e5ead6cc68756c1b84b16d168dd72a107e8d127be81a900d255f492a48ffc487

Resubmissions

02/07/2026, 12:28

260702-pnf3baas4w8

02/07/2026, 12:17

260702-pf4hmshz314

Analysis

max time kernel
898s
max time network
729s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/07/2026, 12:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
email-html-2.html
Size 21KB
Sample260702-pnf3baas4w
SHA256 e5ead6cc68756c1b84b16d168dd72a107e8d127be81a900d255f492a48ffc487
MD5 e065fdba4c7b721471e9d28572dd1af1
SHA1 9249a0a37717eb64440431b71f51bd79398b83f0
SHA512 88567646763b17d9bff9bdeffe9e80b30335ad2bfcb9dbf5745ce4cabe16fc5581a2211c646f92ed61f046ab008827be853ddf9b80a4370187724752731dd55a
SSDEEP 384:B7BmOTcQOTKRpMkDISqXPGvtgDY6v2f2Wi+2Kq38Tq:B7BmOTcQOTcQ9ZHsq
TLSH
T1A5A20D03F3C11C06D99F48A5A017337D3E7895C68F760E74A29B7B7E568DCE39691288
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
756	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134274689127530517"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{D8C40C7F-F752-4020-8832-F230974908F7}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1860	msedge.exe
1860	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe
4036	msedge.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 4036 wrote to memory of 3480	4036	msedge.exe	87
PID 4036 wrote to memory of 756	4036	msedge.exe	89
PID 4036 wrote to memory of 2224	4036	msedge.exe	90
PID 4036 wrote to memory of 2224	4036	msedge.exe	90
PID 4036 wrote to memory of 2224	4036	msedge.exe	90
PID 4036 wrote to memory of 4056	4036	msedge.exe	91
PID 4036 wrote to memory of 4056	4036	msedge.exe	91
PID 4036 wrote to memory of 3012	4036	msedge.exe	92
PID 4036 wrote to memory of 3012	4036	msedge.exe	92
PID 4036 wrote to memory of 3012	4036	msedge.exe	92
PID 4036 wrote to memory of 3788	4036	msedge.exe	93
PID 4036 wrote to memory of 3788	4036	msedge.exe	93
PID 4036 wrote to memory of 3788	4036	msedge.exe	93
PID 4036 wrote to memory of 3416	4036	msedge.exe	94
PID 4036 wrote to memory of 768	4036	msedge.exe	95
PID 4036 wrote to memory of 3416	4036	msedge.exe	94
PID 4036 wrote to memory of 3416	4036	msedge.exe	94
PID 4036 wrote to memory of 768	4036	msedge.exe	95
PID 4036 wrote to memory of 768	4036	msedge.exe	95
PID 4036 wrote to memory of 3100	4036	msedge.exe	98
PID 4036 wrote to memory of 3476	4036	msedge.exe	99
PID 4036 wrote to memory of 3100	4036	msedge.exe	98
PID 4036 wrote to memory of 3476	4036	msedge.exe	99
PID 4036 wrote to memory of 636	4036	msedge.exe	101
PID 4036 wrote to memory of 3668	4036	msedge.exe	111
PID 4036 wrote to memory of 4512	4036	msedge.exe	112
PID 4036 wrote to memory of 980	4036	msedge.exe	113
PID 4036 wrote to memory of 4236	4036	msedge.exe	115
PID 4036 wrote to memory of 4236	4036	msedge.exe	115
PID 4036 wrote to memory of 1860	4036	msedge.exe	116
PID 4036 wrote to memory of 396	4036	msedge.exe	117
PID 4036 wrote to memory of 396	4036	msedge.exe	117
PID 4036 wrote to memory of 4244	4036	msedge.exe	118
PID 4036 wrote to memory of 4244	4036	msedge.exe	118
PID 4036 wrote to memory of 1112	4036	msedge.exe	119
PID 4036 wrote to memory of 1112	4036	msedge.exe	119
PID 4036 wrote to memory of 3496	4036	msedge.exe	120
PID 4036 wrote to memory of 3496	4036	msedge.exe	120
PID 4036 wrote to memory of 1604	4036	msedge.exe	121
PID 4036 wrote to memory of 1604	4036	msedge.exe	121

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\email-html-2.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffbe146c188,0x7ffbe146c194,0x7ffbe146c1a0
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1868,i,7502391644749241258,17199804199121677028,524288 --field-trial-handle=2704,i,13988835042280394267,8970787308060303284,262144 --variations-seed-version --mojo-platform-channel-handle=2740 /prefetch:3
  2⤵
  - System Time Discovery
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,13872325427456683964,16563805868023399663,262144 --field-trial-handle=2704,i,13988835042280394267,8970787308060303284,262144 --variations-seed-version --mojo-platform-channel-handle=2696 /prefetch:2
  2⤵
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2232,i,17869628753703423793,6697000585312136579,524288 --field-trial-handle=2704,i,13988835042280394267,8970787308060303284,262144 --variations-seed-version --mojo-platform-channel-handle=2748 /prefetch:8
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,8490575381059385900,7703034870936878819,2097152 --field-trial-handle=2704,i,13988835042280394267,8970787308060303284,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,2046974006575256889,12216877493409618210,2097152 --field-trial-handle=2704,i,13988835042280394267,8970787308060303284,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4168,i,11343601575803897973,16423637163871661490,2097152 --field-trial-handle=2704,i,13988835042280394267,8970787308060303284,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:1
  2⤵
  PID:3416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4228,i,18327498478605957805,17762796543466421083,2097152 --field-trial-handle=2704,i,13988835042280394267,8970787308060303284,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:2
  2⤵
  PID:768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,14520273963082135602,11872419179051779987,524288 --field-trial-handle=2704,i,13988835042280394267,8970787308060303284,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,559306274890129711,431161421537306858,524288 --field-trial-handle=2704,i,13988835042280394267,8970787308060303284,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5704,i,10737567200894679547,13083607638458653209,524288 --field-trial-handle=2704,i,13988835042280394267,8970787308060303284,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5704,i,10737567200894679547,13083607638458653209,524288 --field-trial-handle=2704,i,13988835042280394267,8970787308060303284,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4216,i,14102715699006466535,9276397771849473797,524288 --field-trial-handle=2704,i,13988835042280394267,8970787308060303284,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:8
  2⤵
  PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5008,i,4884824625154537388,3083380326951550520,524288 --field-trial-handle=2704,i,13988835042280394267,8970787308060303284,262144 --variations-seed-version --mojo-platform-channel-handle=1760 /prefetch:8
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4592,i,6178674688030978219,3126006426241316478,524288 --field-trial-handle=2704,i,13988835042280394267,8970787308060303284,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:8
  2⤵
  PID:980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6348,i,3744883922720707046,13720531684264573258,524288 --field-trial-handle=2704,i,13988835042280394267,8970787308060303284,262144 --variations-seed-version --mojo-platform-channel-handle=6356 /prefetch:8
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=744,i,14438494024099303957,864154534450590745,262144 --field-trial-handle=2704,i,13988835042280394267,8970787308060303284,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,5337224965754819418,17994557069021327661,524288 --field-trial-handle=2704,i,13988835042280394267,8970787308060303284,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:8
  2⤵
  PID:396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5704,i,10596787372113007614,9036317405666544352,524288 --field-trial-handle=2704,i,13988835042280394267,8970787308060303284,262144 --variations-seed-version --mojo-platform-channel-handle=748 /prefetch:8
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6632,i,14607694940403531383,5085641347692543935,524288 --field-trial-handle=2704,i,13988835042280394267,8970787308060303284,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:8
  2⤵
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,18310955580061354731,12552251501742407405,524288 --field-trial-handle=2704,i,13988835042280394267,8970787308060303284,262144 --variations-seed-version --mojo-platform-channel-handle=5484 /prefetch:8
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6588,i,11551036065805284503,14330204529959638850,524288 --field-trial-handle=2704,i,13988835042280394267,8970787308060303284,262144 --variations-seed-version --mojo-platform-channel-handle=1044 /prefetch:8
  2⤵
  PID:1604

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8c5b1a407270ca9ae8bec8f20cc56244f3bde6f042890a4cabcdf4df3d21fdad
MD5 16f782e6f4d4592598936b2f29b6b339
SHA1 5c8c22b7f56af2b2e0d9978418f077cc8fd13c41
SHA512 28b2f7186b910539fa22408b47131fb16874b4c2192a721a69393efd7812da561ea9977b8af678cd3a9e37c23f186f876d7086a20afe28b16659db70955cf16f
TLSH
T15DD09232B7C9E241E14232BAA81447826E2A4A68259AC2176478844CEC6984AA79D28B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b28cb7be2bb68a6cda7ff7689f0ec4acdf8699e4818545d4dd692148ce1d64d2
MD5 a712889d00fb4f0945d13b925681156a
SHA1 1448cbfbc2c620e016aa5e6fccd0ac75e74ef2d1
SHA512 65f51cf451d5f77c9e695462e66abc873922db3c3999c172526727c2356a5a29052ce4b77ead44b02780ca80f6b290696b7633f537570254f36e7374ce0d04a5
TLSH
T12ED09B3277C5D541D5423276A41447816E164568159AC2175474444CDC69445579D147
MD5 SHA1 SHA512 TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log
Size 3.0MB
SHA256 fbec7d551fa3ba48882cbb127c4e8b58d89be944e90a16685d343928232a8426
MD5 78bfbf7e3d22711db7237c85cef3a64a
SHA1 f90880ec3709fd5f1b34d60d241e0694da82c5ae
SHA512 51ccd27b2b2b8b5ffb390c2035e8d4d80f374415a235e380071f3c333f57021d246160baf3999d0f9c37cdfa47fdeb90cbdd9054222535832ea5f94fb4fe26b6
SSDEEP 24576:1lEzzMTZMDEiAtKBrk75vMQr0EZUKZEB3tKBck75TrFCo5:1l0QZNM6nUCrFCo5
TLSH
T1B2E5448AC5A3BAFF02657C77A836B4CD666807D34190FD3B6EFC857E93999A84403350
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 6KB
SHA256 122519c9de733824f1460b1ebdf116b29925b85ed80ea0ebb38806a0783c7301
MD5 58c9aa19d89363d9e118c8baee7a7327
SHA1 caae5d3dcc6d27f7b389bbbe8461a1ffd7270b3d
SHA512 3772575b1aa7ceaf4e8bb499f611770462b1c4931e3cbf3fa158739729c071515239b87ddd433d8ed0122cfd0578b200e16252aa27209f7ac9ceffad6bab2d74
SSDEEP 192:Oj7biUccccccccccccccccccccccccccccoLO:Oj7biUcccccccccccccccccccccccccw
TLSH
T136E1524343E8C7AA8B0664DA4AD8A35C45B1771EE7DCD50C0B4C89EA314F49AB9F56E0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 6KB
SHA256 60a3ea20795f2d2c54dea55af35b649d185b13a041145cdecb38c357ccb07f1e
MD5 488a692bd8a7ee3e3611bc0eed2df1fc
SHA1 15a4ba7fcbf6f3afc6a5e441fec480fac1a51723
SHA512 ec9dadbead6fbbccf3401c1ecf75ff689d7226d3f47782bebdd85d0f200cd403a1004253abb2e228c25867974d4ce7a415b9b6fbaf72df7c2ab7f44b3521e7ba
SSDEEP 192:jjkQN11111111111111111111111111111Oh:jjkQN111111111111111111111111110
TLSH
T14AE12E0783E4C69A8B0655CA4EE4B35C00B13719FBDCD90C5B5C9DEA304E49EEEB66E1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 8549669ff9b74b1a3dcc85f01cc336eddb0df2bbb55d196002049bdbcccd946a
MD5 72d76fdac8fd60eedc7a71c800afbe4f
SHA1 ba8ea9a424ca716d35c6c3410c297f66b9e7fb28
SHA512 caa364ef17719e7c81a9b189e9895b7a2232b21445dfb0d9c19d3fce8967a9095b5f30c3780b0a31c1363bed9e7d93218c293225680f92012d1d79821c667611
TLSH
T1B2E026C65AC8C22EA202644B616CD30CC2C2371FD7C97D8F170884A57242280EB836E0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ba8610211fa2c5ad5849faa142d7a4ef3a28131eedf1514abc8a236ba7ceb373
MD5 102da2de00fbb1f668cf91190831ba67
SHA1 ea3d3ace1b7c3fc574b235acdc05c739b922fb1b
SHA512 6f55795307e3168e02a9793455ef784a4cab177106a6195ca0aaafae58587579ea02b253b529e20e710b1495e2067efb4b9f2afa2b235f8d8237534868358ecb
TLSH
T18D712C1A12F9489DD721A330F1CA1D1E7CF3F19B0E139E49315CD8BDA53A734E4A5554
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b977.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58b977.TMP
Size 3KB
SHA256 db8e70db3809178902f5195256ab147235014baf8fc8659e4b1936122608158a
MD5 8f0840be912f8f6a34c4cbad8e5ff320
SHA1 2e2f425015486dadbc475943a88126b50856d549
SHA512 254e64ef04a43888c50803c00f631064045ab45d79e5cd305ce3909607fde6c32aac87fde7d81894f1841761441df0983d236cb13b80acbfda7275abb2bbe9f8
TLSH
T184712B1A12FA489DD721A330F1DA1D1E7CF3E19A0E139E89319CC8BDA53A774E4A6454
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 87a8ca307ad5b848a9c99f677ddcb7826e272e1eb44a86a7553f276bcdac132b
MD5 f9f602abb8e124179a5ac34fe7a211c7
SHA1 97a41ea8eda0e556c6b12add1c61b029cc01aab0
SHA512 bd3c8bdbf6b19eecbeaa27c5cfd3ed8e775077680a7b4211e59c7d40f2cf24ae507d8a1baa0eac0064e225adc276a25867196f58c3d6ebb570910e7144bae9c5
TLSH
T1A02160F383D5856ECE1156F06A28BE2BCE1D0505832C7C5989E4EF6BD3E3475E40295B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 4e95cc90e41d078a17ca99669ff027288c8d16cc532a8a1b422d6b583d08399f
MD5 f78da488698794e1ebbe4de3a76260a4
SHA1 0ebd2abe704e8837c225eca381ad735aa6b48c1c
SHA512 3e3ff7a00e09810ce0b0ea486b99150eeb6e19ef8573acec16c802c58f18bb75095f8776db1143bb35b850ed5a3e641c70b7c85b0e10a755b022f2b78e230725
TLSH
T11B21A0F787E185AED91156F09A18BE2BCE1D0505832C7C6999E0EF17D3E3075E002A5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 5a57c1e35c1da41cd0508b3fc2b76c9db76b74a04280c2f91a85cef428bba6d5
MD5 085855c680ce22b10dbce2a81775ce37
SHA1 8be82b9f79feab0c6ec56e6a23a13ed21a9d3c92
SHA512 7394efdbe7467d4398b758a9036f2266618f1d2326f4c39b68dc907dff644b019e88c7374b818727c0b3a19b59fba597b6cdd03f24ab92c168f8b8c8e556b63f
SSDEEP 192:sxZrRUyM/jK1Ml8Mkl/f0spvDvIdpdiHHW6+WNGY4wsNh49BIgrJ:sxZrmMl/f0spLAIHbG09t9
TLSH
T15542D712AA345977CCDBD209FA55BF53D6F91473A2940E44AAFCCA0C05E6AED2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 b50c73fae86383a15a3f9f0fd62c11599adc417cea323e0c26c4120dff3b0c89
MD5 13a513298b0dc0bedd28595139ecb4ef
SHA1 77934927d1dc7a90e0bd755f70492a8ffddbdfa3
SHA512 10275df8f7cc0b89f56ebc4034571703a7563a767753ff711db0864216de8b24c8449a0a937f45631914fec7e5c355d6b3caf66ade1154c67a595e33938b7f69
SSDEEP 192:sxZrRUyM/jK1Ml8UQikl/f0sUvyvIdpHiHHW6+WNGY4spNh49BIg5mJ:sxZrmqhl/f0sUqAqHbG/9tk
TLSH
T1C652B6126A345977CCDBD209FA857F53E6F5547392940E44AAFCCA0C05E6AED2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 0b7ec66b13f2cad5a04f214bbc234a88341255bbd0d37b0bdaec1fe38ea944fe
MD5 8d244484e5d613cea03e3a281a893313
SHA1 bde3f8862f844ae20923f162fc725e61e3966898
SHA512 7f87a30809b2284f92b8f0360d1d3a3b914809e9306a4d4015d35c104283ddbf1fba4f769aad9f237b665ef35bd422fd4b7830041b89406b7bdaca778803a523
SSDEEP 192:sxZrRUyMqZjK1Ml8UQikl/f0sUvyvIdpHiHHW6+WNGY4spNhX9BIg5mJ:sxZrBqhl/f0sUqAqHbGA9tk
TLSH
T16452C6126A385977CCDBD209FA857F53E6F9147392941E44AAFCCA0C05E6AED2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 f2f7e90ea57b65652fcd0c9cc2a085b0503be2270a77ba112fce426d0e91194e
MD5 f38a6510730c5a74c6ea6d98782ed8e6
SHA1 585864198462f3ed07b7efa01c0291ebfaf166ba
SHA512 0adf368e1ffe4aee095f5df4acfe25b7d314aa7010142f9afba58ddc6c8898407c39eefdffb537e7fcd206d48d2a33102cbaa13f76ad0f9031961f06c6ce17b8
SSDEEP 768:k28iJPNWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsALl6opdJro9kkUnU3:k28iJPNWvx76ru1jahALocdiRUU3
TLSH
T14ED2FA3B680CCB7E4F844E9CEC266F966DD801CB5B984D5447FA880C03C76EE512799B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4a9d8211-7182-4c12-98f6-a69f4033bc23\index-dir\the-real-index
Size 1KB
SHA256 5be13d3cbc39319738af95aed1eceaa9dd6b739a35ed40b5712110a8f86b80ba
MD5 4264198cfad4e657a125e34dd574b4ae
SHA1 a0d27e8ac64f3f93f5567c280f00b8d6c5d55d34
SHA512 1cfd4ba8e700bbca846bb1189d2427e43574fffb278eb12ebb029825ad51c06f6e98464710a378e91e0f3f5946805899456919b6b4c6d159da68954428597211
TLSH
T1C72121440DE18A6FFDB14172067298A4737089DC1325A753283C32315E2675E3947AEC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5cffd4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4a9d8211-7182-4c12-98f6-a69f4033bc23\index-dir\the-real-index~RFe5cffd4.TMP
Size 1KB
SHA256 98fa25004a17ef07e0bbfcc8668fac723a781b33fc5c753acac65a63e9b4b1e1
MD5 9b86fbd50ad4543364d53026428291fd
SHA1 009efd8068331695ec4e77f4f0341f56fe30c671
SHA512 3c7a36d4bf6c7ab0f8731eb2e4c5a3c4cf59fb4d3bb4e73163287d33d79e1b771085d52013b5cf5c7e8930f43dae3edb9139f5e846e59c7635f15901c2601c1f
TLSH
T1EC21049546D18D0FF995517B1963F8F4B33189008722B393693D22795D25BCE1A4B0D9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 300bfb2ca6e4040f561603f7be60548a0a3612d57391e65f10eba67244716c0f
MD5 31451ec4a51a94de91df2fad98e39d58
SHA1 f53d28c24c71e6c6e2b73a3fbcf98aa1cae3b9b0
SHA512 bb3595272dc52c9dafd0e0d8bcb7e732f054dfd57429590b4cb69df789a799b851510072519ea1cceba940b176c26d3ac634dd9ebc4ef2279082fa2cfc2dda85
TLSH
T1BBE0C0F72FE72840FEBF63E5197098E00286B459D544BC8F141AFBC324613523406C22
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 016b0b88a53e879510284f9399a6147a48d8a8236da5b35e40be53517c6f6c1f
MD5 0ed3ae3af08aec8248b3c87f9ddd3054
SHA1 01468c5520e3099215c201458640bcacd26edadb
SHA512 08fbbc442bd7bfda81d7cbf323a42f7e866f3cab28637f70f080ec3e939df063c39c88bff2ba350a32aa6f7f4855a88165b7d05c132898365bc238e84d161f1d
SSDEEP 96:Ksg4KBW2qEgKNC/8dIsGK+MW6XXg0MK4Zg+MccsXW8RH4Jco6GKQWOTF:CXHa8dIsGK+T6XQ0wZg+zcsXW8RH4Jcu
TLSH
T1D0A12713717B22123D3D2909E69586158782B6E33168F86B37E841B60E7BE254CFDCED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

16b06a0f-2a72-4784-9569-fc620736f11b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\16b06a0f-2a72-4784-9569-fc620736f11b.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 62af2f5c36a967cd2e9c26662caa6d9a1d5b6a2fb2038a7107d77ef3adecf50c
MD5 248c63578b62ad08b7482280eb3b47cf
SHA1 7c13a8843bf3cf7b16e2c9fa9fcb0b088a0d28ec
SHA512 d2b55d7036295e9e54c23e6f0c61459b8dc4c645669be401c53e7a29f6d966ca33be71768196b55e3cf494536c0ad386cd365b29fcc4800065d6a0ee48b3c8b3
SSDEEP 384:ttNn/s3n9SfsNR3Bkw9WURkkTiSFB6Kl8BhBTPLBliow9:tj+9UQSUDB6Kl8BvTPaow9
TLSH
T109928D326C681D7B4DB39959F44735275EF440B7E7C42F94DADC6B1C00DB2986306E2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8b0f2f9bf6457af0bb571f3527aca9485509464b4dbf23d19561d8c3c012e418
MD5 cc7b24a481e56511eb098c68a6c99ec8
SHA1 a006c6686e0a741d2b5b015521371fcda6325b07
SHA512 ff3596b4815a4b4eba8dd174a8e85251f422281f6e86aa225f838e598b7ac5b2d84aa80b5ac4818a79c9fa551b62fda0a21ecbb44768f303f8d5a20970fb8f86
SSDEEP 96:ZqONk1QsjpfmUTmDK5ih/cIPURHl8h4otop5A5DMBhPwivh50xy0SFYKCAxTeYNv:gONl6kDfQmiUyiAZ903plQixctU6
TLSH
T11802FA3568786CBB8EA3AE45F48737275FE4112BEA842F84DAE81B1C04D764C1707837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 b2f19b669730a55ff73a8679cb0759e12605d8af73d85b4d797f5fe4529d8000
MD5 27f2903f2b5d9647d87e74cc793f7cba
SHA1 303d2ac4eed21e64729253249e102aa5557b82f9
SHA512 7ed7116ea542cda3728c3799d9ebcf0233fb0568b7151be04db8ee6dc3fcab3ea889c9bb5d0eb92c85454d897281fb559dc5f646e09b2760b0ae92a2404ea815
SSDEEP 384:AtNn/s3n9SfsNRWBkw9WURkkTiSFB6Kl8BhBTPLBliow9:Aj+9UvSUDB6Kl8BvTPaow9
TLSH
T1FC928D326C681D7B4DB3A959F44735279EF440B7E7C42F94DADC6B1C00DB2986306E2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b8713682fe213b6daa0076a873aafb41239504d9df3c41a6d2215059f103bdd7
MD5 5e7a07b43ee2820ed4b9bb38eb39c8a2
SHA1 0e8a01384eee79e69fd8ce2f220693047fac0ac0
SHA512 daea46b04bcfa5a6f7d35f0477003d5b003abccdee01cbd409477a3d7a600656eda2427ec2d6bfe2d14af261bc29f224ae7e93ebdea8ac189eafd0c820882969
SSDEEP 192:bONE6kwQmiUyJAj903pTeF3xcR+q9CjU6:bONE69Bj9kTimB6U6
TLSH
T1CB120A36A8B86C7B4DE3A951F48736235EA14127DB892F91D9DC2B1C05EF55C130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b17e3265-d265-4f9a-9eb1-29c52babd445.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\b17e3265-d265-4f9a-9eb1-29c52babd445.tmp
Size 22KB
SHA256 b2753805369d33235d698e07d2f19fa3bc59c04bf3efdee540ff10d9a2c654fe
MD5 e79e953f35296a54bae8d31662f50051
SHA1 6182b9c5467ee9e122900cdc08ac172148bf76ae
SHA512 610e19524cfba9e910828186896cdc8844f52eb2a57ea5f3b77c8cca971ce268d5e5ccbda59b4970c62f9d8809018c6edd25b84b7c91b9cc9a0b3626123522e0
SSDEEP 384:6iF1tNn/s3n9SdzsNj8TUNTUlIlWBkw9WURkkTivRB6Kl8BhBTPLBliow9:xF1j+92mwgCSUqB6Kl8BvTPaow9
TLSH
T15FA25B335CA8897F9EB39A85F54B36179EF440B7DA852EA0E7DC6B1C00DB19C130AD25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2558cfb7-e600-49f2-ae49-7e7dffe64657.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\2558cfb7-e600-49f2-ae49-7e7dffe64657.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 1ea1eefe7d053f0465d79058867f227436c5e38a2287f7cc1b297ebdc51e3a05
MD5 8352d74dad98c3545f12bc50a1ea5cb5
SHA1 5b0ad76ed27a831eafcbc5fbb0b3523ce5f4cd57
SHA512 2d0dd1cc40b5adcaa00c1dd5182402fc372618313a8a540a4072af32a6942b629f0b69d054064f7afc69fb752d7e1863f8bbf825bb28e863dd96ee35c3863b6f
TLSH
T13A411C58AAFA1148B3B76F569BF6A86E447F7C372E07D45E00120D4F0673A00C9A2B37
MD5 SHA1 SHA512 TLSH

Submit Download