PID 2668 wrote to memory of 5524	2668	msedge.exe	99
PID 2668 wrote to memory of 2808	2668	msedge.exe	101
PID 2668 wrote to memory of 4304	2668	msedge.exe	105
PID 2668 wrote to memory of 3448	2668	msedge.exe	106
PID 2668 wrote to memory of 240	2668	msedge.exe	107
PID 2668 wrote to memory of 2252	2668	msedge.exe	108
PID 2668 wrote to memory of 2252	2668	msedge.exe	108
PID 2668 wrote to memory of 5048	2668	msedge.exe	110
PID 2668 wrote to memory of 4308	2668	msedge.exe	111
PID 2668 wrote to memory of 252	2668	msedge.exe	112
PID 2668 wrote to memory of 252	2668	msedge.exe	112
PID 2668 wrote to memory of 4308	2668	msedge.exe	111
PID 2668 wrote to memory of 1104	2668	msedge.exe	113
PID 2668 wrote to memory of 1104	2668	msedge.exe	113
PID 2668 wrote to memory of 5904	2668	msedge.exe	114
PID 2668 wrote to memory of 5904	2668	msedge.exe	114
PID 2668 wrote to memory of 2268	2668	msedge.exe	115
PID 2668 wrote to memory of 2268	2668	msedge.exe	115
PID 2668 wrote to memory of 2436	2668	msedge.exe	122
PID 2668 wrote to memory of 2436	2668	msedge.exe	122

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://html-classic.itch.zone/html/17969337/index.html?v=1782266244
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2b8,0x7ffa7878c188,0x7ffa7878c194,0x7ffa7878c1a0
  2⤵
  PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1552,i,8081834810025648345,1805345438789939346,262144 --field-trial-handle=2220,i,325283957015160123,16028124333589291430,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:2
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1884,i,2689632291933466580,4422593236000368332,524288 --field-trial-handle=2220,i,325283957015160123,16028124333589291430,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2488,i,10174966781766394141,4770636585775323782,524288 --field-trial-handle=2220,i,325283957015160123,16028124333589291430,262144 --variations-seed-version --mojo-platform-channel-handle=3404 /prefetch:13
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3328,i,13357538347898387667,11303287601528724492,2097152 --field-trial-handle=2220,i,325283957015160123,16028124333589291430,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3348,i,15191979409876738924,2866862695124659108,2097152 --field-trial-handle=2220,i,325283957015160123,16028124333589291430,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:1
  2⤵
  PID:1076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4284,i,3656545887116504235,4215583544726844216,2097152 --field-trial-handle=2220,i,325283957015160123,16028124333589291430,262144 --variations-seed-version --mojo-platform-channel-handle=4824 /prefetch:1
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4324,i,8514507249402015896,1638389439980467890,2097152 --field-trial-handle=2220,i,325283957015160123,16028124333589291430,262144 --variations-seed-version --mojo-platform-channel-handle=4828 /prefetch:9
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3696,i,10232793096822288590,12650879620827722438,524288 --field-trial-handle=2220,i,325283957015160123,16028124333589291430,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:14
  2⤵
  PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3720,i,7095586885178491169,17299303637312426040,524288 --field-trial-handle=2220,i,325283957015160123,16028124333589291430,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:14
  2⤵
  PID:5524
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,8760813474060964391,11826912295392770258,524288 --field-trial-handle=2220,i,325283957015160123,16028124333589291430,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:14
  2⤵
  PID:5800
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6088,i,8760813474060964391,11826912295392770258,524288 --field-trial-handle=2220,i,325283957015160123,16028124333589291430,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:14
  2⤵
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4968,i,617223513433787582,610034946723871396,524288 --field-trial-handle=2220,i,325283957015160123,16028124333589291430,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:14
  2⤵
  PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4316,i,9532816463017928167,15511542231283425771,524288 --field-trial-handle=2220,i,325283957015160123,16028124333589291430,262144 --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:14
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,7538835976253301512,16056015426245005767,524288 --field-trial-handle=2220,i,325283957015160123,16028124333589291430,262144 --variations-seed-version --mojo-platform-channel-handle=3312 /prefetch:14
  2⤵
  PID:240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5520,i,2196277341158806951,5811057244099200691,524288 --field-trial-handle=2220,i,325283957015160123,16028124333589291430,262144 --variations-seed-version --mojo-platform-channel-handle=5492 /prefetch:14
  2⤵
  PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6276,i,3275067903250274316,6898853824094016247,262144 --field-trial-handle=2220,i,325283957015160123,16028124333589291430,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,4185352843037145301,13702055107395555605,524288 --field-trial-handle=2220,i,325283957015160123,16028124333589291430,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:14
  2⤵
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,4145770004799404904,13441919160193173676,524288 --field-trial-handle=2220,i,325283957015160123,16028124333589291430,262144 --variations-seed-version --mojo-platform-channel-handle=1608 /prefetch:14
  2⤵
  PID:252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1088,i,13804733908029069462,6826013836437486308,524288 --field-trial-handle=2220,i,325283957015160123,16028124333589291430,262144 --variations-seed-version --mojo-platform-channel-handle=2056 /prefetch:14
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,12609952673810297642,11028255831029678862,524288 --field-trial-handle=2220,i,325283957015160123,16028124333589291430,262144 --variations-seed-version --mojo-platform-channel-handle=1824 /prefetch:14
  2⤵
  PID:5904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5384,i,18070132806381105187,17565313435129893459,524288 --field-trial-handle=2220,i,325283957015160123,16028124333589291430,262144 --variations-seed-version --mojo-platform-channel-handle=6104 /prefetch:14
  2⤵
  PID:2268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5484,i,7326019770814041635,8840420522557730270,524288 --field-trial-handle=2220,i,325283957015160123,16028124333589291430,262144 --variations-seed-version --mojo-platform-channel-handle=5760 /prefetch:14
  2⤵
  PID:2436

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5100

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5988

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1540

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:3500

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 2fd9384e79508a77111bb6310e9414898358885ca508610502ff6f1a15ad704f
MD5 714e68787bb5a6d2fd82139f833a5d0d
SHA1 f7a22adc92641d05515b3ae096da910924f11c1a
SHA512 b133f27abfa4ed5bdbd3eaf997e0664f0627537d4882fdaa63c0b1b301219d07f8ba46857db9a196b1210c29ed9f79e6cfd8c688d502b118a21640805665f762
TLSH
T16DD080F43795F605C786617357D0574173750872241647095051D01CCC645DD63DB1EF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 233c07bfff48b5fbad30cd7d90579abd0886400017cd6e7fb037e5626abb1a4d
MD5 71fa6328268340b183c55defa643c474
SHA1 7c004defb21dc2981b3091495c900e02b34e3a86
SHA512 e5b634d358633981cd343c3da26ee18738fb6c54b2334814637e0a9a45343d14770fed7a09c63d55dd190bf7ef111664ba5872f5d5ce925e6bee783e166c75b7
TLSH
T1D4D080F437A5F505C786617357D0574173650872101647095151D02CCC645DD63DB1DF
MD5 SHA1 SHA512 TLSH

Submit Download

5838928a-9fe9-4489-952e-44be05d907ba.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\5838928a-9fe9-4489-952e-44be05d907ba.tmp
Size 14KB
SHA256 f005f0afb5a2cc449b1431e590461d3ae434017c06a1697975189765fa1f7102
MD5 2990bde3a5d5c77fe7908eae879126fb
SHA1 2b8382a39a59ea5a0d0ed7470ba36e2fd6220b0a
SHA512 1d64be801bc8313c6d2cb235cbe52ec45aa69fff72eed766db20a8a50b254111898c9bc458e63de83d4e457fcd42074beba0e054cddf53a87b6223f90f43788e
SSDEEP 192:sxRuRYHyM/jK1Ml8wF4/fVswuiSdfCr2zoA8psE/g6+WNOiQ/YylJ7G7IgIJ:sxRuuxb4/fVswPS4rl/5s/xys
TLSH
T13C62FA1666245D3B8CDBD20DFA417F53D6F91573E2901E44AAFC8A0C01EBADD620381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log
Size 2.0MB
SHA256 0af9272a7ff288aaf6520c4cb4fb7e6f6f0cbe600601943bb57a734606b3304b
MD5 446a2f1c7a7dfc175fc25265a20ee6ec
SHA1 b47f87f6d9c035abe6292fc0acca9a5844dc9a53
SHA512 72e4b7132975d138039ee4f3490b0d74824df60619e6c89220d2956100d32ff5c16c11c4ddc0f4b378f3e2805b782139ae97c168fcd5a12baade6c408e8a88ed
SSDEEP 12288:y7aBW3x0WrE3MBjFBYAbTg7G8FZ3173MDEibtKByk75K+ZLo6t/GV48SsFz7ONrg:y7llJjo1MDEibtKByk758oOR1f
TLSH
T106A5FF4A8553FEEF12347C776436B4CDAA6807E74290FD2BBDFC857D9766AA80803250
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 6KB
SHA256 956999b209d0cbf25eb2f71612887d83ce7f4b324ecb9768f938d86dc92ee266
MD5 1957c5a05905f694557a60a222b1c9b7
SHA1 e4af59f3cd02927e26a76d018ed2cdfddcc137cf
SHA512 e364983f094ddb5ab5b8308e8393f3fb9b734abf23f7de9ce3a0b82330f132bb5034e74081048c1b366e860dd4ad0f96de22ec857b5f677d7d4c32e349a2b608
SSDEEP 192:sGjUBnnNNNN+++rrrVVVXXd2q6QdddffJJJJNLO:sGjUBnnNNNN+++rrrVVVXXd2qzdddffQ
TLSH
T146E1405382E6C29ADF0520CA49A4635C40F23B1BE7DCE508275DCDED314E5AEFAB56B0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 c9f8fbffa346aa6e3758d672b1a8d7317ff27c115711162712e57585f201a4f5
MD5 2e9c4fb42f217043c1047d50bd251978
SHA1 6a4a0fe8d2dffa8522a3bd2832c31c845abba999
SHA512 d534ba33ac444b5bf02673bd1c3b7e01e3a84d069640f68a29d4cf8495d30d7a7859265d9a96f1687b25a7854274565134e8a0dd60bfd99f1026c0e8f76a48ca
TLSH
T1C2E020D446C6D61D5511F8C742FC670C81C1365B92C469052F05CD4C7041540EFE57F4
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 5614bcede31c6395695ed8ec989853cc34260e3056c0abe4c3029aa3e4b5abf6
MD5 0a196cf7b2c4de8688debf82b27ad4a0
SHA1 4d41be166c139b5719e48bf6a0f769fa89c14e4a
SHA512 a0a751c2554c56eb84733a70e328c8676f43a3c1b3c1a25a485d7b066d742d1d561997d5c2eb003776cb06524666a96b7d45144c7c65578144c258dfdbf7c787
TLSH
T1A6613DC43C567A9DE32FF4B390D211AA37F4C2AD850B6A07D848B3B8483AB5478C2935
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59aa6f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59aa6f.TMP
Size 3KB
SHA256 6bf01a68219f5bc3764e596b99ee7663559b0606a1f07a5f9797f14958530a6d
MD5 d1c49e4f4c4f341c65b3e3881e73f2b6
SHA1 f0b5cc32661a2f93d563908d67b23d27d60cf873
SHA512 8bfc089cc4c98ef9ec07099b94eace69331cbe86c656d3478ef14aee237bc4f048cb43dbc6d6c2fc5086ae305b5e02fe3c8f961f539efca84dd87726ff5db3d3
TLSH
T113613DC43C567A9DE32FF0B390D111AA37F4C2AD850B6A07D848B3B84836B5478C6935
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 5d709ee97faceffbdafb7699433f49770e451d6df6b1f402eb3129e46718b5f8
MD5 92284b2858d640c33ceef578cd5d7656
SHA1 1ffdff72a8706af9df6174802d54c156c8067d37
SHA512 878bc6759f71787c1a329dc1cc4070abbb7f3bdc3029112959c042e3f32ddf0bffa9f453fa4a5ca88b2f4dd4e2ba6424a6390af25a1a4646fce310efdea4fbc9
TLSH
T18C71AEF7C3E88A2DC91155F0AB156E2BDE2D0514832C7D2AC9E4AF1BE3E2471E24165F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 9eb462117c7cd489123bc585e00455323233e43ec58a65b9cc9a38f8c3c375f1
MD5 d5f98f1b9923aab1f5d0255d4e6746dc
SHA1 84a87cf367c753ab3d862d98a752b08c6d22f070
SHA512 ec4eecc64b8891cadab9ed075f3c1a370cbb19092ee6231d9d261465830591a776ef3604464a0a7cc754b3cc2292c1f74f2a3d35b838b4396e065a990b2291cc
TLSH
T14171CCF783F4866DC91145F0AB04AE2BDE6C0414832C7D6AC9E4AF1BE3E2471E241A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 29KB
SHA256 44daef49583c31f2eccbf94b4d3900ff33c579d9f56c6138e3974b6787a94a62
MD5 f7a17e34002dd78eda1b061a2faeaddf
SHA1 5cfcf5e34f229a11ff7c8b0555cd7accfe9fd6aa
SHA512 7afbcae9209656d8d34d0e8db3267c814b631166f7038e76dd3c43437761397e30e026fe38d8cea852f8b870eed08d8a02029f27e1dce168b316c789c6c0ec64
SSDEEP 384:sxRRuOqk4/fVscu66s8qMpRiYnazAW8pZS15posJWeT+YS4rD/5s/ry1:sNik4/fvu4Mnc7WeT+V4f/5Or8
TLSH
T17CD20905A924C8778EC39D1CB57D7E33D9EC50526284DEDA1AECCA0C029E5FDAB47827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 9e7acdf22b02ffec5ccfeffcedc8e504de60cca170cbdba682efa448d4ac6337
MD5 ac4353e8d90d9f6ea93b6fb630c43e62
SHA1 e214792439f058584118a1d7aeb27e31b8f63a10
SHA512 166ecbfb88691c820290a057770d746f938748248b2830a77ffc66b9a347bcb92298dce93fa0f61e6e3401293e965354824ef2bc59eeca761b57104bf8ae5d8f
SSDEEP 192:sxRRRYHyM/jK1Ml8UQWF4/fVscuwSdfCr2zoA8pyE/g6+WNOiQ/YyXJ7G7IgDvJ:sxRRuxqk4/fVscVS4rD/5s/ry1
TLSH
T1ED62E85666245D778CDBD20DFA417F53D6F90473A2941E44AAFCCA0C01EBADD621382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 bd63e422f36f9819e215c6d2a0a5bf1d6791300964ffed22e0e1da9f6150327c
MD5 30f5e1fb9e3e7161dd0d83474dcb527b
SHA1 4ffa86769d6ef61fd7b5984fac87365635ddc296
SHA512 6ba116605c88877636f3caf33c56fac49ba84d980341f7004b5415644b7c571cba92a20e2df632e385be28b98b5d17f0938426018010737cc68124d2cd6a708b
SSDEEP 192:sxRRRYHyM/jK1Ml8wF4/fVscuiSdfCr2zoA8psE/g6+WNOiQ/YylJ7G7IgDJJ:sxRRuxb4/fVscPS4rl/5s/xy3
TLSH
T12462E9166A245D7B8CDBD20DFA417F53D6F90573E2941E44AAFC8A0C01EBADD621382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 132505a693b4ec604569677f6cbac503a552b419cd63bf6e49992d1d263df940
MD5 c2d172f97b3f1e3e1bad9c278221be48
SHA1 43e0b7037d038178da91fa77148b3c268880ddf0
SHA512 8b27edfea490222cf9e1e4a385d24511285b047646b95e10b164f2e33dcbcd0d78e91bef9dee1fb612d19fbae8a10a2fdafc105bf96a25f9b67edabd6d411fe3
SSDEEP 768:AIox30WguMfnA8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOcciuro5Klrp:AIox30WguMfnAu1jazXil5Kb
TLSH
T101C2EB3F640CC77E4F845E9CEC25AE966DD801CB97988D5447FA890C03CB7EB921A4DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\7810cd6c-c4d3-4ed8-a03b-461d0290a487\index-dir\the-real-index
Size 792B
SHA256 ee7255ffaaab50cc43c75ac5478d4ada463a9995f94e40e7931b0b0758f442d3
MD5 543c4ffd1ed8aa5e46cc8b77f3955ea9
SHA1 ed80abfc14e3168d046d5cd144134c8b0c247ea9
SHA512 904a672ae886ab7347038d5c1f743118b0ef2374615637ac81af0add802c85e5c354fee797a4d297ff004405d9ddb61e249313ba385060b7053f28a854b71748
TLSH
T17B01ACA2DCD22C03EE1282B72936E00C23AAA5EE35449607216CB93D8A53569695069C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ded12.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\7810cd6c-c4d3-4ed8-a03b-461d0290a487\index-dir\the-real-index~RFe5ded12.TMP
Size 792B
SHA256 1ede7caed4ca50ae43d4f7f5f84388e69ca24ccf79128c17fcbfacb0db66a7c5
MD5 18b98f3df3108d1360ac180683e03c7d
SHA1 4239fc51fa70312c590135a06be719387c5ff66d
SHA512 4277897b68d2d31057f8b83ffe787ba12f976c626588036e172391c0a22babd2ff79656d82fb1a6fd09b5964c1ed19c03a0a00fcdff6e10905ab3457838ea302
TLSH
T15301819645D15D43DD01C5B61E07650E33BBA9707344DA0710E9B47D4573A3D665119C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 3daa28980d0d1522c6dce49426feaf024bfbb71cef64f84e52498310da327514
MD5 d196fc952d1397d3f6cdd2fb2d46fd6f
SHA1 644f1fdb4247ad8f0849526ada1896607da389f9
SHA512 4647cb325c0eb452833e285963a1d3b9499d0124b444b2b927814403d7a4699f4009b9e0ed3b64fe77cad93c7df9c50743caa1266b6ad941d766bd2689f3613e
TLSH
T167E0C0771EE7082CE85FCFDB2471D4A501847934D645AC4E402FD3C300FA3013489C12
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 3acb8b8016124ef10d94e9a6e27dcd1111e8ca36bea4fb24ffc5a3b00d62e883
MD5 7edd9e2a27899c2b9c0efe41d714d599
SHA1 4ad8277a831d020189aceb18d06720ea21a98c6c
SHA512 acd148e7404943bcdbbf207f473f7237ab3753ba4e83c1ea913a4b32da7f78fa12ca936a2a38dba50ac111d7e44234c2fa59aed33a8c248b04c215a73f64e90d
SSDEEP 96:KHyruiQEYkoEJPOqkKGBO4kaCipQC5KEQKFanDMpdLBB9WV6wgF9K48gr9cTrC1C:kyruiQEYFEJGqmBO4VCipQC5fqDMpdL6
TLSH
T174914251747E2700387E651D86B8F82B428270E230A9747B77A865921F67E005EFEDDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

2a570094-0824-4a76-b08f-b3cef7c9f3cd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\2a570094-0824-4a76-b08f-b3cef7c9f3cd.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 d031f880edf7be219c2d0fec6849560a1ddffa62baa0ba339300167ad4574495
MD5 cc75947404514fff48c6790a8b5e637c
SHA1 528692aca40230337e4e87a4296dad9f124de1c0
SHA512 3e99fba109889889c3b5b28ac05504a0912123132b3a88b5729d0a430e4370aba4354009c9272165ff3d7c505b3caf1f5fc65d153d6e9fabdaf7ceee53d16368
SSDEEP 768:xrv+4UNbdf3zwK9QOJIh0Ngahk/hUAFjQIMyOV3N5E9ElhB:xbsbN33N0hNFUIpONNmWB
TLSH
T19703BF72B868EAB35DF7E2C5B60672437FF8416745C50A84C9EE6B0D428B1DE134BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 dd6a85fd099b37eb8939aca687d5c27700c030809fdd69f75ef9a14e7e85e74e
MD5 830ea60a7b880bd01111fc2b2e63256b
SHA1 3f69d82188d4cddb9929286de0f0b285dbeea54b
SHA512 81727ac26ceed25836931eebb8308d11da643569947063e4151ecccfb0c78aabd43fd52f35959870c7e50f4565ad28f7e89db86acfa6ecd49f24f5f698be0dc2
SSDEEP 768:Mj+9Z30w99QOJIh0Ngaht/hUAFjQIMyOV3N5E9ElhDl8BvTPadN:L9Z3ZNZhNFUIpONNmWDl0Wz
TLSH
T111F2AE71BC91DEA74CE7D7C9B30662876FE4027745C52E848AEE6B0D028B29D134BC35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 89296a5a07b02ffc4c2097bd4f82ea2604fa66ed1baafcfdf5bb962775be36ff
MD5 048f2a209580667728d2303704f3572c
SHA1 db064d9b9741d302454871aedc5e073342f48b76
SHA512 0bb6f08bb6dba6c9e148247864fa667a67eca60aab1761e33382d22728494345af9fdbd03211e93d4c7ec8d2549b5e050d6e6072029589ef030ce0fd7616a30e
SSDEEP 768:qj+9Z3zw99QOJIh0Ngaht/hUAFjQIMyOV3N5E9ElhDl8BvTPadN:J9Z3CNZhNFUIpONNmWDl0Wz
TLSH
T1BFF2AE71BC91DEA74CE7D7C9B30662876FE4027755C52E848AEE6B0E028B29D134BC35
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 42KB
SHA256 fce47fab8582127b0e74055875d63dc17feca061905e20d3b152c9863a3b28d5
MD5 bc5711e638395799584f7d7076826536
SHA1 d7b285c1cf11419d8e66f78ea16c0abfb4bbcf9a
SHA512 a3da28d2e0344024329503bf097b7004318969706fe675d2cce40285bac47f1a0abdde3c1f614fadf8c8028bcfc2997ea74ce6f144f42274f0bc372df5139d9f
SSDEEP 768:MyF1j+9E3YwgVwt9QOJIh0Ngahy/hUAFjQIMyOV3N5E9ElhDl8BvTPadN:m9E3fNmhNFUIpONNmWDl0Wz
TLSH
T1B7135AF2A8C38A76D8AE9787A33D2D425EBCC16774842940B7DD5A0DCD462BFC247C25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 5394356245af70ee912903c0127e1bbd8872ca5f1e0c594b299c1c74e5e0c6f5
MD5 8f5630a2f2821ea530d55f4643d2d36f
SHA1 3993505cba6aea7145b191cee0a585324ccb4ed3
SHA512 0fef4429c29df6925d31af3a11c8f159da45fc860bb1ef5d71e39eb12bf46af783146b54ec7a9294de23367dfb46c78b59920dcf22426f070640eda5e2208c03
SSDEEP 768:9rv+4UNbdF3OFsQOJIh0NgZ/hUAFjQIMyOV3N5E9MPo+8r0mL:9bsbf3tNYhNFUIpONNmlDrv
TLSH
T1EB03BF32A8A4DAB39CE7E7C5760A72437FF4416755C10B84C9EE2B0D824B1DD230BC66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download