hxxps://0af21ca4[.]click[.]kit-mail3[.]com/27up84n9xrfoh8pdg9lt3hg98703vbghvw9qp/8ghqh3uovn6dr8ulu9/aHR0cHM6Ly9hcmNoaXZlLnBoL2h0dHBzOi8vZm9ydHVuZS5jb20vMjAyNi8wNS8wMS9hdXRvbWF0aW5nLWdlbi16LWVudHJ5LWxldmVsLWpvYnMtY291bGQtYmFja2ZpcmUtbWl0LWFpLXJlc2VhcmNoZXItYW5kcmV3LW1jYWZlZS10YWxlbnQtcGlwZWxpbmVzLWF0LXJpc2sv

Analysis

max time kernel
148s
max time network
140s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/07/2026, 01:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://0af21ca4.click.kit-mail3.com/27up84n9xrfoh8pdg9lt3hg98703vbghvw9qp/8ghqh3uovn6dr8ulu9/aHR0cHM6Ly9hcmNoaXZlLnBoL2h0dHBzOi8vZm9ydHVuZS5jb20vMjAyNi8wNS8wMS9hdXRvbWF0aW5nLWdlbi16LWVudHJ5LWxldmVsLWpvYnMtY291bGQtYmFja2ZpcmUtbWl0LWFpLXJlc2VhcmNoZXItYW5kcmV3LW1jYWZlZS10YWxlbnQtcGlwZWxpbmVzLWF0LXJpc2sv
Sample260702-bc2b8aaw9s

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3308	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134274276541316932"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2409539145-3342400454-2096821238-1000\{0E8CD020-7F81-4BD8-8818-B9AFCE327D28}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3464	msedge.exe
3464	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe
2128	msedge.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 4140	2128	msedge.exe	80
PID 2128 wrote to memory of 4824	2128	msedge.exe	82
PID 2128 wrote to memory of 3308	2128	msedge.exe	81
PID 2128 wrote to memory of 4824	2128	msedge.exe	82
PID 2128 wrote to memory of 4824	2128	msedge.exe	82
PID 2128 wrote to memory of 3728	2128	msedge.exe	83
PID 2128 wrote to memory of 3728	2128	msedge.exe	83
PID 2128 wrote to memory of 1980	2128	msedge.exe	85
PID 2128 wrote to memory of 1980	2128	msedge.exe	85
PID 2128 wrote to memory of 1980	2128	msedge.exe	85
PID 2128 wrote to memory of 4872	2128	msedge.exe	86
PID 2128 wrote to memory of 4872	2128	msedge.exe	86
PID 2128 wrote to memory of 4872	2128	msedge.exe	86
PID 2128 wrote to memory of 4864	2128	msedge.exe	87
PID 2128 wrote to memory of 4864	2128	msedge.exe	87
PID 2128 wrote to memory of 4864	2128	msedge.exe	87
PID 2128 wrote to memory of 1108	2128	msedge.exe	88
PID 2128 wrote to memory of 1108	2128	msedge.exe	88
PID 2128 wrote to memory of 1108	2128	msedge.exe	88
PID 2128 wrote to memory of 1632	2128	msedge.exe	89
PID 2128 wrote to memory of 5036	2128	msedge.exe	90
PID 2128 wrote to memory of 1632	2128	msedge.exe	89
PID 2128 wrote to memory of 1632	2128	msedge.exe	89
PID 2128 wrote to memory of 5036	2128	msedge.exe	90
PID 2128 wrote to memory of 5036	2128	msedge.exe	90
PID 2128 wrote to memory of 3892	2128	msedge.exe	93
PID 2128 wrote to memory of 3892	2128	msedge.exe	93
PID 2128 wrote to memory of 3892	2128	msedge.exe	93
PID 2128 wrote to memory of 3196	2128	msedge.exe	94
PID 2128 wrote to memory of 3196	2128	msedge.exe	94
PID 2128 wrote to memory of 3196	2128	msedge.exe	94
PID 2128 wrote to memory of 4960	2128	msedge.exe	96
PID 2128 wrote to memory of 4960	2128	msedge.exe	96
PID 2128 wrote to memory of 4968	2128	msedge.exe	95
PID 2128 wrote to memory of 4968	2128	msedge.exe	95
PID 2128 wrote to memory of 484	2128	msedge.exe	97
PID 2128 wrote to memory of 4372	2128	msedge.exe	99
PID 484 wrote to memory of 4124	484	msedge.exe	100
PID 2128 wrote to memory of 996	2128	msedge.exe	101
PID 2128 wrote to memory of 604	2128	msedge.exe	102
PID 2128 wrote to memory of 3472	2128	msedge.exe	103
PID 2128 wrote to memory of 880	2128	msedge.exe	104
PID 2128 wrote to memory of 880	2128	msedge.exe	104
PID 2128 wrote to memory of 3464	2128	msedge.exe	106

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://0af21ca4.click.kit-mail3.com/27up84n9xrfoh8pdg9lt3hg98703vbghvw9qp/8ghqh3uovn6dr8ulu9/aHR0cHM6Ly9hcmNoaXZlLnBoL2h0dHBzOi8vZm9ydHVuZS5jb20vMjAyNi8wNS8wMS9hdXRvbWF0aW5nLWdlbi16LWVudHJ5LWxldmVsLWpvYnMtY291bGQtYmFja2ZpcmUtbWl0LWFpLXJlc2VhcmNoZXItYW5kcmV3LW1jYWZlZS10YWxlbnQtcGlwZWxpbmVzLWF0LXJpc2sv
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ffb57a6c188,0x7ffb57a6c194,0x7ffb57a6c1a0
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1772,i,1258388834972555266,15188589491930929470,524288 --field-trial-handle=2152,i,2471158580310145332,4931227855148899653,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,4999370587904639460,9659965953494617503,262144 --field-trial-handle=2152,i,2471158580310145332,4931227855148899653,262144 --variations-seed-version --mojo-platform-channel-handle=2148 /prefetch:2
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2564,i,4147912468642330962,1377400866570837194,524288 --field-trial-handle=2152,i,2471158580310145332,4931227855148899653,262144 --variations-seed-version --mojo-platform-channel-handle=2556 /prefetch:13
  2⤵
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,2627157937059305390,9649543196326095484,2097152 --field-trial-handle=2152,i,2471158580310145332,4931227855148899653,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,11767075031487696069,15585135380539453718,2097152 --field-trial-handle=2152,i,2471158580310145332,4931227855148899653,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,14197765560885160005,15537883460971080835,2097152 --field-trial-handle=2152,i,2471158580310145332,4931227855148899653,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:1
  2⤵
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4276,i,3660662468221078701,3076218876150799565,2097152 --field-trial-handle=2152,i,2471158580310145332,4931227855148899653,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:9
  2⤵
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4392,i,14540423388432956697,16038159137172930654,2097152 --field-trial-handle=2152,i,2471158580310145332,4931227855148899653,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:1
  2⤵
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4396,i,4632172669057317154,3646281022022766044,2097152 --field-trial-handle=2152,i,2471158580310145332,4931227855148899653,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:9
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5448,i,7408856364065684996,16753633479818515394,2097152 --field-trial-handle=2152,i,2471158580310145332,4931227855148899653,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:1
  2⤵
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3416,i,8753329707899138255,15786248753125834086,2097152 --field-trial-handle=2152,i,2471158580310145332,4931227855148899653,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:1
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5760,i,13758716087307344344,2943929930485829482,524288 --field-trial-handle=2152,i,2471158580310145332,4931227855148899653,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:14
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5768,i,8577414059511368159,16817731260474436700,524288 --field-trial-handle=2152,i,2471158580310145332,4931227855148899653,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:14
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,12625410471171912230,4223872604878047925,524288 --field-trial-handle=2152,i,2471158580310145332,4931227855148899653,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:484
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1140
    3⤵
    PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6372,i,8751865161810268767,15199948121571300248,524288 --field-trial-handle=2152,i,2471158580310145332,4931227855148899653,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:14
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6372,i,8751865161810268767,15199948121571300248,524288 --field-trial-handle=2152,i,2471158580310145332,4931227855148899653,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:14
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4492,i,14509290719708096156,18242600581825552840,524288 --field-trial-handle=2152,i,2471158580310145332,4931227855148899653,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:14
  2⤵
  PID:996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4512,i,9611792432058593342,10415268779201188852,524288 --field-trial-handle=2152,i,2471158580310145332,4931227855148899653,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:14
  2⤵
  PID:604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4476,i,10884723996124239982,4179657927277525556,524288 --field-trial-handle=2152,i,2471158580310145332,4931227855148899653,262144 --variations-seed-version --mojo-platform-channel-handle=4456 /prefetch:14
  2⤵
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5344,i,2524068684775985573,8060542355597388018,524288 --field-trial-handle=2152,i,2471158580310145332,4931227855148899653,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:14
  2⤵
  PID:880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6640,i,16690146435972123885,8724957387813314759,262144 --field-trial-handle=2152,i,2471158580310145332,4931227855148899653,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3464

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1152

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bf637ca0b28ebd6e948876848ccfe71d201158d460d4ad944f124f9d17ee5472
MD5 827e00d89fccbbde703c679b5c7ff536
SHA1 6d9e235782beb4e6b38fd4db2946f9bfc725110c
SHA512 1d18100db386f25678d8dabb492ab6e15d08e2c5a7d7e6c76bc253df648e2b5438cbc4fcb5a4033a1e14afbda93b271225eb5f545f12663d6bc35ca51239fcc3
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7X:fwUQC5VwBIiElEd2K57P7X
TLSH
T148B3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0b5dc1bf65a27f8ea20844919d7db192caf7a54fd791434a1304a7df2e9b496f
MD5 5de7bfd3f869f48e7255b6bdc532c4bc
SHA1 c26027eb70bc9887bf69c2b22be60226b685dbae
SHA512 0e6af8c455f57dc816a2c01366f46a0d069e8f41cccb1f7565e2afd873b71ffd5f135649fb4bf44d1a15a9efd68dc59696dc74a971b3483ec9d87a4323b2b4f2
TLSH
T112D08032FB5D6052E7455230D893DF10276644A12C974B41E325C84CD5B80D493C3282
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e3c932e879f8a7071362a654b47cd73c05f90d7fe66be785d811b84b86743e1b
MD5 8c92d931ed33c3d779a020ae7e111fb4
SHA1 de123f6d92bf24747affe820aaa8be3785388fae
SHA512 5be895d6a61eacf4f3117293636fb4890abbe186ddcbfbb3c8d3aa0fd1aa59519bbdd86e552732d2ded27aae5be1ffb0d6d9f6ccaac824d1b13ed03a12a438dc
TLSH
T13BD08032BB9D6452E7455230D893DF10276644A12C978B42E325C84CD5B90D493C3282
MD5 SHA1 SHA512 TLSH

Submit Download

073b51dd-6c7e-457e-8b1f-8f5ab9c86dc9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\073b51dd-6c7e-457e-8b1f-8f5ab9c86dc9.tmp
Size 13KB
SHA256 a35d50c4504f9ff81f19df9ceec78b59ba26a09bdea0517e4104da0687e524eb
MD5 4d1d7efc4e6f7b34605a04d177e3fd0e
SHA1 f193199e538488ff0fea7f4763aa62b919bfb6c1
SHA512 c0e8d340427787ad8b79065b3bce55b2a831fd8167e29db0869b7ecab87fe51b53c6513d45dc026e1a6458d414476da4cd66d94e3ee3ad5639f0b00956de0372
SSDEEP 192:sxZsRMyM/jK1Ml8MFE/fvsSSRX/IdpST/W6+WNYYY/Y0ocVHWDkIg5IJ:sxZs6dE/fvsSSNw0/b0/5ntG
TLSH
T1D152D7166A345A77CCDBD209BA55BF53D6F90563E2900E44AAFCCA0C01E7AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00008b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00008b
Size 374KB
SHA256 9e58eef4c759e0f11538b7483cf06db0eee77e2f759477f430c0a0336baa7e5c
MD5 26636c6b0f19d3f091c8f9eaf16988a6
SHA1 301472ed6eb13e36e86ce7a9c30ca1158b1ff632
SHA512 b9377375bc95d52ec1615f5d87694ac9a7b9d19099630410ef159823fc8a31e2d6ebb8fa6242dfad2e8a0df673616604d0812d0574be8e0bb281935a1f3996d3
SSDEEP 6144:2MWU4MrvT1tBu/ARRfkKGM32RzlqKs/LXaMhXrO7ugO1KeiTxttKWK:BWYrvT1tBu/4GKNgRqKs/LqMhbO7j7er
TLSH
T13A8423DDA074E58D2A056560AB2DAF05B1FB435ACDD8A390CAF1BCB0FDC80F6E55842D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 8f31b861020af5a3ab8faa9a356d60e750b615ffcd9548cbe5616d2b332d6d37
MD5 f63a898be1970b4b10ec655e079a8c4e
SHA1 2fe4c29a72a6994fab01b7f50465e7dd46d85fa8
SHA512 23a44aafbec75cdc03c3bfa6d41915712950ca842ee2ed0630a134f8cb883b7d24ed10e5821e070e5209f29f200745b1254fe3574b0c617d200ff0db3cdc86a5
TLSH
T1DE71B81746A3C05BE3B01632C0C21E9D3E3281954A6F7EDAC69484BB3F19326E67794D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5887b9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5887b9.TMP
Size 3KB
SHA256 395ca85a5951d159c013cb5c04871a97dc259ff28aacd0010c31b826af416dc0
MD5 4dd32c5d844f9f4af098a20181b8bf2a
SHA1 a7408c90bde650557790d88d04e13cee48fa1458
SHA512 00a4418658d63de4097f00d41d474346a6e122979537e1e70106909a251887c9831b489d1dc433e6d5623e72c74ea005a9dc4d9517df30f91d88135c26c2d1a3
TLSH
T16371C8074653C05BF3701632C0C20E5C3E3181854A5F7EDAC6A8447B7F19326E67794C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 e2707ec24d97ad91f228ca5367a7f3671a54f438d48e6b390195bde8a6855f37
MD5 98543a5729e1793e42c60e1d864bc255
SHA1 bb55f5a4f8128caf65427d8fec6dcfd35cbd0295
SHA512 27566dbf646b560b84fa863c0d88eaba3ef426d3ce2a33cf2d6c2a01158b27618235c57e15bd2bbb50033cea186dc4a58a00125ce99a024e021a1be95648245f
TLSH
T11551ADF7C7E4862DC90256F0AA24AE1FDE1E052547283D6685D4AF5F93F2472E102A8F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 5317d74bc55a5813f40c9b0a38f51a0c7ee33e1b5ee8b51539884f83b8c26141
MD5 e89ddb652e89bcb00d3d375a0b5442ca
SHA1 66488f20dbc9d6b1b40c9adffc9abbb1f8703f78
SHA512 6da34261d8f469a2880a64220a47c3ec86eeddd005b8f88f53f303c511e098183b227a40547f1a19bb03f21f9fad78c7d978c38d5b7defaeb906091dcf820358
SSDEEP 192:sxZsRMyM/jK1Ml8UQkQFE/fvsSSRX/IdpUT/W6+WNYYY/Y0oPVHlZkIg5IJ:sxZs6qkGE/fvsSSNwq/b0/5oUG
TLSH
T10652D8166A345A77CCDBD219BA55BF53D6F90563E2900E44AAFCCA0C01E7AED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 654d8bd878968379bf1ea5d5716be30ca842c69d72ffee4887ce272528bebb53
MD5 9b877c4d77a4c2cb2d1bae2b1f888112
SHA1 e0d2a2658407a5c5fc81bbc24bb68e787b5ad6a6
SHA512 282df216c40f339294792df3bc6d0115719e62d17d13a6ed376f5019b7e150e9166794763ffe0533758b9ab975bc64c8d63501f5ee89773ad7203dda22e786d6
SSDEEP 192:sxZsRMyM/jK1Ml8MFE/fvsGSR6/IdpST/W6+WNYYY/Y0oniDkIgrJ:sxZsydE/fvsGS4w0/b0/5u9
TLSH
T1F452D8126A345977CCDBD309FA45BF53D6F91562E2900E44AAFCCA0C05E7AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 f1654f15d2e0ccb5cb0fe551be5501be1a5bc43311535a5a3b46c79077f71ec6
MD5 a745ba91ec06c5cd0619dff45b78ef7f
SHA1 569bfcc88dadeceee49956d86142015e0dd80591
SHA512 a08932b7b498f5074a2ac38b400d88e98808923788e4bd53561c4cddaf10176162e1df90817a8dd9364fff7f3aa981bf762612b016552789cb3c1fbd0ad35fef
SSDEEP 768:Aoc0s8Ww2YfWRm/JQg18F1+UoAYDCx9Tuqh0VfUC9xbog/OV3BOLl/TB0OMLrovI:Aoc0s8Ww2YfWRm/JQg1u1jaKBOLpTuOw
TLSH
T1D6E20B3B284CC77E4F844E9CEC26AF966ED802CB66684D5447FE494C03C77EA521A49F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 abcf318ef036089ab7fcf8c5bf847c0500bc10f243806120e81c6dd47a50801c
MD5 24a13fc8f06f1ae0df7bce13cb536bd1
SHA1 04dcdd0a8c64cd0bae14b0ec95dd017b15f89f6d
SHA512 8ebf70fb1e3eb4cd491f5209b4f7cbc4431792992d0c38ecaea6a0dabba635317d95c94a86fbb5823de764a31a1c570cba5a4fa66ec063a34bd23879b849d3a3
SSDEEP 96:K8kAKVS2y4gKFW78dIsGK+MW6XXg0MK4Zg+MccsXW8RHoZs4q2P:qLLW8dIsGK+T6XQ0wZg+zcsXW8RHoZsY
TLSH
T17F91706271BB12113C7E290CB395B6664682F0677128F87B37AD50B28E67E104CFD9ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0edeb8a0-2be3-423c-a066-23f68b82f3fe.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\0edeb8a0-2be3-423c-a066-23f68b82f3fe.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 32764e6e45b8e890363e98442425cf0557f2947efedbe049b5df7537a4daa89d
MD5 931e30409dc565e56cd8afd7f342188e
SHA1 e42781f295fbc4adc340cb456c55beac58e02764
SHA512 5ab8d86153922633a3bcebe6cde66565a884b3914f729618f8ab0233f46fed44ace7cd6e595c73def43fe9d8230780ab7af43c4b50732fc183452e37dbafd41f
SSDEEP 384:YtNn/s3n9Sm8NNuhchVkUu8YkDsoKl8BhBTPLBliG:Yj+9Rm1CRoKl8BvTPaG
TLSH
T103927B719C686D674EA39998F54B36179FB8413BEA852F9086FC3F0C01DB29C6307D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 a80f26f71065a239a6ec82127fa81cb7d5d5a1d7484323beb4cccb0339c19666
MD5 0c19d72aa9cda05954ab6e18b4b0e13c
SHA1 3655531cb5f3574ea866805b8499c6a25648ba83
SHA512 50080d18060c425ad39223bea3e8417a68959fae1ca5807e1162d1219ac307c64b632734a40a5ef3c749139dadde372a59fd9429a0647d7f2b1b9557474ec97d
SSDEEP 384:rtNn/s3n9Sm8NNqhchVkUu8YkDsoKl8BhBTPLBliG:rj+9RG1CRoKl8BvTPaG
TLSH
T144927B719C686D674EA39998F54B36179FB8412BEA852F9086FC3F0C01DB29C6307D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 a35c3e248fc0cc57a52ce9c18d42f5eeb17e72f0f071cb285fef0c15849eea3c
MD5 bed6953b1de1c4f88aff16a5d555bb15
SHA1 4e8985253ac83c90045915a76c9c9ed688574b75
SHA512 177e915ccb08f81442683d07a041ecc2d665fbc5f67f87cd3cbbf34f2d1bab8b700875a28e7f4b2fbf7d9560e37ac767d357b1f16bcbbb95a4764daa27970025
SSDEEP 384:WiFQtNn/s3n9Sx8NX8TUNTUlIl5hchYkUu8YkDuooKl8BhBTPLBliG:9FQj+90+wgB1CDooKl8BvTPaG
TLSH
T174C219F248D78936D9AE4B47B73E2D138E7CC167B5402A50B3A81A0CCC961BFD306925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 db913b8f4cdaa9731fa3dc888198ae596ad091d2ad98824ed067fea557bf986c
MD5 04d08bf8aff44a956d50cd10340b48d4
SHA1 cd5ad6807b1f577e95289daf40edcadf5382e36d
SHA512 34b90526ce0c6ee84540c9ca03d20d92a6a327c32085d9c528ed35f209d256e51deaf44a037e637f8d29cc94c848453f7d22f5742448458d02031220f989e9ee
SSDEEP 384:AtNn/s3n9Sm8NN5hchVkUu8YkDsoKl8BhBTPLBliG:Aj+9Rr1CRoKl8BvTPaG
TLSH
T1CA927C716C685D674EE39998F54B35179FB8412BEA852F9086FC3F0C01DB29CA307D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0447f1f2f42969924641cab840a7573ba9eeed0cf57a75c28c56644dec09be28
MD5 a4546218086dd45cc5b9ee31242cb957
SHA1 716ea80c0081c4df8721629b863ef398dcb90bfa
SHA512 bd4a100f69d0b9795bd54779bbee22095051ba29ccb9a32bd6039b53a4e95839cea6647125183e93eae633371e4c8d8b8ccff1145670a7aac31f9f221c497481
SSDEEP 192:XGNK6jCQmiUylIQf4SufoPxzYZy5SntTmU6:XGNK6qu3fju8YkC1mU6
TLSH
T1BD02C675AC686C779EE3AE55FA8736139FA4212BE9952F44CAF81F0C00D764C2347826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 218f653aed4569897e69c4d065ebe0ddb8c7ce0d6f54b7fe4793c3585d672508
MD5 17ea5b2b0e70540e3979a48ff108d855
SHA1 c9e45d9a7ff05106e161f11ab2e21364c32a2a59
SHA512 7a3c3caa7e7b3ef1b9467c8929254b7193ab6d9bca0b3cda3a054f4797e74f4bbd1f7777d2f33e34bab50803228916436cf89123e4e0acc9c94cc8e5e0e63323
SSDEEP 192:DJGNI6jPQmiUyTQBG4SufoPxzYZyDpYxWOMEqiU6:9GNI6dFkju8YkDjoU6
TLSH
T13612E675A868AC6B5EE3A864F58731139F645127EA853F40CAFC2F1C01EF59C630B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

909f615e-1de0-4d05-8c8c-2e50a7da7076.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\909f615e-1de0-4d05-8c8c-2e50a7da7076.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download