hxxps://cl[.]s12[.]exct[.]net/?qs=ABB7InYiOjEsImQiOjQ5MzB9AAwAAAAAAZr_f2E0XT39kPLhSLefiC-cdRxrQODPMG-YaYR3Xd_2pZQqZr16nMDjM4oixqRwb6pkGSGkH5UmO1zqcOnBV27k7Wj1mAb3P14ei9U

Analysis

user interaction
yes
max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/07/2026, 14:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cl.s12.exct.net/?qs=ABB7InYiOjEsImQiOjQ5MzB9AAwAAAAAAZr_f2E0XT39kPLhSLefiC-cdRxrQODPMG-YaYR3Xd_2pZQqZr16nMDjM4oixqRwb6pkGSGkH5UmO1zqcOnBV27k7Wj1mAb3P14ei9U
Sample260707-scdplafy21

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2156	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134279099183021298"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{EF22002D-7835-4A90-8E06-51B7B995A785}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2892	msedge.exe
2892	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe
4388	msedge.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 4388 wrote to memory of 2168	4388	msedge.exe	88
PID 4388 wrote to memory of 2156	4388	msedge.exe	89
PID 4388 wrote to memory of 3820	4388	msedge.exe	90
PID 4388 wrote to memory of 3820	4388	msedge.exe	90
PID 4388 wrote to memory of 3820	4388	msedge.exe	90
PID 4388 wrote to memory of 2064	4388	msedge.exe	91
PID 4388 wrote to memory of 2064	4388	msedge.exe	91
PID 4388 wrote to memory of 3636	4388	msedge.exe	92
PID 4388 wrote to memory of 3636	4388	msedge.exe	92
PID 4388 wrote to memory of 3636	4388	msedge.exe	92
PID 4388 wrote to memory of 3956	4388	msedge.exe	93
PID 4388 wrote to memory of 3956	4388	msedge.exe	93
PID 4388 wrote to memory of 3956	4388	msedge.exe	93
PID 4388 wrote to memory of 2152	4388	msedge.exe	95
PID 4388 wrote to memory of 2152	4388	msedge.exe	95
PID 4388 wrote to memory of 2152	4388	msedge.exe	95
PID 4388 wrote to memory of 4840	4388	msedge.exe	96
PID 4388 wrote to memory of 4840	4388	msedge.exe	96
PID 4388 wrote to memory of 4840	4388	msedge.exe	96
PID 4388 wrote to memory of 3484	4388	msedge.exe	100
PID 4388 wrote to memory of 2852	4388	msedge.exe	101
PID 4388 wrote to memory of 3484	4388	msedge.exe	100
PID 4388 wrote to memory of 2852	4388	msedge.exe	101
PID 4388 wrote to memory of 1700	4388	msedge.exe	103
PID 4388 wrote to memory of 744	4388	msedge.exe	105
PID 4388 wrote to memory of 744	4388	msedge.exe	105
PID 4388 wrote to memory of 744	4388	msedge.exe	105
PID 4388 wrote to memory of 2964	4388	msedge.exe	106
PID 4388 wrote to memory of 2964	4388	msedge.exe	106
PID 4388 wrote to memory of 2964	4388	msedge.exe	106
PID 4388 wrote to memory of 3848	4388	msedge.exe	107
PID 4388 wrote to memory of 3848	4388	msedge.exe	107
PID 4388 wrote to memory of 3848	4388	msedge.exe	107
PID 4388 wrote to memory of 5076	4388	msedge.exe	110
PID 4388 wrote to memory of 5076	4388	msedge.exe	110
PID 4388 wrote to memory of 5076	4388	msedge.exe	110
PID 4388 wrote to memory of 4460	4388	msedge.exe	112
PID 4388 wrote to memory of 4460	4388	msedge.exe	112
PID 4388 wrote to memory of 4460	4388	msedge.exe	112
PID 4388 wrote to memory of 4568	4388	msedge.exe	114
PID 4388 wrote to memory of 4568	4388	msedge.exe	114
PID 4388 wrote to memory of 4672	4388	msedge.exe	117
PID 4388 wrote to memory of 1652	4388	msedge.exe	118
PID 4388 wrote to memory of 400	4388	msedge.exe	119
PID 4388 wrote to memory of 4328	4388	msedge.exe	125
PID 4388 wrote to memory of 4328	4388	msedge.exe	125
PID 4388 wrote to memory of 2892	4388	msedge.exe	126

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cl.s12.exct.net/?qs=ABB7InYiOjEsImQiOjQ5MzB9AAwAAAAAAZr_f2E0XT39kPLhSLefiC-cdRxrQODPMG-YaYR3Xd_2pZQqZr16nMDjM4oixqRwb6pkGSGkH5UmO1zqcOnBV27k7Wj1mAb3P14ei9U
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2ac,0x7ffbf87ec188,0x7ffbf87ec194,0x7ffbf87ec1a0
  2⤵
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1956,i,7966150311527614491,16752347561322691374,524288 --field-trial-handle=2304,i,5602465339579288955,13880164101411058548,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1740,i,4404294168876196024,8210559581061900089,262144 --field-trial-handle=2304,i,5602465339579288955,13880164101411058548,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:2
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2612,i,5994717550792097541,222319940185023103,524288 --field-trial-handle=2304,i,5602465339579288955,13880164101411058548,262144 --variations-seed-version --mojo-platform-channel-handle=2492 /prefetch:8
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,2701489172399803194,11213003901859487343,2097152 --field-trial-handle=2304,i,5602465339579288955,13880164101411058548,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,17483149747508392709,14500754661025110033,2097152 --field-trial-handle=2304,i,5602465339579288955,13880164101411058548,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:3956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4128,i,854066246677228016,15292584373516410380,2097152 --field-trial-handle=2304,i,5602465339579288955,13880164101411058548,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:1
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4212,i,15951251996415683794,12409092073655691604,2097152 --field-trial-handle=2304,i,5602465339579288955,13880164101411058548,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:2
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,3079219344208418480,5690952541014650053,524288 --field-trial-handle=2304,i,5602465339579288955,13880164101411058548,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:3484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5116,i,10870714366088332971,314893703635374774,524288 --field-trial-handle=2304,i,5602465339579288955,13880164101411058548,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:2852
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,6780519610629539810,14790015874918156268,524288 --field-trial-handle=2304,i,5602465339579288955,13880164101411058548,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,6780519610629539810,14790015874918156268,524288 --field-trial-handle=2304,i,5602465339579288955,13880164101411058548,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:1700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4388,i,2074419227710301027,7061265674475622985,2097152 --field-trial-handle=2304,i,5602465339579288955,13880164101411058548,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:1
  2⤵
  PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3568,i,12981232814300653238,10423122169773805911,2097152 --field-trial-handle=2304,i,5602465339579288955,13880164101411058548,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6272,i,18367626359681965093,9673776503910765455,2097152 --field-trial-handle=2304,i,5602465339579288955,13880164101411058548,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4416,i,7074642662455722176,12435798416324943192,2097152 --field-trial-handle=2304,i,5602465339579288955,13880164101411058548,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:1
  2⤵
  PID:5076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5100,i,2099041158685460977,3182764801781684214,2097152 --field-trial-handle=2304,i,5602465339579288955,13880164101411058548,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6480,i,11153040917560090033,10264813351317466737,524288 --field-trial-handle=2304,i,5602465339579288955,13880164101411058548,262144 --variations-seed-version --mojo-platform-channel-handle=6488 /prefetch:8
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,12684765717967795180,13156176359835328536,524288 --field-trial-handle=2304,i,5602465339579288955,13880164101411058548,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6384,i,17985897412964286857,17799016610085230695,524288 --field-trial-handle=2304,i,5602465339579288955,13880164101411058548,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:8
  2⤵
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6416,i,9947693872682244911,11271219980664411874,524288 --field-trial-handle=2304,i,5602465339579288955,13880164101411058548,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:8
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6852,i,11661140899982317597,9350953565118160324,524288 --field-trial-handle=2304,i,5602465339579288955,13880164101411058548,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:8
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7148,i,10866745063737110871,13120155523304323332,262144 --field-trial-handle=2304,i,5602465339579288955,13880164101411058548,262144 --variations-seed-version --mojo-platform-channel-handle=7152 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2892

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ab98da7535c8de464335204ae97fd672936e639269325c3a388b3039d8396b83
MD5 1656a3560c7aeae221756f3891b89fd3
SHA1 e48441fe2b843ba3bd0bb7799c07b22a27db8eb7
SHA512 c06d7152d11e33601716d4c5c33c7373ac4e0c16571e80ac4a8ffb9cabb52fae51d4fe8d808fc75be943287b55a320e90a186d71a5f06e9db006f6ab89266400
TLSH
T1CFD09B307B597042D3074031E8074790169E84B5249B86066554410D7D5A485E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ec6419a915c6f94199df67c6cf1d67bc666c22ef160c8377d6792913a6518679
MD5 a8d0099e5966b86c13c6997282a63770
SHA1 df541b93a0caebe364906ec90c768bb625495f4c
SHA512 a2093c42c3f547b910f560ee7a58cb187cef96045e8e335276c7bde87fdc5e9894b670421e94170d0878e86a2bea8125d914e11181882004f966732f9670a693
TLSH
T135D09B303B597442D7074031E8064790169E84B5249BC7076554410D7D5B4C5E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 82be781e6493e5220e39b1dd94b85c165b1b2cedc916f1256cdad223a09266dc
MD5 08d4a0ab58e41752f3da44040667fae1
SHA1 51a10916d183989e5b3d1f3c4cdf73c43bfd9adb
SHA512 99911a030ce89a9270e4645c6d0a3106305b25978dc3f29f0077156ad30963acfb88f92f5b0df8da07c3a1ad9ed9a702e82382c38c4210d84ad66c6085df8c92
TLSH
T15C71E93D040E4469D3AA03F364F213167D71BBEBF6D32E957190AAF028013D68E0F1A8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b19fce092d345e5c220da7e693ed757021791078b66a6924f284f9c8e76b467c
MD5 aa2e3c6242329a86ed5ad4c6fca84cb0
SHA1 12531fb81c8a98f3e78d6f1884e99210368d4783
SHA512 faea7a17b2f6bdc88bb9c5f0285057940f70b8fc2a734cf920886184d30cf4bc8dd22921119b23b27b28c718614d0ee0113f9f58f6c1a2543702d2bbeba4d07c
TLSH
T11D811C3D064E0469C76A03F390F1131AB871BBDBF6E31E9670949AF419023E58D0F0AD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588d47.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe588d47.TMP
Size 3KB
SHA256 11eb84d93adb0b2d1e360c786ef280bf51edd89e010ecf1f7bc95210504632ad
MD5 9d3356f630015c19ac0fec1d6424054b
SHA1 dfb79ff67399b4a0963668c6c2786149d6bfa1e5
SHA512 b0bb6c9186d2bddd37068ec26606278c8cbd6aa32baf5586601c5e5a22ea45648cf0db0acf66b162bd22a6bbb08bd9cb62782aab0f616fd41ea9927e4460443b
TLSH
T15771D83D040E4469D3AA03F364F1131A7D71BBDBF5D32E9571949AF028013D68E0F1A8
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 754097b3767fb73ba0825028d4e9af003424decbd9417d6077f2c231c82cb39f
MD5 3cf137934aff4e4521c6ef33f90a303a
SHA1 439083795199d08b0ab0a44c326e972a5dac67a3
SHA512 d8df71b542bf4d8f3f326d3bf4eeed97fd35010fa6b17262c225881ff63b72e782dafdd9766c52a71e8ce1eeeee44a87a056b71e9e28b089d064845bd7837d7c
SSDEEP 192:DWQa7dOgVNjzfKeOhJDALrGkj6Rum67IbNHu69w7o/wlBtyr0yoI2YOPV9PFmc:DWQCdOgVNjzfKeOhJDALrGkGRum67IbU
TLSH
T15612D0F7C6E4CA6D981255F866747D1BCD2D0A18C3283C698DD9BF4A73E20B0D211A9F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 09e8bb6c0f2819b6872b382934abb247c1c5066df69656ee07667c1e01d1bd68
MD5 6af6c3d8044cb68b133930a262e77e96
SHA1 243a8bea9d0ba100377d6076484928ec19892d49
SHA512 7182c1e35beb417f290b6aceef4ad8078039c66c48c030f4ca9b9d2e80feb6f7b1b0e83fd6c51f9e8a8110aaf045a192103b1a70ca1dad7f657f4c9ec795f1fc
SSDEEP 192:sxZjRAyM/jK1Ml8Mkc/fhsXtAqhIdpJHW6+WNGYzc/2JfIgrJ:sxZjCMc/fhsXGzJHbG8f9
TLSH
T10742D7126B34997BCCCBD309BA457B53D6F50562A2900E44A9FCDA0C05E7AED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 84d02ad7b56e4738fd44da6c3b853eb6c5554db1e3f174288d9fd92d941b042e
MD5 9927a55c48f94cf1ae2dbeaeae260a0b
SHA1 7099240918eec070665c62f130abdd378d3f6d8d
SHA512 aa61f8e19c44b963bda97d5c8ab61be92d5bb07fd28c75c0e6f38b052cd654b78b13e2fc6b9ccf82a0cb47414f52533c443cef6dc75a4fd22bcf39a022ac523e
SSDEEP 192:sxZjRAyM/jK1Ml8UQjkc/fhsstZ1nhIdpdll0tHW6+WNFjyRxYz0m2JfIg5GJ:sxZjqqIc/fhssDEyHbqxLfg
TLSH
T11E52C7526A34997BCCDBD209BA41BB53D6F51562E2940E44AAFCDB0C01E7BDD2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 c5e37db3a5b70b0a3833ebf18840b6d828dd135296ace7e3a9febc53d9dac891
MD5 b30fd9dc8a4e31c2dfe9c567e7f65bbb
SHA1 7949cc0a87b267b07235a61b988ea58deeab55b4
SHA512 acc2ab996535e7b420c624621a7cdf168d553f384b34de2835b9628576925eb836650ec72fb2d48a91f889d412ca2553684a4a79222f544ca9cf2939b5218c4e
SSDEEP 192:sxZjRAyM/jK1Ml8Mkc/fhsstZ1nhIdpfll0tHW6+WNFjiK/YzeV2JfIg5GJ:sxZjqMc/fhssDEkHbh/kfg
TLSH
T1A752D752AA34997BCCDBD209BA41BF53D6F50562A6940E44AAFCDB0C05E7BDD2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d0ff4afcedf9600706888a71a699fcae3b1cb778277191ef14a89ecf85738a59
MD5 8415ef51335261e435047cd60ec4f889
SHA1 00f027fafba7b45074908162ac006c1f39b0b605
SHA512 39ede8a09b503a67ec3a135e5d7f4872d1f4aaefcc926cafd5b8a7078c440493782e0d9b307db3f92d54e054797d9316d6464ba58680f4703c10d52e50e6c8f7
SSDEEP 768:mVW7kf0Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX5LlWYSjDroIBiD1Y2:mVW7kf0Wvqidau1jaa5LA3jwNO2
TLSH
T125D20A3B680CCB7E4F841E5CEC266F976ED801CB66988D5487FA884C03CB6EA51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 6b23dd46cc7b12686eadda356e759f31401dda45648eba37e1925c5f842d8475
MD5 88831a202bfda4f10c7e2d5272029fb8
SHA1 ea0bde5292af7cab2a7092be6872f641c049b1c7
SHA512 e15bdcc3c89c0c6016f1e0a5c81a2bc49d0d97abaae65a46288526c629aed740e842b8642834d11c04685d5e576724f0a9d6560b88be370b58c20cc041054cf1
SSDEEP 96:KIbCKcfTWKIsSHAxEwCui4WGbrg44K4dgq4c4YLqwVHnwVRnlV5WhOUgZ5K4m:si1HAxEwCuivGb04cdgqX4YLqwVHnwV6
TLSH
T1A4918105313B0A803C7E3948A1A585275F82B1633518B46F7FA905A22E6FE524FFF8DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\fc16ec17-5d17-4b81-97ce-030baa3d8903\index-dir\the-real-index
Size 72B
SHA256 fe87969aee5f4c676ca479a2d50d8c701a2c7d977f7e50b5388f15c79512fbb2
MD5 38e2156132b36ec61c23589914b9deda
SHA1 1832dea11a30322ab623058260762e3586182293
SHA512 2f1d943843e6bc345104527539673c5c4a13b70a1f65788024638fdad19ff46d52e7a7399c1b4b093644993defb657ab84d30b29774177b8af5c1f9fe1ec7b32
TLSH
T1C5A0022812531205C41406713E770161B3714D61EA05036281E02184D8E11995943139
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58fbb1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\fc16ec17-5d17-4b81-97ce-030baa3d8903\index-dir\the-real-index~RFe58fbb1.TMP
Size 48B
SHA256 e15589ff26d6d6706d18a2ca2581232c3b6815708bbb87f348e3c54a74f90810
MD5 a666bce5dbd0b8b1bc229d6134ce711a
SHA1 fe3cb612c0cb2c7d530af604b91e22c57d90233c
SHA512 4a7585b7eb1615819391d526504e6934b50f41635d78b2478a35f13c61dfbbb73fa5aa233c3ddbba0202fa8e4f78653e0d08921e89fb57d6c78b7a004c7a5812
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 82B
SHA256 79f9fd9b19af9e07d3f02c8135329e0bd64418db98fb935dff8b2167daf2d879
MD5 5f8cd977ced0731dde55c0e855e6e0e6
SHA1 9c3f0a678b5fbbdc56c403a7f99e4d10730382ff
SHA512 c5a401d4410c28ce09d99e734ea1129fbb0c471f67ad55a8fa8ab38606e5f77a99882e7c147095bef4864ec5e410da3ed3623de5181576c2fcab632b06e4045d
TLSH
T1D4A001FB8900859A4B36A9EC2166B21DE04BA18C8CD1CDF4D45986422228BB24402890
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 163B
SHA256 1d8b29f735914b1249c3effe06aa3914888d2cc224f65d402e06bd30ee88a7f8
MD5 d9776af8b2da7ceb63879acd1e2cacb1
SHA1 0ba3d6517443397d159579328d2debeb7c06bd35
SHA512 0dc7ec0895e50f9879f84fa778b5118e8eac32f0456850fde0669438bf32b25adb02c012c49a57891b390dc5be4aad297b91b5008c96302f30c6c6b5e976db85
TLSH
T136C08CFF44208A4B4BB9B5C81420720DE01B9C4CCCD0CCF8D04E3A022138A638882820
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt
Size 157B
SHA256 7e3ae0131343773f63761312f9963fe6c53e97db607400df53890de5bca6a13e
MD5 65cf725dfa481ed7e947a2a62abaab7d
SHA1 1d422a73c0a2cf9bd32dfb292700464146948dd8
SHA512 d6d473c503cf23419697830d50b22dc0659f3feef2a1829d528ce0f42838e298fc92b70b228a2dbd46f839841bce9bd62ef45f85615b7762bba9bd7ccfd1d8f4
TLSH
T1EEC08CFF8420CA8F4BB4B6C81415B21DE00B998CCCE0CCF8904C2A021138AA38842820
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe58ab10.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\CacheStorage\index.txt~RFe58ab10.TMP
Size 166B
SHA256 1ee4e3e61e001183c7de99c6301020353d3cf9a706de388c60b8d1601f1a862a
MD5 c4db565b4fa9605d36791cf160bbac11
SHA1 2eb233992d3125a7ab379fab579e0528c62c8369
SHA512 9e074188f7a1d48f0ddca7aa2c8999d4e9a83cfaaa79c13115d1a8cd50f5c30a602e5d4cab6a6662a9a8c55b91d2ee4d0c1fc167954443c79a78b6c291fc372b
TLSH
T195C08CFB823288160735A4D9203A300CE0026D5CDCD0C8E4C41DB08131BC362C002A50
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\IndexedDB\indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

8f3da44e-11c5-41a1-b903-ce078b0414a5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\8f3da44e-11c5-41a1-b903-ce078b0414a5.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 338a18a18e3f2a63bed8668534fbcb98091afe10daa845200cc4dbfb94a3cdca
MD5 9595afc5e8c6b1f15371c99b21ab8de9
SHA1 ea63fdaa222a34742bf948af76b9de09f9e3e44e
SHA512 194cb45f76844518d96e4da3f915dfa71797a8aa674756e33b4293599aae6473d47ab98216e9eef927941947a67a819bd37234a50bd040f51b946dce3d4e60c5
SSDEEP 192:u+LsN4SQlCLkBbp4QmiU1Ix64aGBPKcl+FdGuom1YKEMndNMqI+U8:/sN4SLGbGWlQd0mEMnjU8
TLSH
T1063219316C74AC3B5E92B245F48637139FE4512BEA886F84E7DD5B1C05EB3EC130A91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0c8329f3b7da431429967118ed1b6ff0336d0972cc15a165d4644f71e8540c86
MD5 b96a5c757812dffd47270ab2fc251e65
SHA1 2e3a5e508c80a34ee4cb1b11418cf4b9b6ac5d27
SHA512 e4b01729666af16426aa102d999aa543829f26fe3b0dec6e82817ffa5aa9e14de814a32d2d1674c6787992775f5971553413c5aac1f52e32da5bc2e559833df0
SSDEEP 192:4ONZ64BvQmiUyDnX5GBPKcl+FdGuom1YKEMBWwMqI+U6:4ONZ6ex+Xzd0mEMljU6
TLSH
T10D121B316C75AC7B5E92B645F48637035EE5422BEE886F84E6DD2B1C01EF79C230A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 d65db6551b30b6abfdff5cb446ead130a58426cb2b651fcb243adc9f039aef30
MD5 ede1703d87389df13b826b34722462b4
SHA1 4d9fc750c420106e61df1e049f121b8dfac61430
SHA512 ade3e5c0eb8c571dba5807b3a1dcb58996eaf11453fd3e113224965972ca9f060f1c1b55822825aebfa10f707f5337cc28381cb3a36e75fe103abd64cb17f9a0
SSDEEP 384:UiF1tNn/s3n9SQzsNo8TUNTUlIloLGbGylQd0mEM+jOObjI9G6w7nUP:vF1j+93RwgUGRWkM+j29M2
TLSH
T163C228F208D7893ADA5E9747B77D2E168EFCC16BB5845A40B3899A0CCD961BFC306805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0a46feca997fa62f31d8527dded15fa39552767a68e0dde560f2c337cf00d83a
MD5 9e87e2918632f1949e4ba752414653e4
SHA1 db8ad8acbc7ecd444c4de4e9b3bd5eb5e1286c29
SHA512 729ebfbaf62a288817ac4f77e0b6d9cbc3398eed8a439e07d1e2ea012d4e9eda2a5940b7923f330916ed5704c8c95aa71089dbf52a97cc068f94bf9d79936f31
SSDEEP 192:MONf64BAQmiUy41nW5GBPKcl+FdGuom1baDK5U6:MONf6eAnRWzd0mSeU6
TLSH
T1EC02FA35AC756C7B9EB2BE45F48637175FD8112BB6D45B44EAD81B1C00E724C234682A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 078404da9218c081efc635d8a80c3a0118adde840408478e3c781fd4a0713ff8
MD5 32e75c15eb5e295df61e7767edc1ea55
SHA1 738fb59bd05327bbb90dca73c19a7844206e7c79
SHA512 22996a737055688889c25fc47ec882131b90b3b05e72015113823594076a549f90fee3c26d28e41c97bbbcd787e4915943912b74fa742c4ba82c764d301a7500
SSDEEP 384:QtNn/s3n9SfsN4oLGbGWlQd0mEMnjOObjI9G6w7nUP:Qj+9UmGFWkMnj29M2
TLSH
T105929E315C359D375E93A256F4863B178FF4927FA6C81E84E6DDAB0C02DB6EC4306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

35bc1496-d883-430f-aff9-e4f65794d454.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\35bc1496-d883-430f-aff9-e4f65794d454.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 54cf4a7b4954d6aaf92e24d9808571c7a068aba2834d2346474594230caac280
MD5 c6dfc2d4a9b44d18f9f9512b4f2b4040
SHA1 e8180ce7a2c2e9e1cc1c0015685ef94fb15a9f19
SHA512 fb4cb3b435251388ccad2c1bd3e4071a0dfa5e9ccb084d4a5ab9b84149831b3c4eaff273f31d372303066b2b88865ba67c35558b7b94e2a5d9cbc2483e1c0fc3
TLSH
T17741175CB6F91108B3B37F5A6BF2A96D487BB9772E4AD05D00110D4F0A22B40D9A1B37
MD5 SHA1 SHA512 TLSH

Submit Download