10f8f0f973673501fe0b21c1dc7fb0e2c7a2e11d1d3e5c84528f3466fa551b7b

Resubmissions

07/07/2026, 08:45

260707-kntaesbs8p4

07/07/2026, 08:34

260707-kgnrcsdz2w4

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/07/2026, 08:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
IT2672970656157.html
Size 17KB
Sample260707-kntaesbs8p
SHA256 10f8f0f973673501fe0b21c1dc7fb0e2c7a2e11d1d3e5c84528f3466fa551b7b
MD5 692ad86fc5fcc328241a26764523d2c4
SHA1 61a9de1d2ca00deedb7696736d7892eec0180717
SHA512 21e76a2d38413a43621cd93eba6a87752e707fa00236768329c7dcf74cd1a70da229440e50383c5b4c0696ff42babe54b78e7c3a20b0b69280db08297204d23c
SSDEEP 384:TnaXYvhnajYtX18YaKHZS19kbEOCEqAbmX97M:jIQyuyhK5GkbEXEq9XS
TLSH
T16E82DB2089E501557F432388BFD3E0A556A4C2538B15C6A4FEDD43CC9FDB5E8A2B276C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3680	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134278875244819635"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{47248DAD-A931-4700-8AB5-35737FC1C515}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3460	msedge.exe
3460	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 21 IoCs

pid	Process
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe
4352	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4352 wrote to memory of 2816	4352	msedge.exe	85
PID 4352 wrote to memory of 3680	4352	msedge.exe	86
PID 4352 wrote to memory of 1052	4352	msedge.exe	88
PID 4352 wrote to memory of 1052	4352	msedge.exe	88
PID 4352 wrote to memory of 1052	4352	msedge.exe	88
PID 4352 wrote to memory of 4452	4352	msedge.exe	89
PID 4352 wrote to memory of 4452	4352	msedge.exe	89
PID 4352 wrote to memory of 2036	4352	msedge.exe	90
PID 4352 wrote to memory of 1360	4352	msedge.exe	91
PID 4352 wrote to memory of 2036	4352	msedge.exe	90
PID 4352 wrote to memory of 2036	4352	msedge.exe	90
PID 4352 wrote to memory of 1360	4352	msedge.exe	91
PID 4352 wrote to memory of 1360	4352	msedge.exe	91
PID 4352 wrote to memory of 1620	4352	msedge.exe	92
PID 4352 wrote to memory of 1620	4352	msedge.exe	92
PID 4352 wrote to memory of 1620	4352	msedge.exe	92
PID 4352 wrote to memory of 1272	4352	msedge.exe	93
PID 4352 wrote to memory of 1272	4352	msedge.exe	93
PID 4352 wrote to memory of 1272	4352	msedge.exe	93
PID 4352 wrote to memory of 1792	4352	msedge.exe	97
PID 4352 wrote to memory of 2272	4352	msedge.exe	98
PID 4352 wrote to memory of 1792	4352	msedge.exe	97
PID 4352 wrote to memory of 2272	4352	msedge.exe	98
PID 4352 wrote to memory of 1660	4352	msedge.exe	101
PID 4352 wrote to memory of 760	4352	msedge.exe	102
PID 4352 wrote to memory of 760	4352	msedge.exe	102
PID 4352 wrote to memory of 760	4352	msedge.exe	102
PID 4352 wrote to memory of 4380	4352	msedge.exe	104
PID 4352 wrote to memory of 4380	4352	msedge.exe	104
PID 4352 wrote to memory of 4380	4352	msedge.exe	104
PID 4352 wrote to memory of 3320	4352	msedge.exe	105
PID 4352 wrote to memory of 3320	4352	msedge.exe	105
PID 4352 wrote to memory of 3320	4352	msedge.exe	105
PID 4352 wrote to memory of 4268	4352	msedge.exe	106
PID 4352 wrote to memory of 4268	4352	msedge.exe	106
PID 4352 wrote to memory of 4268	4352	msedge.exe	106
PID 4352 wrote to memory of 4328	4352	msedge.exe	113
PID 4352 wrote to memory of 3412	4352	msedge.exe	114
PID 4352 wrote to memory of 1664	4352	msedge.exe	115
PID 4352 wrote to memory of 1768	4352	msedge.exe	119
PID 4352 wrote to memory of 1768	4352	msedge.exe	119
PID 4352 wrote to memory of 1768	4352	msedge.exe	119
PID 4352 wrote to memory of 4540	4352	msedge.exe	120
PID 4352 wrote to memory of 4540	4352	msedge.exe	120
PID 4352 wrote to memory of 4540	4352	msedge.exe	120
PID 4352 wrote to memory of 1664	4352	msedge.exe	121
PID 4352 wrote to memory of 1664	4352	msedge.exe	121
PID 4352 wrote to memory of 1664	4352	msedge.exe	121
PID 4352 wrote to memory of 4848	4352	msedge.exe	122
PID 4352 wrote to memory of 4848	4352	msedge.exe	122
PID 4352 wrote to memory of 3868	4352	msedge.exe	123
PID 4352 wrote to memory of 3868	4352	msedge.exe	123
PID 4352 wrote to memory of 3868	4352	msedge.exe	123
PID 4352 wrote to memory of 436	4352	msedge.exe	124
PID 4352 wrote to memory of 436	4352	msedge.exe	124
PID 4352 wrote to memory of 436	4352	msedge.exe	124
PID 4352 wrote to memory of 3648	4352	msedge.exe	125
PID 4352 wrote to memory of 3648	4352	msedge.exe	125
PID 4352 wrote to memory of 3648	4352	msedge.exe	125
PID 4352 wrote to memory of 1108	4352	msedge.exe	126
PID 4352 wrote to memory of 1108	4352	msedge.exe	126
PID 4352 wrote to memory of 1108	4352	msedge.exe	126
PID 4352 wrote to memory of 2480	4352	msedge.exe	127
PID 4352 wrote to memory of 2480	4352	msedge.exe	127

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\IT2672970656157.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2a0,0x7ffc705dc188,0x7ffc705dc194,0x7ffc705dc1a0
  2⤵
  PID:2816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1936,i,14556588599866943936,15508776917761487478,524288 --field-trial-handle=2272,i,5610755484492500556,14469285471371552684,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,12222978110213192415,6095615322833476743,262144 --field-trial-handle=2272,i,5610755484492500556,14469285471371552684,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2316,i,7824296065068979459,17199401813271023686,524288 --field-trial-handle=2272,i,5610755484492500556,14469285471371552684,262144 --variations-seed-version --mojo-platform-channel-handle=2468 /prefetch:8
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,5360390214771683501,1473820959774853731,2097152 --field-trial-handle=2272,i,5610755484492500556,14469285471371552684,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,6265081843230610814,13082864291897247867,2097152 --field-trial-handle=2272,i,5610755484492500556,14469285471371552684,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:1360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4184,i,5391964751682919637,5714083050136259308,2097152 --field-trial-handle=2272,i,5610755484492500556,14469285471371552684,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:1
  2⤵
  PID:1620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,13982627624779635885,6062945753138615178,2097152 --field-trial-handle=2272,i,5610755484492500556,14469285471371552684,262144 --variations-seed-version --mojo-platform-channel-handle=1644 /prefetch:2
  2⤵
  PID:1272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5068,i,17635370803879356067,13549700083528419956,524288 --field-trial-handle=2272,i,5610755484492500556,14469285471371552684,262144 --variations-seed-version --mojo-platform-channel-handle=5160 /prefetch:8
  2⤵
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5072,i,15238392249267698974,14394702291203264913,524288 --field-trial-handle=2272,i,5610755484492500556,14469285471371552684,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,16521612420307920800,7482714185395170776,524288 --field-trial-handle=2272,i,5610755484492500556,14469285471371552684,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,16521612420307920800,7482714185395170776,524288 --field-trial-handle=2272,i,5610755484492500556,14469285471371552684,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:8
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5932,i,7039992250714330482,13315219617357307070,2097152 --field-trial-handle=2272,i,5610755484492500556,14469285471371552684,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:1
  2⤵
  PID:760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6412,i,3227392510097678209,1940631636804675847,2097152 --field-trial-handle=2272,i,5610755484492500556,14469285471371552684,262144 --variations-seed-version --mojo-platform-channel-handle=4140 /prefetch:1
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5924,i,7802154112545429334,13931862510220587991,2097152 --field-trial-handle=2272,i,5610755484492500556,14469285471371552684,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:1
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4204,i,14644484382707848162,4326229899761080032,2097152 --field-trial-handle=2272,i,5610755484492500556,14469285471371552684,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:1
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6500,i,5303014330878783135,3013517701395034091,524288 --field-trial-handle=2272,i,5610755484492500556,14469285471371552684,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:8
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6400,i,14830243495947112006,7180520731901466757,524288 --field-trial-handle=2272,i,5610755484492500556,14469285471371552684,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:8
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6420,i,4233687552688741371,12988929964986674342,524288 --field-trial-handle=2272,i,5610755484492500556,14469285471371552684,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:8
  2⤵
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5888,i,18342702539827036833,17910081414221397635,2097152 --field-trial-handle=2272,i,5610755484492500556,14469285471371552684,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:1
  2⤵
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5208,i,2095922453937109368,7971026921876132342,2097152 --field-trial-handle=2272,i,5610755484492500556,14469285471371552684,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:1
  2⤵
  PID:4540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5248,i,4454483229940395383,15752251011053066094,2097152 --field-trial-handle=2272,i,5610755484492500556,14469285471371552684,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:1
  2⤵
  PID:1664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,15965391667756346743,5396383035456782954,524288 --field-trial-handle=2272,i,5610755484492500556,14469285471371552684,262144 --variations-seed-version --mojo-platform-channel-handle=6736 /prefetch:8
  2⤵
  PID:4848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6384,i,3186760122034891846,12419737076750551050,2097152 --field-trial-handle=2272,i,5610755484492500556,14469285471371552684,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:1
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=5972,i,9392262576022353382,1760727142842259959,2097152 --field-trial-handle=2272,i,5610755484492500556,14469285471371552684,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:1
  2⤵
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=5252,i,16732033061524033635,7403254926001375628,2097152 --field-trial-handle=2272,i,5610755484492500556,14469285471371552684,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:1
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6656,i,8762546569020426314,15367804733779186320,2097152 --field-trial-handle=2272,i,5610755484492500556,14469285471371552684,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:1
  2⤵
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=6596,i,3135593594881632588,12299252777552394134,2097152 --field-trial-handle=2272,i,5610755484492500556,14469285471371552684,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:1
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5460,i,1133767452010509456,18312141940529585629,262144 --field-trial-handle=2272,i,5610755484492500556,14469285471371552684,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=3520,i,13790393003672708809,9650626382378736536,2097152 --field-trial-handle=2272,i,5610755484492500556,14469285471371552684,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:1
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=2128,i,10165663746546479138,15456282185708379938,2097152 --field-trial-handle=2272,i,5610755484492500556,14469285471371552684,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=31 --always-read-main-dll --metrics-shmem-handle=4188,i,8580327682117032661,15090562967211492649,2097152 --field-trial-handle=2272,i,5610755484492500556,14469285471371552684,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:1
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=32 --always-read-main-dll --metrics-shmem-handle=5156,i,17836435982316995446,5620832243440264890,2097152 --field-trial-handle=2272,i,5610755484492500556,14469285471371552684,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:1512

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1348

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 083d78ea5ea69126b24164f2e05fc467ce21fdcdf2ec67f8e94c4366a1284886
MD5 da79f81681859af2b76762aa37a5f73e
SHA1 53d69c959eb46848bc7ed7b5c480df864295389e
SHA512 f647681c342e36fa2f41fb9d54d089303f98b802703a42609226ef5755aafc91ef00af41a82f980c0f2819709322c59ef6cd1c18725ef5133691894902fc44c1
TLSH
T1FCD09B7077CDAC11D5450471D45547535D96CA4C24D7DB076011801D68557D9B35E067
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 9063717c49a2c3b42bd126be4ac5ee157580a28130095ffd327af405c3c98619
MD5 f038e570d40404e5ad0d2ccd8e188a93
SHA1 80c50ac8371a8981908d333514badec7ef23e3bb
SHA512 e61a92fd13c9b6ac481ab4fb2adec02a30797f0effef6f9b28de15752c688a663d254250e9be3580442f54bd4a80a37c3f69d831b3fa36edaa0cbb64cc5ed93f
TLSH
T1F6613A7402527282E3E31530D3CA160537B208BDBBDBDE1923B0B87EB536F5A852943B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5903a0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5903a0.TMP
Size 3KB
SHA256 dc6923cbdef155e12f2c46ea219115cbd5b5f45a3f526965c691c490295358ae
MD5 29c4f663bfa8d8e232c59b38482edc0a
SHA1 c87b12b091cd23b72459573ce373cd2fc37eb8bc
SHA512 2d13bdb0ea820fa4d4a4a4208bbe29ea0fc758462c8f0bf1fa9440dd9826ca777f5c2377eb75d0b05f11f06a808b501b7e695cd6bc01f6a5b4a08f044495fc11
TLSH
T1B6613C7402427282E7E31530D3CA160537B208BDBBDBDD1923B0787EB536F5A851953B
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 fb35c05b6d37858ed71636f5c31317bb328932607010167bdaf3f613885e851c
MD5 52ec76a11d145d40bd309aea813cc075
SHA1 3bcad25ed0bcbf3cba24b91cce2febf66e276faf
SHA512 1c3b181120a59c3eecfd92eb06ce86b1d8308412c67c402f006aade527ab7cf093405196e53e271884a86cacf045e5d66efd8d2ce436c090cc949c4e3bdd8e44
TLSH
T12E21ADF783D585AEC91156F0AA28BE2BCE1D0501832C3C5989E4EF1B93E3075E002A5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 7c2bc4121791805fd94fa8fbf3a6179166f7a76d1b19bfcc63d2ac6b90b7af19
MD5 75ebaaf51166e897cc38819fbb93d99a
SHA1 8eb3a9e1598f5d3a51cbf1f34122c5c4cb653f94
SHA512 fc848e867dd387a9480565f08613e85ddd834e2f5671b2998ef271a5327fb7f145c06ab093cf33be48e2bf9b02fcbe64bbb2240383e1cfe8fa9d8495adb8cdbd
SSDEEP 192:sxZ/RYyM/jK1Ml8UQkkH/fSsy9gI1MVYIdpHNCHW6+WNGYwefGlIg5pp8J:sxZ/6q/H/fSsy9NCpwHbG3vpg
TLSH
T13B52D9126A349A77CCDBD219F955BF53D6F9547292900E44AAFCCA0C01E7BDD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 0e25ea149545604a95127c606865a243ed784aa04fbe1f11a166e65d78e77b4f
MD5 0bb273f9ed4cc40ca910bbcdf2e49131
SHA1 6083c06355b6249adb77f9480ff36be208d51c24
SHA512 35978382c8d13374d5dbb7505f94a23ef1d2ad342a1d8443e99a6da4dfccbbf7d3c4b99d2dfdd098440065b5bf94a900ee35bb63166d4cec3664b952140f34c4
SSDEEP 192:sxZ/RYyM/jK1Ml8MkH/fSsj9gI2xYIdpd/HW6+WNGYwKKGlIgUp8J:sxZ/6MH/fSsj9Oxp5HbGYUpg
TLSH
T17742D8126B34997BCCCBD209FA55BF53D6F9556292900E44AAFCCA0C05E6BED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 78698d4aa3231181aaae5723331ea7981635f9fbbfc48ae488f0c773b4075d26
MD5 ba78bce76de3e8748844f4f571f97c70
SHA1 3fdf10b4ea96a0a3af43d605e4974bb565391eb7
SHA512 ef5973efc8a127a7d99665da49fe67dacbdff1548f2ba9fb5ae66b19f6eb8edbf9bd7c9c758a317ee8287a119f793e8e0c040862f709bd14ca624c3ed3bb39c0
SSDEEP 768:ef4jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+d9rohBcHan:ef4jeXmWvmKLEu1jacPLZQd2M0
TLSH
T171D2093B284CCF7E4F844E5CEC26AE976ED801CB6A584D5447FA894C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 729B
SHA256 8d2f0aae7ff70bb0211921262fa34e6854a7bca73e5f3fbfa348d895d69f1c88
MD5 cea09b9b8e87d9527401b39a50a47ac7
SHA1 bd45cb8e539e36edea8a558202a654e8624c579d
SHA512 2fa0eff188605e9572f37c690b8d24afc605e76dbad655dc3184261c114ea6839dfa7f54d495a0a595363bb32d29dfcab7f4aa656821ab0339d6166762160c59
TLSH
T12701C7003A3982053E7EA90C8AD4C616E2D571523714E62FBBA443932F97E038DFCDC9
MD5 SHA1 SHA512 TLSH

Submit Download

3b13dc59-2e37-4c6d-8358-b5fe92b98608.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\3b13dc59-2e37-4c6d-8358-b5fe92b98608.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 df5d0c1c9d9e8d2c34e05be6b00a258c220bf547a208a1f142eb84cf2b887dbe
MD5 7dfcaaccfc20b7f889fa2a5b828333fd
SHA1 5c5265069d6b0d9daeb42803f44b8ec3c1340cfa
SHA512 170ab38a647c23ea5828d21c4feb2b91fb257fb28c212fb7d2aec9f6d8acc6163e8ab777962bf4dbd2074b5b7422dca779d209f5d65cf0ea6c15bd0280ad9e70
SSDEEP 384:gtNn/s3n9SfsNqLEPZjwof+W86nX6wFhOObjI9G6w77:gj+9UKPiw3X6eh29M7
TLSH
T1F9928D32692CAE678DD2E695F48B26178FF8416B97C52F84D5ECAF0C00CB6EC1306916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 0ac935032c70a36e311584d1b1bd88b23f7839dc535ae0bd1e8a6914721081af
MD5 19a295bdac8fe66f9fd94bcf2f56b9c9
SHA1 2e8a819f57a14ad0fa8e967405aaf81cec9f96c9
SHA512 5acb483efc070067915ce131c4d5498ed9de461f703b75a77cb6a7e8f092c29f5a3320416a9bd8baea9711ccfd1fed0604e481d9c265a84bdc53f1ed890cbccb
SSDEEP 384:juiF1tNn/s3n9SczsNy8TUNTUlIliEPZjTof+W86nX6mFhOObjI9G6w77:ZF1j+9fLwg3PJw3X6Yh29M7
TLSH
T125A26C335958CE7B9EE29A95F54B32138FF441ABCAC66B94E6DC9F0C009B2EC1306D15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 63176fe8a4641e0ab3cccb47d9ee8abdf3ed00ea3990d2b72715cecd5d370b57
MD5 67e5bd6b337585ae1fc6c036646edbe1
SHA1 91a9ae9111f2265d3074aa144a59866990e13b30
SHA512 dfd7fe643cd9d7f4735cf385dc02f901918db3a785b4a478047519de4455c77684540ebabb5dd23b29a25a91ebfe6fc422d35c0f35899081b4bf4d05de3a627a
SSDEEP 192:QOND6hZ5QmiUy3bYc/+jV8jzorxonX635cOqQqnU6:QOND6jiYu+W86nX669hU6
TLSH
T12912F9366978AC675DD2A595F48732138FE85127DFC5BF84D6EC1B1C00DF6AC230A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 22c9f52dc9cdae14d33218e1df60dc30342c6424f3f95a96a69412d1f6f06e32
MD5 6779b5fda95f252dd20cd08649ea2011
SHA1 07a32225a4ee630a85306ebc1309dcd778cf3fc1
SHA512 6635b8eb881f8c4e1202752b116672dbef915df4f56c01b613d99f8b7b068f403ba0cb0256edd7d94d2af6dc87d12ccfca279459e06147824bb1dbb9d2836c59
SSDEEP 384:StNn/s3n9SfsNqiEPZj5of+W86nX6wFhOObjI9G6w77:Sj+9UzPjw3X6eh29M7
TLSH
T1CD928D32682C9E678DD2E695F48B36138FF8516B97C52F84D5ECAF0D00CB6EC1306916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9becca4831ecb3c910bf290cccb1eae9c4cdc614b13d119e8784acd9864996a7
MD5 55ccf0e696986c7d276e51be7b426d34
SHA1 0825e9c1cd875fd922d848b6c768c93ee078ef91
SHA512 bd48314c9b5461ed1aff78773eb96cfdbc57cebeaf908be71c01f6d62e9b2246e8f9ce4e4d0ae5522e5201a6afe83406355eac98915931a0e86778ea51cce449
SSDEEP 192:EONz6hZ0QmiUyZbpc/+jV8jzorxoE5wOZftU6:EONz6oKpu+W86721U6
TLSH
T10402E93569786C778EE2AE45F48727135FE4112BEA956B84E6F85B1C00C779C2307836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

cbde7ed2-7ac1-44b7-860d-242e8a5eb642.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\cbde7ed2-7ac1-44b7-860d-242e8a5eb642.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 711bd446e703994d9c2e6ec06d15fdf9ed028b99c9dda47ca858ba04daefb12b
MD5 c402f633c81ee38e1c3c36deaabf6606
SHA1 e1d79ed096bebb23b6f4ddf7466e045b988023a7
SHA512 0f378d3253d99560eb1e45338679e4e3d63a5a6b86d0d6ea15bea14a0ef1a0d6435d0a4677bcf32e258e9e36fe1d2791ea83e8e0a7a615b07c7d495fb2375823
TLSH
T1AE415A58B6F91148B3B36E4AAFF7A86E487A7D772E06D45D10110F4F4A26B40C8B2737
MD5 SHA1 SHA512 TLSH

Submit Download