e5ead6cc68756c1b84b16d168dd72a107e8d127be81a900d255f492a48ffc487

Resubmissions

02/07/2026, 12:28

260702-pnf3baas4w8

02/07/2026, 12:17

260702-pf4hmshz314

Analysis

max time kernel
898s
max time network
799s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 12:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
email-html-2.html
Size 21KB
Sample260702-pnf3baas4w
SHA256 e5ead6cc68756c1b84b16d168dd72a107e8d127be81a900d255f492a48ffc487
MD5 e065fdba4c7b721471e9d28572dd1af1
SHA1 9249a0a37717eb64440431b71f51bd79398b83f0
SHA512 88567646763b17d9bff9bdeffe9e80b30335ad2bfcb9dbf5745ce4cabe16fc5581a2211c646f92ed61f046ab008827be853ddf9b80a4370187724752731dd55a
SSDEEP 384:B7BmOTcQOTKRpMkDISqXPGvtgDY6v2f2Wi+2Kq38Tq:B7BmOTcQOTcQ9ZHsq
TLSH
T1A5A20D03F3C11C06D99F48A5A017337D3E7895C68F760E74A29B7B7E568DCE39691288
MD5 SHA1 SHA512 SSDEEP TLSH

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5348	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134274689140670493"	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2639994890-966400312-4246138405-1000\{6A3FE62F-6C26-44C4-985F-97B585DDFA73}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2639994890-966400312-4246138405-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3084	msedge.exe
3084	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe
1636	msedge.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 1636 wrote to memory of 5764	1636	msedge.exe	88
PID 1636 wrote to memory of 4884	1636	msedge.exe	90
PID 1636 wrote to memory of 5348	1636	msedge.exe	91
PID 1636 wrote to memory of 4884	1636	msedge.exe	90
PID 1636 wrote to memory of 4884	1636	msedge.exe	90
PID 1636 wrote to memory of 5632	1636	msedge.exe	92
PID 1636 wrote to memory of 5632	1636	msedge.exe	92
PID 1636 wrote to memory of 5964	1636	msedge.exe	93
PID 1636 wrote to memory of 5964	1636	msedge.exe	93
PID 1636 wrote to memory of 5964	1636	msedge.exe	93
PID 1636 wrote to memory of 5252	1636	msedge.exe	94
PID 1636 wrote to memory of 5252	1636	msedge.exe	94
PID 1636 wrote to memory of 5252	1636	msedge.exe	94
PID 1636 wrote to memory of 2400	1636	msedge.exe	95
PID 1636 wrote to memory of 1944	1636	msedge.exe	96
PID 1636 wrote to memory of 2400	1636	msedge.exe	95
PID 1636 wrote to memory of 2400	1636	msedge.exe	95
PID 1636 wrote to memory of 1944	1636	msedge.exe	96
PID 1636 wrote to memory of 1944	1636	msedge.exe	96
PID 1636 wrote to memory of 4776	1636	msedge.exe	98
PID 1636 wrote to memory of 4776	1636	msedge.exe	98
PID 1636 wrote to memory of 2764	1636	msedge.exe	99
PID 1636 wrote to memory of 2764	1636	msedge.exe	99
PID 1636 wrote to memory of 1824	1636	msedge.exe	101
PID 1636 wrote to memory of 3244	1636	msedge.exe	105
PID 1636 wrote to memory of 2868	1636	msedge.exe	106
PID 1636 wrote to memory of 1328	1636	msedge.exe	107
PID 1636 wrote to memory of 6096	1636	msedge.exe	108
PID 1636 wrote to memory of 6096	1636	msedge.exe	108
PID 1636 wrote to memory of 3084	1636	msedge.exe	110
PID 1636 wrote to memory of 5988	1636	msedge.exe	111
PID 1636 wrote to memory of 5988	1636	msedge.exe	111
PID 1636 wrote to memory of 3228	1636	msedge.exe	112
PID 1636 wrote to memory of 3228	1636	msedge.exe	112
PID 1636 wrote to memory of 5472	1636	msedge.exe	113
PID 1636 wrote to memory of 5472	1636	msedge.exe	113
PID 1636 wrote to memory of 4328	1636	msedge.exe	114
PID 1636 wrote to memory of 4328	1636	msedge.exe	114
PID 1636 wrote to memory of 2448	1636	msedge.exe	122
PID 1636 wrote to memory of 2448	1636	msedge.exe	122

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\email-html-2.html
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x284,0x7ffd0c98c188,0x7ffd0c98c194,0x7ffd0c98c1a0
  2⤵
  PID:5764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1596,i,5088881107961281881,11862266707687255684,262144 --field-trial-handle=2616,i,5222666935492105669,13238455193976934904,262144 --variations-seed-version --mojo-platform-channel-handle=2612 /prefetch:2
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1824,i,9518840764108663021,3783017559077101740,524288 --field-trial-handle=2616,i,5222666935492105669,13238455193976934904,262144 --variations-seed-version --mojo-platform-channel-handle=3224 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2312,i,414008245100443180,5307676158050192323,524288 --field-trial-handle=2616,i,5222666935492105669,13238455193976934904,262144 --variations-seed-version --mojo-platform-channel-handle=3432 /prefetch:13
  2⤵
  PID:5632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3348,i,16656976705825100338,11717166951699010852,2097152 --field-trial-handle=2616,i,5222666935492105669,13238455193976934904,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:5964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3352,i,5349798508694295586,16640881322536874989,2097152 --field-trial-handle=2616,i,5222666935492105669,13238455193976934904,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:5252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4192,i,4608533272267681890,4361238015065415224,2097152 --field-trial-handle=2616,i,5222666935492105669,13238455193976934904,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:1
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4204,i,13156735200645782094,11185844471943185084,2097152 --field-trial-handle=2616,i,5222666935492105669,13238455193976934904,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:9
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5228,i,6284922178296072649,10547415098356235555,524288 --field-trial-handle=2616,i,5222666935492105669,13238455193976934904,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:14
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5216,i,2264281920261022382,8328518774802221274,524288 --field-trial-handle=2616,i,5222666935492105669,13238455193976934904,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:14
  2⤵
  PID:2764
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6092,i,16917517007620734228,15270337205229281904,524288 --field-trial-handle=2616,i,5222666935492105669,13238455193976934904,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:14
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6092,i,16917517007620734228,15270337205229281904,524288 --field-trial-handle=2616,i,5222666935492105669,13238455193976934904,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:14
  2⤵
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3748,i,3948739991726363255,1028893281534391111,524288 --field-trial-handle=2616,i,5222666935492105669,13238455193976934904,262144 --variations-seed-version --mojo-platform-channel-handle=4532 /prefetch:14
  2⤵
  PID:3244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4752,i,572414937413796735,6021968451398649141,524288 --field-trial-handle=2616,i,5222666935492105669,13238455193976934904,262144 --variations-seed-version --mojo-platform-channel-handle=4572 /prefetch:14
  2⤵
  PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5176,i,10507005650945828001,8210409261100617118,524288 --field-trial-handle=2616,i,5222666935492105669,13238455193976934904,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:14
  2⤵
  PID:1328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5452,i,8616918486728126821,8750048052299248685,524288 --field-trial-handle=2616,i,5222666935492105669,13238455193976934904,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:14
  2⤵
  PID:6096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6484,i,6182949242396049736,10353689107040255827,262144 --field-trial-handle=2616,i,5222666935492105669,13238455193976934904,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,3372995282704481424,6511651724085460935,524288 --field-trial-handle=2616,i,5222666935492105669,13238455193976934904,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:14
  2⤵
  PID:5988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,12582862990973429314,15906400929890406340,524288 --field-trial-handle=2616,i,5222666935492105669,13238455193976934904,262144 --variations-seed-version --mojo-platform-channel-handle=2652 /prefetch:14
  2⤵
  PID:3228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1116,i,13838789973342367404,18295578837487876109,524288 --field-trial-handle=2616,i,5222666935492105669,13238455193976934904,262144 --variations-seed-version --mojo-platform-channel-handle=6560 /prefetch:14
  2⤵
  PID:5472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,16758517259458086507,15298200339810880756,524288 --field-trial-handle=2616,i,5222666935492105669,13238455193976934904,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:14
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6016,i,42898949429230383,6138180407673587628,524288 --field-trial-handle=2616,i,5222666935492105669,13238455193976934904,262144 --variations-seed-version --mojo-platform-channel-handle=2936 /prefetch:14
  2⤵
  PID:2448

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5612

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1548

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:2388

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bf637ca0b28ebd6e948876848ccfe71d201158d460d4ad944f124f9d17ee5472
MD5 827e00d89fccbbde703c679b5c7ff536
SHA1 6d9e235782beb4e6b38fd4db2946f9bfc725110c
SHA512 1d18100db386f25678d8dabb492ab6e15d08e2c5a7d7e6c76bc253df648e2b5438cbc4fcb5a4033a1e14afbda93b271225eb5f545f12663d6bc35ca51239fcc3
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7X:fwUQC5VwBIiElEd2K57P7X
TLSH
T148B3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 674d24008448b140a9b320032b4ed333cf5a592b073bf375c453c816d33c703b
MD5 b989ec4e221bd567659492bc1ad7ab3b
SHA1 372670805b3060960e77e6ba32a3b9edd0241cf0
SHA512 f6934e6a831bcac97110107a79389dae0e669b743e0d62e5b411c19471bf237f4d61c7cee27d9fcacbd7045cbe27e78b4e6c38f6e76ca789a7760295558b0bb3
TLSH
T1CBD0C0383E28F508C5402076E4504310E3238131742B8242B010F02DEC581810BDF0DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5e1a5fea1006889b9c3bcf0a470a6a4256d5300a4b7036038ddce5fd042c424c
MD5 e9af81b8f1175d007e2c699939cb3df6
SHA1 696178bffe86e4e363a26747d6a5cb80e28621ce
SHA512 38174d529846c50b0af9a056e65ca491645c3cbf1fb867ef22a3b7c7ee4287ba29c3a28d736bc2e9c562faa24bb671db3b9cc40507a467140e47eaa4aeae6d51
TLSH
T145D0C0343E38F408C540207AE4514310E3138131302B8242B010F03DEC581810BDE0CF
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 357B
SHA256 5f3f2c81a2f93bd45f4afc9de4312596f05c3f48e58687c6992a20dbff873644
MD5 84c31ee5c92c6d3dfa8c900b38ba5fd3
SHA1 957efb11ea0c2c21c437080bd30dc58cd368e8f2
SHA512 43222260171d76bd3f41521f5bb7f5773011ba0641e1b8a65e825e80308f58eb13eeabb82d00dba1aa3cdf90fe1a88fb67f9b6584b483879b4f40cfdcf1b8672
TLSH
T149E048565390DA993203AE4FA25CE3384BD3717A95C9D97F2A047D9464C10016BF95EC
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 7928fd4696b28f08e4d319a4c4a6fff70df9abb1b7f1cd3dbd756c1aeaf7e33b
MD5 cc83c6f1b093326deef97bbc82c91226
SHA1 532ab5d085c185f0eb7ca2c6bd734deea67c080c
SHA512 59aa644de45e6982b58c921e5ea990adf1aaa10c366a962c18415d6ea364fb535263b6c5d671dacc7c8dd3e888b19fc2a33bcd32529e5b225e7444de0a082a53
TLSH
T11DE020C506C5C65D5101644F615C970CC5C13B1BA2C4FD8F170488797643480E7D35E0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 357B
SHA256 9aaf0b1cbce09cb0f6a173a5b24c1869c09d1238497986fc462a211ac963fc54
MD5 9e684d3674f24bd07213404c6c437661
SHA1 b483e0ff665b688f94ed3f931ef604d626b50b3a
SHA512 4c93e156f0e8f1bfba1173208e29928e1e9ce80f53202122dc41a73103b62f52b33d62326a2b7fb904d7425c2106a23257b0b8ca0999e3915597099dffb169d8
TLSH
T10FE0926543A0C5F81187DECEB2AEF72C44C7743DD5C8E85E6A04AC9924404006FA10F5
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 274B
SHA256 ca4dd2b8226ab35c8c0f0117fefcf4fa3af285ac59f3f03d1365d6abcca21208
MD5 f37365728182a768d79454f7e9427214
SHA1 a723dc8455513475021090f568a1afac6345dc95
SHA512 b870f9eb12c20246f0a97dcd71bac235b88da47f647d28133067fc4febf6ff1cf3e0160f5ce7bbd143920618b53f34cf9e16f0f7706fd56e9d923ff1f6654c9d
TLSH
T166D0C2F8A88C688FD7E52AFD4262B0400F6446D29826DE020119F9C136649F01F52070
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 9c6c4e5a65374b340f0dc7d0e67a8c63d894c41d0de6ae634242f7a66ef4e331
MD5 451a46ca5dad273cbf5a42cc400cca62
SHA1 05676945427a74ae5e985e01f7ac2af78daac7b1
SHA512 f904f6bf52436f2c2374ee8e35ccdecaf74ffa3835c25611b44412df66cb8bdb7d83f9168a68ef3027b6157479c7148f3453c9b36436e47ec1e5a8f2c10fd9d5
TLSH
T13E61C7309C9D2A21CF2E207553DD90853F70E49235031FAE02BE9579BF4AB4DB2500F9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5970f0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5970f0.TMP
Size 3KB
SHA256 ad6fbce586681a49a0a14c60707a6cf4aba884392b17d9d4390219e75149b8a1
MD5 6cadeb08c626e543d05999afb418a7ca
SHA1 7cb75def84c951fd9b1df1b25651b86b266b79aa
SHA512 9fc651f99c40353d5cfcb9bd21424062846ac427370d154218249bba6a4eb28bf356f18014c9c25e2af788de131a75f40fe85ba11b20a3071f1dc09886cf693f
TLSH
T1A261B4349C9D2A21CF2E207153ED90893F70E49235032FAE02BE9579BF4AB4DB6500B9
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 f9bf6be9bd401d4025bf329920d885e337210447cbdc2f1e08e1e13729e59005
MD5 f97a4dab5ff646e8ff048b35105e0e42
SHA1 733bdd1d1475a60fcf76e73b68066281f8ad8e88
SHA512 9411409a0a60f7b13052e3cfda4f28ba96392fe529aa1a7f02bc7143af66b4ae16008219e65dffbe4db969c31bf938bfade0ed4866570eac96125a7c3728bd52
TLSH
T1ED41AAF7C3E4857E891186F0FA186E2BCE2D0915832C7C5A89E4AF1BA3E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 fb959b6bcfe287a5bcd0775aa708895dd293cd697fd9a213049c66acaca3a2cf
MD5 5aed5d200ae103aa1641d90b715ea8c1
SHA1 5917fa0ea198621e88d81ae57f4ad1f765c0d455
SHA512 5efc806ecc10ae6a0afe9d1be07482a25cdd71b4a977a11af855a5453e5d330e3a65f700853ec66d2fefb777f41d72986813d8c5f24415efee66b98f1831370a
TLSH
T1AC41BFF783E4856EC90156F0EA186E2BCE1C0515832C7C5A85E4AF1B93E2471E141A6F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

a7757778-ec94-48db-918c-55980c6a7cd6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\a7757778-ec94-48db-918c-55980c6a7cd6.tmp
Size 1KB
SHA256 817d3af83cd4c9e2ad4cfde855b9b667674880b474d93f0b7a788ef03f0edd57
MD5 64e253ddd550ea17760572cb6056233f
SHA1 bf1451920142425df55b7dda9e0e2e63d898d956
SHA512 4b3a20df74ce830830826f14a236496fa1550c7cb25767e208f17c037aeefef7c1066ad90e897e43155fc8f28d2ce78fa57eb037378ed284c18098e783603c4a
TLSH
T11D417AF7C3E4856E890156F0FA186E2BCE2D0915832C7D5AC9E4AF1B93E2472E14196F
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 fb8515d235ea8dbf9a4897d5a07b43700878a61909780f77e3cffa3d3297ca1c
MD5 a0db40d5a3535543084d72e265b5bffc
SHA1 49d7fa3437ec90e5210937107e70ac88cf56f2b9
SHA512 4ee2fb536a72d264c49ca426d4612eaa5b3f2cdaa28d61d21430e1f14230442e26d7d039320c38f143bef181fa6691ba9835a3d98fe74d506d51593d77f1bd65
SSDEEP 192:sxRRRFyM/jK1Ml8UQSFd/f4eHsJKlVE1jVCzoA8peO/g6+WNIY+xuF+GD8IgDKJ:sxRRDqYd/f4eHsJK/ijRJ/5IqFei
TLSH
T18362D815A634597B8CDBD209FA967F53D2F91573A2901E44AAFCCA0C01E76ED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 c11b91675e4025aa4e892442aead0f79a78e8cfcd0a5f0fca02bbd12d28f6097
MD5 227fc41f50317cb2bdeaa96ccbf6d4a6
SHA1 fc823c9cf657e59aeb7ac6047549c57acffa34af
SHA512 e96cf5c30490e35da7872ddca0aceb351ee04a51914f33cfc4e04332f01eb24ca4c9b474441d1c6321b640354ee6dbcf16c13cc14c1636a0e62468a031625af3
SSDEEP 192:sxRuRFyM/jK1Ml8wFd/f4eHscKlQE1jVCzoA8p4O/g6+WNIY+vuF+GD8IgIJ:sxRuDbd/f4eHscKyijRD/5IEFes
TLSH
T17952E8056A34597B8CDBD209FA567F53D6F81573A2901E44AAFC8A1C01E7AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 2a83592b0817fea975baa89476b57b44a565daf680a3c817f1cb426969681df3
MD5 c192aca40ae3ae38cf94ed9ee094d96e
SHA1 0a79aff8974e8e49ccf0542a2f5f489432e53caa
SHA512 e542f4ac49d49b186ea78fd7b81bc9812614e964e6b9f7499a2ebdf6f35f10276bd29faef63f418ffb01f4aa7e3e392a1c1fcc963f9075f0452e573abcfec67c
SSDEEP 192:sxRRRFyMqZjK1Ml8UQSFd/f4eHsJKlVE1jVCzoA8peO/g6+WNIY+xuF+GD8IgDKJ:sxRR2qYd/f4eHsJK/ijRJ/5IqFei
TLSH
T1E662E916AA7459778CDBD209FA967F53D2F91173A2901E44AAFCCA0C01E76DD2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 ed7287dd5552e887cbfcdb8a14f6ec19088bc9b2eef0ac11c8f8523dc8bf004d
MD5 c96dd1ad844c467303ab1469d2a106b5
SHA1 c0d53c8be4a404ff7f09f1d834c2d1ebfe04b0b5
SHA512 952d4ef633c4b6b7afbfaa10b92c64a52322cf561457f23222ef5c012c7bfb08e412ad241cb581fc964ba325b5e54dee66b679e214502cba480c598462d368a5
SSDEEP 192:sxRRRFyM/jK1Ml8wFd/f4eHsJKlQE1jVCzoA8p4O/g6+WNIY+vuF+GD8IgD4J:sxRRDbd/f4eHsJKyijRD/5IEFeo
TLSH
T13E52F905AA34597BCCDBD209FA567F53D6F81573A2901E44AAFC8A1C01E76ED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 b9a1a12533b9aab9c703e9448f4938d0df8f42e0624473ed39d40f0aeac54bfc
MD5 4a3bdb5ae5b733d387ee9662b81cf423
SHA1 a040e8b65b042403daf13b38cd9ccb5111a1bc67
SHA512 444cb145a8f96e393dcab257d7f9b64388004a623f5b793e4d8baa5282021abb3924b7a3092218c9095443478b5f20de4cd00bd504aba6cb76c2aca9b731a174
SSDEEP 768:7dUhjgWgEyf3w8F1+UoAYDCx9Tuqh0VfUC9xbog/OVIe0Gxrod4LS:7dUhjgWgEyf3wu1ja9RGKdqS
TLSH
T1B4C20B3B640CC77F4F844A9DEC29AE976DD801CB9B588D5447FA890C03C77EB921A49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\546debcb-1733-4547-b4db-916d75206e0d\index-dir\the-real-index
Size 792B
SHA256 fe90d2f17738e8f73e1f377404e24b4acae763c3f5e544c3bb07e8cdb1034a45
MD5 84886243fce2d228c8041ce3800394e7
SHA1 00b9a0fcf0872fa4ee3498025a847e9f3e3c921a
SHA512 91fe44de7d58e614df7614bf8d3082a8d7ce694ea82c324fba4e42053b88c57c5bc99701925bb06c9e82c47aa11d25f0ad2530fdd6a414198db1c1ce035af58b
TLSH
T1C101ACA6ACC16C03DE11C1772A32B00E33F656EE38489B57116D783D8963B69505018C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5db3a3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\546debcb-1733-4547-b4db-916d75206e0d\index-dir\the-real-index~RFe5db3a3.TMP
Size 792B
SHA256 62bb8c443e02361ea193bde48264992714dd7b9351be02e53a31a4615d72fd3f
MD5 cc3343d0adc5749b91cc282004f70d51
SHA1 aaaac817d4b22250152a0df9ec4c87a87268d820
SHA512 fd6c2985dc442b20f3470b5a92f00fc2a982daaad20b557858f4406ad24ae05e46775b5b868b5ba8db4c11bc9a8cddd7a3e52b8ec1cb1288c49df14c718e7408
TLSH
T13201E19555D1AD43DE01C1F61A07500D33BB98703244EA0710E5B47D0573A2D655019C
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 527f172bdb2538203f32366d045cffab89d35e8f2b2fc32880d7694c635eed2a
MD5 edb255a5198ae1a1d5563ef5a258228a
SHA1 0f84e19b63bf6f476755b6946e3be4806384c8fb
SHA512 86f4b95445c2d8f739692a32c34c08245c31975a86d2a9a1332b825c07f7b5a57ad500f5c5b949bc1db5f4881498c4a26a38cdab4931ac4266bc2a274258c4c9
TLSH
T104E0C0B62DF60714FD9FD3C5283184A904007978C585FE4F103EA1D314B23632889CA5
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 75bf736a3dd162c97824c0cae47511b53c192e1fddf79f71f0af80da97804e63
MD5 edceb43ecd01a0e3a2df428734c744ac
SHA1 dc723c4fb37ee88814bb1b57380d7513046d470d
SHA512 4024a430352d794c1cdbe7c467142fef8eb99d8bdb4e4cce3db8ea0d64356f6f636515694c45692f399c5220446cea8fae431e4435110bbf4a935c1deefc497d
SSDEEP 96:K4DiK44yGd6KWQWU1gkeCGEWCPvgsEK4hgmEcEkveEZHCHuC0UECz:85V9U1gkeCG7CPYs4hgmrEkveEZHCHua
TLSH
T15991A852757B2780383D240D8369DC2A52837092349EF52B7BB951E61FABE104FFDAD8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a0be8.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a0be8.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 e4b916de1645363e0d5550a8af3a648f6f25cb50eb4a31daabe6fcdfaec84389
MD5 7a2781637d57811e22912f032174042a
SHA1 775f1a4e55511640a2b21798ef58562c3ba3e298
SHA512 c00a5024cc10a63985d1a95ab28cec24edb37c19a3a9d9b86632b2e319edddab7f882fd4148d080e2f510b40d9ed0266af547390d098dca19416fc04ee31e4fd
SSDEEP 768:9j+9i3nBGv/5CMcvnWgWWR+2SrXH78tRMFhDl8BvTPago:49i3nBXJPWg1bSro2hDl0Wgo
TLSH
T1DAF2AD31AC554DB38DF2DA84B2077243BEE44193E2CC2E98C4DC6B0E46DB69D2747D69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 f7ad990909245275d18013cac19c7c524b15b5a076d14e5c1445b592292b4b54
MD5 d332b7015d47f7bed1152d513550133b
SHA1 c9b7ca2576ebc53e87290ec67646f088dd1cb9e2
SHA512 787898a5508498246731bf83b4c2cfcc92a17bdf25f97150acf4bf90637541742626ecdce35321f0d46e2d7470f734c1523eba37492395ff97db1f6aee3bbc85
SSDEEP 768:9j+9i32BGm/5CMcvnWgWWR+2SrXH78tRMFhDl8BvTPago:49i32BOJPWg1bSro2hDl0Wgo
TLSH
T1FAF2AD31AC554DB38DF2DA84B20B7243BEE44193E2C82E98C4DC6B0E46DB69D2347D79
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 5b2903b88dd143ae51eacc3944daeed71f230f51c4f2e92a0b9687c9169169e7
MD5 965d0bbb0cec04ffad9980334813fe3e
SHA1 aeee78c17042d6f295f623f569d5f88b20841e9d
SHA512 fa4c4303baafffb5cf3decb01c45033e093149564bc3b0901abf5a4344ac8d99429fb4527e33d14a27a0577e1f3b447216af17e9c7c70e931ad245fb5d9e88b4
SSDEEP 768:QF1j+923TwgjBGv/5gMcvnWgWWR+2SrXH78tRMFhDl8BvTPago:9923ZBDJPWg1bSro2hDl0Wgo
TLSH
T15603AE32AC548DB78DF2CB84B20B7343AEF041A3D5C86A98D6CC6E0D129B6DD1347D69
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 2a5b4d2c087c4c293d4e171c636b5c533ea0953864d9c96af7533da77e8e8ddd
MD5 ca523ec6fe609b59b5d1e22f50a81baa
SHA1 f4f647cd83a2364c7753c9d23fdf32f16f582788
SHA512 37dd9310679598fd1ce0386f5fe305f8268b959ced90600e06c14793068f333d9c8d21eba251c3d5ab6345d9ac66b161ed2b04ca1014dd7ebdbe614598bd97ce
SSDEEP 768:Orv+4UNbdp3UD52McvnWgWWR+2SrXH78tRku+8rr6F:Obsb/39JPWg1bSrozDr6
TLSH
T11903BF32A8684973DCF2D685720B76037FF44193E6C91B88C4D91B4D429F9DE270BDA6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9b6e33ed-2b78-4300-ba79-a59fb8ac0d80.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\9b6e33ed-2b78-4300-ba79-a59fb8ac0d80.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download