hxxp://www[.]theclient[.]magerwa[.]com

Analysis

user interaction
yes
max time kernel
298s
max time network
291s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/07/2026, 12:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://www.theclient.magerwa.com
Sample260708-ptr2rsfx3w

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2460	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134279878695398070"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{082A8490-D036-451A-BFBD-CC1B648C2A26}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4776	msedge.exe
4776	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe
1968	msedge.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 1968 wrote to memory of 4524	1968	msedge.exe	85
PID 1968 wrote to memory of 2460	1968	msedge.exe	86
PID 1968 wrote to memory of 4764	1968	msedge.exe	87
PID 1968 wrote to memory of 4764	1968	msedge.exe	87
PID 1968 wrote to memory of 4764	1968	msedge.exe	87
PID 1968 wrote to memory of 4464	1968	msedge.exe	88
PID 1968 wrote to memory of 4464	1968	msedge.exe	88
PID 1968 wrote to memory of 1648	1968	msedge.exe	89
PID 1968 wrote to memory of 4548	1968	msedge.exe	90
PID 1968 wrote to memory of 1648	1968	msedge.exe	89
PID 1968 wrote to memory of 1648	1968	msedge.exe	89
PID 1968 wrote to memory of 4548	1968	msedge.exe	90
PID 1968 wrote to memory of 4548	1968	msedge.exe	90
PID 1968 wrote to memory of 1684	1968	msedge.exe	92
PID 1968 wrote to memory of 2560	1968	msedge.exe	93
PID 1968 wrote to memory of 1684	1968	msedge.exe	92
PID 1968 wrote to memory of 1684	1968	msedge.exe	92
PID 1968 wrote to memory of 2560	1968	msedge.exe	93
PID 1968 wrote to memory of 2560	1968	msedge.exe	93
PID 1968 wrote to memory of 4796	1968	msedge.exe	96
PID 1968 wrote to memory of 4796	1968	msedge.exe	96
PID 1968 wrote to memory of 4796	1968	msedge.exe	96
PID 1968 wrote to memory of 2012	1968	msedge.exe	98
PID 1968 wrote to memory of 2012	1968	msedge.exe	98
PID 1968 wrote to memory of 2012	1968	msedge.exe	98
PID 1968 wrote to memory of 4720	1968	msedge.exe	99
PID 1968 wrote to memory of 4720	1968	msedge.exe	99
PID 1968 wrote to memory of 1676	1968	msedge.exe	100
PID 1968 wrote to memory of 1676	1968	msedge.exe	100
PID 1968 wrote to memory of 5044	1968	msedge.exe	102
PID 1968 wrote to memory of 1628	1968	msedge.exe	104
PID 1968 wrote to memory of 1628	1968	msedge.exe	104
PID 1968 wrote to memory of 1628	1968	msedge.exe	104
PID 1968 wrote to memory of 968	1968	msedge.exe	113
PID 1968 wrote to memory of 3868	1968	msedge.exe	114
PID 1968 wrote to memory of 3984	1968	msedge.exe	115
PID 1968 wrote to memory of 2944	1968	msedge.exe	116
PID 1968 wrote to memory of 2944	1968	msedge.exe	116
PID 1968 wrote to memory of 2944	1968	msedge.exe	116
PID 1968 wrote to memory of 4240	1968	msedge.exe	118
PID 1968 wrote to memory of 4240	1968	msedge.exe	118
PID 1968 wrote to memory of 4588	1968	msedge.exe	119
PID 1968 wrote to memory of 4588	1968	msedge.exe	119
PID 1968 wrote to memory of 4588	1968	msedge.exe	119
PID 1968 wrote to memory of 4776	1968	msedge.exe	120
PID 1968 wrote to memory of 4112	1968	msedge.exe	121
PID 1968 wrote to memory of 4112	1968	msedge.exe	121
PID 1968 wrote to memory of 3472	1968	msedge.exe	122
PID 1968 wrote to memory of 3472	1968	msedge.exe	122
PID 1968 wrote to memory of 3184	1968	msedge.exe	123
PID 1968 wrote to memory of 3184	1968	msedge.exe	123

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://www.theclient.magerwa.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2ac,0x7ffcbbb9c188,0x7ffcbbb9c194,0x7ffcbbb9c1a0
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,13360221343868288741,4480499045504832789,524288 --field-trial-handle=2228,i,17967917499099849393,8648506537428774570,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,15196229484576899375,8045659485973359271,262144 --field-trial-handle=2228,i,17967917499099849393,8648506537428774570,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:2
  2⤵
  PID:4764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2288,i,149260169833349343,17917555067557217105,524288 --field-trial-handle=2228,i,17967917499099849393,8648506537428774570,262144 --variations-seed-version --mojo-platform-channel-handle=1948 /prefetch:8
  2⤵
  PID:4464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,14469286018165357899,13610748657354838214,2097152 --field-trial-handle=2228,i,17967917499099849393,8648506537428774570,262144 --variations-seed-version --mojo-platform-channel-handle=3444 /prefetch:1
  2⤵
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,17715298207662329038,16810902657718104561,2097152 --field-trial-handle=2228,i,17967917499099849393,8648506537428774570,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4180,i,11654922475196019461,2880091241810177801,2097152 --field-trial-handle=2228,i,17967917499099849393,8648506537428774570,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:1
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4204,i,5576930620757751255,8628823236437115339,2097152 --field-trial-handle=2228,i,17967917499099849393,8648506537428774570,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:2
  2⤵
  PID:2560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3580,i,8800709100686186814,8615007437144303456,2097152 --field-trial-handle=2228,i,17967917499099849393,8648506537428774570,262144 --variations-seed-version --mojo-platform-channel-handle=5036 /prefetch:1
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5208,i,6376887857241609986,701798831021675968,2097152 --field-trial-handle=2228,i,17967917499099849393,8648506537428774570,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,17035700781964525698,17910355682824817352,524288 --field-trial-handle=2228,i,17967917499099849393,8648506537428774570,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5220,i,1144864546465723651,7374282000007963279,524288 --field-trial-handle=2228,i,17967917499099849393,8648506537428774570,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:8
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,12128851825122220255,5813753527475174065,524288 --field-trial-handle=2228,i,17967917499099849393,8648506537428774570,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:8
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,12128851825122220255,5813753527475174065,524288 --field-trial-handle=2228,i,17967917499099849393,8648506537428774570,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:8
  2⤵
  PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6152,i,16812302026590168165,15245038233282126974,2097152 --field-trial-handle=2228,i,17967917499099849393,8648506537428774570,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:1
  2⤵
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4472,i,15283898260917015203,17924323373948704386,524288 --field-trial-handle=2228,i,17967917499099849393,8648506537428774570,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:8
  2⤵
  PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4476,i,11743874395320750246,210981944920150282,524288 --field-trial-handle=2228,i,17967917499099849393,8648506537428774570,262144 --variations-seed-version --mojo-platform-channel-handle=6304 /prefetch:8
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4460,i,2370639741333442146,707528007851351747,524288 --field-trial-handle=2228,i,17967917499099849393,8648506537428774570,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:8
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5248,i,8790167406956338369,11008183912623275781,2097152 --field-trial-handle=2228,i,17967917499099849393,8648506537428774570,262144 --variations-seed-version --mojo-platform-channel-handle=5260 /prefetch:1
  2⤵
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6176,i,6625732161284032084,6090901383418495061,524288 --field-trial-handle=2228,i,17967917499099849393,8648506537428774570,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:8
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=752,i,7933355561256801401,7540082119186728661,2097152 --field-trial-handle=2228,i,17967917499099849393,8648506537428774570,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:1
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3408,i,8424159354931024024,10305197616408004040,262144 --field-trial-handle=2228,i,17967917499099849393,8648506537428774570,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,3342491276044167733,16745384130173310048,524288 --field-trial-handle=2228,i,17967917499099849393,8648506537428774570,262144 --variations-seed-version --mojo-platform-channel-handle=3944 /prefetch:8
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3536,i,10104427350890003372,12283879384847440863,524288 --field-trial-handle=2228,i,17967917499099849393,8648506537428774570,262144 --variations-seed-version --mojo-platform-channel-handle=3952 /prefetch:8
  2⤵
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6220,i,4723824111547478236,9539917002177726506,524288 --field-trial-handle=2228,i,17967917499099849393,8648506537428774570,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:8
  2⤵
  PID:3184

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1472

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 994380ffd288a5f1a9acc9eb76a487a55b12cc1daec839d811240f6cbdc4da3a
MD5 f5ed4946834be586ac6410ed88740a7c
SHA1 6108ce368e8b3bb8012956bb25606c3b16835c7b
SHA512 76bf60b37c50422ab125edd3da70629e685408a106655a9b7e5cb6aa7b6a9000c76d8ac2f5dc85e58e893b61bef9b539b9488ac894f1fc1338a58944dc9f4711
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P77:fwUQC5VwBIiElEd2K57P77
TLSH
T1E5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85da5d101c008762046da9670ca95944217bbb1829e60a748f367ee4f9926b13
MD5 ef105d8d3e87a813544857290c28833d
SHA1 bfe7010cf80fb8cbcb9eeb5e0d0b551ece0b3134
SHA512 ae71c302652e2de890fca25723381f403f4f9ee51e2da6583977318de3e7ff00defb73b202e17a287def3ff618de86c0af96c0fca7729ef3efe0a4ba3cfdfc63
TLSH
T16FD0803377C9A100F6567375F413C7412F27057415868613A168C45CDC784C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98eae6fcc56d922689f3a45ab65635857e6510c437555d4eae3a6cd68dff3acb
MD5 338a3c92e96cad1510815c958fc76de7
SHA1 e1234ace09aad728f9bde0798e2fb22ee82583de
SHA512 e29c9087bb4c9c94c8525a95c307117f14827336de29aa01f837bd02b05b3aecd1c1771970519a60972a1495e05b4f68ab34cf5e4ec9d7060f6383ac019c2ed7
TLSH
T17DD0803337C9A500F6567375F412C7412F2705741586C713A168C45CDC794C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 90a8cb8b14553185ac94477e488e4865d2562edc20bc56396e9a03761b64eef9
MD5 3ef58ed9c54c0811be8eb556e182495e
SHA1 5152a0353aab4712ad064f6277a34a916dd40f0f
SHA512 7c97079fab323cf6b76a707bbc55006ce63cbc6f39ec90fef1ebe34373220b34c3088d92296af0f477026252bd2b47105eea7ae911139ed74ec603f015a5a482
TLSH
T1BDE0DFAC33F0C5A459329B8BA26C735444D27C35E68EE85E6A04A8BA34000846FA62F0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b7f5a609f3517b696143590db69b53cdea55c315237280cb23b94d8b64c8f60c
MD5 5cbedf2bea1447c3bd2106a90668fba9
SHA1 4cde4780527bf794698d5a685b190477a14f07d6
SHA512 3db21d6e1ec1dd54eac320457a003287df43209499429ef1b5cf129522c2099e9454f1d528997ec771c694d72dad48eb6eef5882ca3f3b98435254d0c7e1c99b
TLSH
T121713C2902FE039DF3222272F1DA0A1434F3679B0E937D4E10A88F7C2532B348DE5408
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58683b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58683b.TMP
Size 3KB
SHA256 8b89e85d660b6a93426c01a7e7d1eaac7ae023b7735ba23484a6b7c51df26c3f
MD5 7c676dd207600c10ae478cbe4beceef3
SHA1 167f07d741b1419a08558f91c47d857c6be557e2
SHA512 eb9f691f245f4924042e41147996f8f082fe279df5ac2721eca6f7536db20f113c35d271581fc90b5b8274938e5c02f8b73c6a38b4213520a93814043ff168fd
TLSH
T1E1712A2A52FE079DF3262232F1D95A1834F3679B0E937D4E10A88FBC2536B348DE5409
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 2498c90e3f6aa8f40ce74600ebec6c015c7b30759827b6d4d2198ec354064f63
MD5 2220d52b091478b682fa1663fdf4ab7b
SHA1 a6d42b6555c8a9cb49e171e016be4638b1556555
SHA512 3669df2c3abd6a5e254770dc353c36c56ea832b4fa1cee19f17024c6bf0c2ad7dd9f97a81353a6581adf64e36c9f2f4b280bf4fad5040818fbce41e939fd00a9
TLSH
T1281190F3C3D585AE890556F0AA24AE2BCE2D0605432C7D19C5D4EF2BD7E3475E10255F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 4f4f910eb77772030fa2d302f1331f6422a32cdb31560add929fd173a3dea662
MD5 1d477a93c8a048e39c3360125600fdee
SHA1 29ad5c045ff5faaa46950a7a7e87e983262cc0ba
SHA512 62a7ad8163169b3151f2f6e484beda35fb44c525d2a2ed2fca175564d4930680ef120df86d3b5587eb4c704bc9b6ad71ae58387c3de388393c56e5edc3806a9e
TLSH
T1C0218EF383E585AEDA1156F0AA14AE2BCE1D0501432C3D1A86E4EF1B97E3475E00295B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 faac0b418927028a9aa128561b043c2a4e8caaaf4e908298289b2676f1450fd4
MD5 20452c2945220f6f46f2f13ca581d95a
SHA1 6a8bad4f53571adc76625d3258d2b1c9ede11544
SHA512 e1b40bd87d62c7f294d6ed4c984d344946adc841508f6731606eb6b6e8e8279ba627ee48501242428080f93258fb676887e60d89ab737a5acabf66863da71b2f
SSDEEP 192:sxZPR9yM/jK1Ml8Mkx/fgshZiVVIdp7GH0y6+WNGY4wo1QuIgrJ:sxZPFMx/fgshZcm6HYG7x9
TLSH
T159520816AA345A77CCDBD209FA45BF53D6F90572A2900D44A9FCCA0C05E6BEC2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 7f025b43997decc1c0764df19d1c8ec38db5aa515094f5ebdf9a61abee56afe1
MD5 25cc6304c504ae1022fc567fd582c48d
SHA1 9d9974b93a83c727126b99adf123e17e77ccc775
SHA512 a6cdf123e6bda4013279eae2d2f26d427bce2ffde0da4572f0c0909188d461745d77f1968070a0d8a1b67dd7d4896a2db89eb03703bfbf4962777257ffeeca0d
SSDEEP 192:sxZPR9yM/jK1Ml8UQukx/fgsHZi/VIdppGH0e6+WNknWLp/Y4Bjho6+uIg5dJ:sxZPFqFx/fgsHZamsH8qYp/XOs1
TLSH
T12C52E716AA345A77CCDBD209FA84BB93D6F5057292904E44A9FCCA0C05E7BED2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 4f0ab421a5428545eb2b2359d358d7325c25676bcd933b1af5c9048cb5cef93d
MD5 e9e13205e5a4a3acb65b7872d00d2300
SHA1 e2b682713060e97942d59acd9bf76a2bc6d4134f
SHA512 700ae54c710e9a304050c84373bdb7cbb206b3938057913f6d615da70fbb31866b1a4a40f2b7e600f9f22c31cbdc0af2b274c94e6676a2ca408b25dc2143b6cd
SSDEEP 768:JZ8iJPNWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsALl6opdaroskTUnz:JZ8iJPNWvx76ru1jahALocdRLUz
TLSH
T177D20A3B680CCB7E4F845E9CEC266F966DD801CB5B988D5447FA880C03C76EE512799B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 9e29d17c415bf2a55854e43a177904dc27122a0e4e83579367c30aa6cf92d004
MD5 114c684c7728f259eb2d861967e38e1c
SHA1 28826c2b4a4217b657023a91be112967ef8e97fa
SHA512 4ee45bfc86779523b21a81aae93a3756ce5360a7d52de486dd308965a893af7f67d31cbb5b0677ca90c96835bf5a8da55e9e479bb1d9991ab38a9f7dd4ba819f
SSDEEP 96:K0YwKlqqCy8Knqd0VAE+imkWivPgMkK4BgGkckEP+k5HI5MYKWv:Cvn40VAE+imbiv4MYBgGLkEP+k5HI5MI
TLSH
T1B691671774BB02913C3E640895959A169BC3B7A33218E42B37B840711E6BE294DFECDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 08f945607f80c72dd0572b4fc7412f250042d48bf5d096464ae6fd1ca2a3cda5
MD5 bca8d28b858710065ebf2ee900b9e40e
SHA1 75ff641e6515f02c9f6b151b1fe8e7ee824de094
SHA512 d9a0e3da6d36f7cdda59755f4dfa631349b1ef9a9c54592a3e9f2ccf4fe5911bcffa6b6402ddcbf49dbef84b724cd79af60d6b0c4aa64a145778bd4195da694d
SSDEEP 192:uhLsNlzeOqQZScS6H2mkaNQmiU1HJAH4k03iowmcEJ83lLIZcrqoU8:0sNlzeZ6DVcYkywmffYU8
TLSH
T15E3228327878AC7A5EE3A596F04B36139FB48167DBC82F94D5EC670C05DB2EC5306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 f70dbe92cbcb99330fb35458011ffac251c1a9b3c2f41f139c4df43c3b20bde9
MD5 56426f92e09fbbaadb353ec76511d995
SHA1 fd9ab51e2a657b969f393acae5e0b8873e09992e
SHA512 567d3982d3805fa57abe624ba6990fc4afb51522e90c4b36dc8ad6c929306a684d559390734e238ae491ddd5b51d4b561b570e8fda8a883710ec9eab9f409292
SSDEEP 384:CtNn/s3n9SbzsNlcBZ6DVcYkywmfYYScjmwxlm:Cj+9wV6ewXYY1jLm
TLSH
T14D927D3368799D6A5ED3919AF44B36178FB891A787C42F90D9EC6B0C05CB2EC4313D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3fbb4a3749d55968709a87b126a1005a76e65e2ceb7b60b4087e5716879c7d0e
MD5 b7556220c56522533e1c23bd18f6e55f
SHA1 5fa8d87ef4556ae912c24dcda52b348f1fa55c7b
SHA512 2a8b73828359b8522d1b80511e5a34551660c9879e30034826b4d8350d983cd5525befd35412dbcd69b9ad48a79b85f0f4b3c04adc51347a0ae0cd9643111869
SSDEEP 96:ZqONkrwQsjpfmUTmDK5ih/cIPURHl8h4otop5S5DEBhPwivh50xy0SFYKNAxOYoZ:gONw6kDfQmiUysoZ903iow+QiZQ90oU6
TLSH
T15502D93568786CBB8EA3AE46F48737275FA5117BEAC52F84DAE81B1C00D765C1303827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 ed9b25690653769de293dc5ead0ad39a2696e1e58200207f68c5de7f7719213d
MD5 912ae9dcc31898480e15ea2c3b092900
SHA1 6090fc7c9fbf7357ef320ccec480a69a16429be7
SHA512 8bfe70ca617f479a2d41af9ea242c57c031bc0c7d14a27e05db5adf324ca03d92991efad9c47fa7f4974a6963c63c8a4c70488a37d81f99e4063f3ad43eac571
SSDEEP 384:ItNn/s3n9SfsNlcBZ6DVcYkywmffYScjmwxlm:Ij+9UV6ewXfY1jLm
TLSH
T1F9928D336879AD6A5ED3919AF44B36178FB491A787C42F94D9EC6B0C01CB2EC4313D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6ba63bcc4031fbd4408660c74a7470353c3ad50c0c4a3693158db81fa8a131c7
MD5 a952094ad97666126fddc014c89b7eee
SHA1 7a719d16b23e1685cdd30514f7c92fc3e8977ee8
SHA512 44065ae4721815c46821e0d4e1d5e2a921896a84c3c33d1ee41fb661f5037b16aa63e7a0acf298a973f71c9253f37d5fb92bf03bfca331a62a2573d7dcc40228
SSDEEP 192:LONQ6kQQmiUybwoo903iowmcEJ8XcRZcrqoU6:LONQ6B0o9ywmfnYU6
TLSH
T1981229326478AC7B5EE3A996F48736139FA48127EBC97F90D5E8271C01DB29C1307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

40c7a5f3-6efd-4748-a77f-b470dcfa7452.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\40c7a5f3-6efd-4748-a77f-b470dcfa7452.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 373d04bebdadacc4eeb4e1ba257d61ff62133c4b29e7563d73a1015a910fe60d
MD5 19806db91786a1fa440e8a97aa5cc4a3
SHA1 4158e2a6a74a58f21855bb078bb4ce0ca06148aa
SHA512 8b06d95bc78d4bd02377f4d5533fa5e9d5a55dfd15b82428773a0296e93237f10a4e1951020f5b0b9d5c39cd3abe8bfc6d41de5f8be7ac45e2885de3d08c51fe
TLSH
T182411858AAF91148B3B76F56AFF6686D487BBC772E46D45D00010D4F0A32B40C9B2B37
MD5 SHA1 SHA512 TLSH

Submit Download