hxxps://31e2838968a5483da54358ee722f0a15[.]101[.]us[.]prod[.]marketingusercontent[.]com/api/orgs/31e28389-68a5-483d-a543-58ee722f0a15/r/O-X_0FtBeU6PhFmXgtYBAAcAAAA?msdynmkt_target=%7B%22TargetUrl%22%3A%22https%253A%252F%252Fwww[.]ruthschris[.]com%252Freservations%253Fcmpid%253Dbr%253Arc_ch%253Aeml_ca%253ARC27Q1064B_vs%253AA_pl%253ATopNavReservations%22%2C%22RedirectOptions%22%3A%7B%225%22%3Anull%2C%221%22%3Anull%7D%7D&msdynmkt_digest=wdnt%2F%2B%2FCHz5YCO3gMkDzQou0Wp%2Fi13bWVEBy3exUD7g%3D&msdynmkt_secretVersion=a3955a744d9049f88dd8bdc1907bf2bf

Analysis

user interaction
yes
max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
10/07/2026, 04:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://31e2838968a5483da54358ee722f0a15.101.us.prod.marketingusercontent.com/api/orgs/31e28389-68a5-483d-a543-58ee722f0a15/r/O-X_0FtBeU6PhFmXgtYBAAcAAAA?msdynmkt_target=%7B%22TargetUrl%22%3A%22https%253A%252F%252Fwww.ruthschris.com%252Freservations%253Fcmpid%253Dbr%253Arc_ch%253Aeml_ca%253ARC27Q1064B_vs%253AA_pl%253ATopNavReservations%22%2C%22RedirectOptions%22%3A%7B%225%22%3Anull%2C%221%22%3Anull%7D%7D&msdynmkt_digest=wdnt%2F%2B%2FCHz5YCO3gMkDzQou0Wp%2Fi13bWVEBy3exUD7g%3D&msdynmkt_secretVersion=a3955a744d9049f88dd8bdc1907bf2bf
Sample260710-fdcsgac17m

Score

4^/10

discovery

Malware Config

Signatures

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SystemTemp	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3376	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134281323110137874"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1636999435-3883760687-346127294-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1636999435-3883760687-346127294-1000\{7F284AF9-C624-413A-9539-11404280F6C1}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4984	msedge.exe
4984	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe
3124	msedge.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 3124 wrote to memory of 4868	3124	msedge.exe	80
PID 3124 wrote to memory of 3376	3124	msedge.exe	81
PID 3124 wrote to memory of 4232	3124	msedge.exe	82
PID 3124 wrote to memory of 4232	3124	msedge.exe	82
PID 3124 wrote to memory of 4232	3124	msedge.exe	82
PID 3124 wrote to memory of 2936	3124	msedge.exe	83
PID 3124 wrote to memory of 2936	3124	msedge.exe	83
PID 3124 wrote to memory of 3204	3124	msedge.exe	85
PID 3124 wrote to memory of 3204	3124	msedge.exe	85
PID 3124 wrote to memory of 3204	3124	msedge.exe	85
PID 3124 wrote to memory of 3916	3124	msedge.exe	86
PID 3124 wrote to memory of 3916	3124	msedge.exe	86
PID 3124 wrote to memory of 3916	3124	msedge.exe	86
PID 3124 wrote to memory of 3784	3124	msedge.exe	87
PID 3124 wrote to memory of 708	3124	msedge.exe	88
PID 3124 wrote to memory of 432	3124	msedge.exe	89
PID 3124 wrote to memory of 3784	3124	msedge.exe	87
PID 3124 wrote to memory of 3784	3124	msedge.exe	87
PID 3124 wrote to memory of 3908	3124	msedge.exe	90
PID 3124 wrote to memory of 708	3124	msedge.exe	88
PID 3124 wrote to memory of 708	3124	msedge.exe	88
PID 3124 wrote to memory of 432	3124	msedge.exe	89
PID 3124 wrote to memory of 432	3124	msedge.exe	89
PID 3124 wrote to memory of 3908	3124	msedge.exe	90
PID 3124 wrote to memory of 3908	3124	msedge.exe	90
PID 3124 wrote to memory of 1788	3124	msedge.exe	93
PID 3124 wrote to memory of 1788	3124	msedge.exe	93
PID 3124 wrote to memory of 1788	3124	msedge.exe	93
PID 3124 wrote to memory of 3940	3124	msedge.exe	94
PID 3124 wrote to memory of 2220	3124	msedge.exe	95
PID 3124 wrote to memory of 3940	3124	msedge.exe	94
PID 3124 wrote to memory of 2220	3124	msedge.exe	95
PID 3124 wrote to memory of 784	3124	msedge.exe	97
PID 3124 wrote to memory of 4304	3124	msedge.exe	98
PID 4304 wrote to memory of 2604	4304	msedge.exe	99
PID 3124 wrote to memory of 3652	3124	msedge.exe	100
PID 3124 wrote to memory of 3652	3124	msedge.exe	100
PID 3124 wrote to memory of 4824	3124	msedge.exe	101
PID 3124 wrote to memory of 4964	3124	msedge.exe	102
PID 3124 wrote to memory of 4136	3124	msedge.exe	103
PID 3124 wrote to memory of 4372	3124	msedge.exe	104
PID 3124 wrote to memory of 4372	3124	msedge.exe	104
PID 3124 wrote to memory of 4984	3124	msedge.exe	106

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://31e2838968a5483da54358ee722f0a15.101.us.prod.marketingusercontent.com/api/orgs/31e28389-68a5-483d-a543-58ee722f0a15/r/O-X_0FtBeU6PhFmXgtYBAAcAAAA?msdynmkt_target=%7B%22TargetUrl%22%3A%22https%253A%252F%252Fwww.ruthschris.com%252Freservations%253Fcmpid%253Dbr%253Arc_ch%253Aeml_ca%253ARC27Q1064B_vs%253AA_pl%253ATopNavReservations%22%2C%22RedirectOptions%22%3A%7B%225%22%3Anull%2C%221%22%3Anull%7D%7D&msdynmkt_digest=wdnt%2F%2B%2FCHz5YCO3gMkDzQou0Wp%2Fi13bWVEBy3exUD7g%3D&msdynmkt_secretVersion=a3955a744d9049f88dd8bdc1907bf2bf
1⤵
- Drops file in Windows directory
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x250,0x7ffe3935c188,0x7ffe3935c194,0x7ffe3935c1a0
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1688,i,965037577155332912,7585974024548146228,524288 --field-trial-handle=2016,i,8280849102939965802,6426185203742766666,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1516,i,2657122816356564627,2567383627421440791,262144 --field-trial-handle=2016,i,8280849102939965802,6426185203742766666,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:2
  2⤵
  PID:4232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2548,i,84830904993682788,12710041573989818470,524288 --field-trial-handle=2016,i,8280849102939965802,6426185203742766666,262144 --variations-seed-version --mojo-platform-channel-handle=2736 /prefetch:13
  2⤵
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3400,i,11149748179608907784,4016482973816585852,2097152 --field-trial-handle=2016,i,8280849102939965802,6426185203742766666,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3404,i,13628601367011925585,9705800262723766037,2097152 --field-trial-handle=2016,i,8280849102939965802,6426185203742766666,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4156,i,1341395282296321952,1142181542832835679,2097152 --field-trial-handle=2016,i,8280849102939965802,6426185203742766666,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:1
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4168,i,15688814854457202774,11326820558608623262,2097152 --field-trial-handle=2016,i,8280849102939965802,6426185203742766666,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:9
  2⤵
  PID:708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4212,i,18401074359224169804,4211728448872688404,2097152 --field-trial-handle=2016,i,8280849102939965802,6426185203742766666,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:1
  2⤵
  PID:432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4268,i,10267946804265530262,10507011549403777189,2097152 --field-trial-handle=2016,i,8280849102939965802,6426185203742766666,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:9
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3600,i,6880278810854431454,144083581836479072,2097152 --field-trial-handle=2016,i,8280849102939965802,6426185203742766666,262144 --variations-seed-version --mojo-platform-channel-handle=4388 /prefetch:1
  2⤵
  PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5400,i,17496446338469255158,5628919649901061661,524288 --field-trial-handle=2016,i,8280849102939965802,6426185203742766666,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:14
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,1892036190589711768,8997712138321049622,524288 --field-trial-handle=2016,i,8280849102939965802,6426185203742766666,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:14
  2⤵
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,5825744707016827975,1084225063714795259,524288 --field-trial-handle=2016,i,8280849102939965802,6426185203742766666,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:14
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,5825744707016827975,1084225063714795259,524288 --field-trial-handle=2016,i,8280849102939965802,6426185203742766666,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:14
  2⤵
  PID:784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5216,i,15591098645942080712,17640443240523088534,524288 --field-trial-handle=2016,i,8280849102939965802,6426185203742766666,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:4304
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1108
    3⤵
    PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6804,i,16095758351178462140,15457257029192539491,524288 --field-trial-handle=2016,i,8280849102939965802,6426185203742766666,262144 --variations-seed-version --mojo-platform-channel-handle=6800 /prefetch:12
  2⤵
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4628,i,18232357113142502526,14959788880929549457,524288 --field-trial-handle=2016,i,8280849102939965802,6426185203742766666,262144 --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:14
  2⤵
  PID:4824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4612,i,6111615866132873149,14901286360194163604,524288 --field-trial-handle=2016,i,8280849102939965802,6426185203742766666,262144 --variations-seed-version --mojo-platform-channel-handle=4604 /prefetch:14
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4616,i,14525891295431770039,3223857789800670287,524288 --field-trial-handle=2016,i,8280849102939965802,6426185203742766666,262144 --variations-seed-version --mojo-platform-channel-handle=4588 /prefetch:14
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5716,i,11285164608165274511,1975806143381149999,524288 --field-trial-handle=2016,i,8280849102939965802,6426185203742766666,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:14
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6288,i,3097422380973293581,610402935200083970,262144 --field-trial-handle=2016,i,8280849102939965802,6426185203742766666,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4984

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4988

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 9420686d12b2cba6dc69896d607eadac629280a010e5358a4872ab9753f24ed7
MD5 8be6e81804d8b903ae07c11b2e53e3d9
SHA1 817c41cb00b05a8f2040323b93c6416b92dbc01b
SHA512 c2cfff48ebb312975aa2615d841d0badff185589ad3a3f5e8420c2ea0eb5dc0e5354d917cc43d57bec169a63d4fa21d66e91dc3e195592ece23d37fff7c04680
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7R:fwUQC5VwBIiElEd2K57P7R
TLSH
T1CDB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 1024KB
SHA256 624eaf606d0845d9ef3f81652f29a5b8489b6543deb1e4fd4903c415238ee9d9
MD5 38623c06e100113cf825efa6a44b2386
SHA1 479d8e0c6d7d10c05203a37707a6249d2537a9ed
SHA512 452d7012b949688cabc6afbf4badfe9d02c090f30c06557f7f87b606cd716cda97771136964935eaa4d1668303889011f75ff599a79a6837c285ef84ebc2c8e7
SSDEEP 12:sUXhV0xosfxCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:fRqxosfxWMk8xVZ4YWI30otWn
TLSH
T1CD257885B34494FFC8C35A7189BE27902774F6DE5F02836B6A377A0E2E271D44B48220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e8c11bffd04a845e6747271563ae4a847b510ffe734f41902fbd4b2f062eee45
MD5 9391bc4c1d157f197ee937c50a0513b1
SHA1 6876d0c906cc67e359c85730e312ab21c9022e9f
SHA512 c7624f44a5f0344859c2b10351ec030d8b7ee6532d0895f59ad3dc1f0d843ba0c30c603b9732abcbfe351222d8c06f2d73e0f439168f1a1b2222c8fd3f566136
TLSH
T10ED012663B0E7045EB1542719453C344166D606615629612B1B8955C98A55D452851C3
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5116dd98c2b23ba5b09db7653ab553aa29b175fa64b8b9ed64ecd21beb5831c6
MD5 5ed835b9bd8886391af7b9dc575ac02b
SHA1 9a588837530f2096248ee7dee8596bb8d3c7d137
SHA512 44cb5053e3ad196ed2b5bd8cb0f51f9c889b22c1847f07a8819b2cb32d6fd93484e30687191edae9487bff46d6c4b744ba3b7a37f2b5644f920fa810083ed0e9
TLSH
T11CD012663B0E7045EB1542719453C344166D606615629713B1B8955C88A55D452851C3
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 8587b1988bfb60d01d994659caea475c60b4da98bccf8149fa9ff68ea285f05d
MD5 3add3413c8dd192ef099e77a57ea7a80
SHA1 af80eb6233265c4c4f6da41d8241788accdeec30
SHA512 babd532dd5c234a381992e9eefafc72b8cb83758fae962ce0c38dce3f7d676b8ef0c07d9bc879aa1177430c36cba4caaf4888637c97d882c8086373494741492
SSDEEP 96:97d7q5azg3a25DE8B2AsF4siwnvSYS1aQelH3Y:97d25azgK2rktLnakQeu
TLSH
T13C91E71706991CF8F7EE1175F0D1EA993A70C0CE88679FB702D0A63D6A16750288A73B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58eec0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58eec0.TMP
Size 3KB
SHA256 5931ec664fd7da1b606d0ad92be86f2689e7436f7455d2257ea370588707587c
MD5 5b73fd6179ea4b7f534f99cf5ea414f6
SHA1 3f9897b3b04c4361168f18bf6b5f69fc3b54f2b9
SHA512 3899f6d6a1a6d3de0cd3038bc4c71216d4032784503caae6c6cc594dc2207650f9b04e415452b02e58ab5a8d28bbf9e9cdbf7f223ceb7f8ea2ee77849c54fa0e
TLSH
T19B712A67061A0DE8F7AE0070F0D2D2493A7280CFC9AB5F7702D4DA7D7A1A721485A33B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 e725605d7fa7157fccae73c9171603116fd13d4d594efb5a60e630920df0ff81
MD5 fff35e802abe0f3a189f85a3ea32ca2f
SHA1 3a7a8fbf447311add505ed0ef25b87ebb482ede1
SHA512 d5ba9a5e6f801eaf7e015e4cd57612c81e8c8308f4531a944ef75b0ce122fe9b8a43b9d2a10bf91213e512cf728be0bfba5fdf56333d8ef4b649d66f8786cae2
SSDEEP 96:DENOLmLSeLnLzL+zBVLJrwBL04LHLKyLsqLqLqrLtLypLBLTaL1BLyLTzLq:DEgKGej/61Vdrkg4DmyoqOerhQdfavmi
TLSH
T1ABA19BB383E4C62ECD1159F0AB146D1BCE690568676C786788D4FF5793E30A2E241A4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 9b1f37003e796ba7f270bbfd5d62d09a6467ffef1586d1ae1bf3512c01ca11e9
MD5 b766d785434a7af17d646bd671d143a0
SHA1 e4bd70e85da1ecab111178dac5ea5e588d4901a2
SHA512 801a2e1f5f9019a2906568082010c2d315bfae64b1446ae35e41a87224bab1d84aeea545ff0f9b24dfe1fb57af6b3dd96ee6eb2fe64b23cee4e4b1d591039dd4
SSDEEP 192:sxZcRuyM/jK1Ml8UQLFSH/f5sVZbUKIdpnpV/W6+WNo/Vb/Y0sjRILIg5BJ:sxZcgqBI/f5sVBI//bW/5zt
TLSH
T1CD62D816AA349977CCDBD209F955BB93D6F4146293900E44AEFCDA0C05E6BED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 8c9aab92cc95fbf91e98071a4ac1c3170630e1216f292ab5bf08200cb77170e8
MD5 d9a7070cdc3095aff2a53d99e9ce5a5e
SHA1 e3596ca659c16b5577d9d2950341c1ea4c2961d9
SHA512 fdd5efbd6b8e5363c970f93b57a342b7474fb0655a0934a141a23c28314009a64922f4dbadc8d70c327c21a8dd54df66c2171755ac9398e80992928198aa3fb9
SSDEEP 192:sxZcRuyM/jK1Ml8MFSH/f5sDZDUKIdpppV/W6+WNo/Vb/Y0sL2ILIgrJ:sxZcgdI/f5sDdIV/bW/5k9
TLSH
T1F152D712AA349977CCDBD209F915BB93D6F9156293900D44AEFCDA0C04E6BED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 4ffa0fdc50b0842dd54ee95b7a600abfa226b6a23990f149ee942298adfe2ad2
MD5 60707831e5bef7bea69ad9e1d3914368
SHA1 010b8eaea23b0e1f8cd49651e820e69055192f68
SHA512 1fbee7bedc2ffd9f412b2ce49ff44595de61110cf5d074d2087ff29dfc22436a90ab38d2139c80e9f2fa63986f9c9054a824a58abeecd355529f227ce739c2ff
SSDEEP 768:De/Xh8dF27kWRmwcQZw8F1+UoAYDCx9Tuqh0VfUC9xbog/OV3mjLl/k601qgroId:De/Xh8dF27kWRmwcQZwu1jaKmjLpkD13
TLSH
T13EE22A3B280CC77E4F844E5CEC26AF966EE801CBA7584D5447FA894C03C77EB512A59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 07e0b3d0176f3e5e7931d5f59d747eb632fdb835dd442cc552a4f9e2afbbaf0b
MD5 18bad6de00770984fed5ff685f7b25b6
SHA1 4d55e6414cfeb0b1a5a9035ff4ba7af0c227aa98
SHA512 7d6d8af5b51f1062b9880b30eb8b4ef6e5edff7763da125629fe4bd767103a9c48b5e8da9e49ee83f41ab706c3792a9c9498169fcc2bb3da43152585d6764d90
SSDEEP 48:K7AbMQ6ea4m2trI5Y4KYdgC4kYoX9CQVyW/ylRPhd/mloWI55/KYug7/kHvXgVSX:KIRWKqQCqgwKhiiFuKuAi+
TLSH
T196916112317A47823C7DAA08859197364686B5EB3138A43B3BE804A60F7FE55EDFC4CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1a9cafc8-31ab-4765-b30a-3f2d20bc503a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\1a9cafc8-31ab-4765-b30a-3f2d20bc503a.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 ec5d8047cd0096274d23e9d12b10998bc4265caa7bb938eb9ee6685ff317ecd2
MD5 f73c0738ba27d573844f18fae08653f7
SHA1 caefc23d1b5de21e7f33d8fa412a5a384d9ed1fe
SHA512 4389d7eecdbe9779597982fb0fe557c62eb96ef1fc6da0d03abe484e0363e0ed1256af2e2fbbcf0199ad8862c30b2e9b782476869981785e854e457c82d41220
SSDEEP 384:9tNn/s3n9S18NQMQXi73fr/E5cOoKnOObjI9G6w7x9:9j+9Cyj/EQKn29Mb
TLSH
T185928E356869AD778DA38559F44B3B1B9EB042BF93C82E44E9ED6F0D05DB1EC4302921
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 bba2cbdf46382e5546f091617e46e90067e5cb78e456d2dbada3c3b305eb9be8
MD5 1f0015c40652ef84c925e5d1dd5af1ab
SHA1 4ccf39a7c030a0f82c4f8920ca363041e7871d8e
SHA512 723f55932fff48609ec786d6bd9ac85be82edec38a9bf0efb7248e401fa41da85499f43a1058a7b019ecac12c9f37c62e9c6ce8eef86c8c9a7a985ba43de58a9
SSDEEP 384:siFgtNn/s3n9Se8NQ8TUNTUlIl1QXi7ifr/E5cOoPnOObjI9G6w7x9:XFgj+9Lpwguj/EQPn29Mb
TLSH
T17BC22AF258D78936D96E4B57B77E2E068EBCC1ABB6841944B7D85A0CCC961BFC302910
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 380a53bce9b20e3a6bd023256f69423c6137e496e4f59f6d07a94a526a4138d4
MD5 8da4a3b43f12bb61a126c5d5d9f29e06
SHA1 a3658ad3e6366dbe0589fad1d2530d9643569999
SHA512 c759b8f7059ad8b5ec68c4d5b42262b9c2de9daaf4a091d8edbb3168c443db24b139d0fc98f46927cdf9704e0da5519fac88baef2a2e7a8e81623caa399163e9
SSDEEP 384:otNn/s3n9S18NQwQXi73fr/E5cOoKnOObjI9G6w7x9:oj+9C+j/EQKn29Mb
TLSH
T108929D356C69AD778DA38559F44B3B1B9EB046BF93C82E84E9ED6F0C01DB1EC4302921
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 d167b50d41bf215d18bb20aef9c76e0d83af5126a803fb6919b756ccc2be1915
MD5 2b6ac8aecee964b5d340b24a5b5938a5
SHA1 cfcf0b6b8689f34f8ebb01a56d2421a8e8b7f37e
SHA512 22ecebc2f5299d76d45e7cfc57e459df3091257094285aa050f3b782a7abd05ac055ac38ab2d428f90d5a76131d6fd467f76b154786e1a52cd8abfe07fe86e64
SSDEEP 384:atNn/s3n9S18NQ1QXi73fr/E5cOoKnOObjI9G6w7x9:aj+9Ctj/EQKn29Mb
TLSH
T1DD929D357C69AD778DA38559F44B3B1B9EB042AF93C82E84E9ED6F0D01DB1DC4302921
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 cf857c962fb2d2f874c5ba17857cbf8b67c70707eb994e628e24bea2b8609cc1
MD5 51759caa2af57167c36194a24e2f0b4c
SHA1 8a72f77e3e9b703bb391dbe9c79ecd262fc3d2a8
SHA512 3813c264810499cb5e339726181d4de0b6941e6db4c26c8ea8607fbad6f06f7f9e0de006393e2ae901daf52a4b65d6492b8821d1049542bec5fffddab7280971
SSDEEP 192:YGN56t6H34QmiUys0X29q/rUH5mZnGNJYumR/9nWqDU6:YGN56MXYM29q/E5cOovnU6
TLSH
T15A12283578A8AC6F5DA3A954B48737038E55426BEBC87F84E4EC2B1C01EF19C130A922
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a28289f7ea1fcd6932aa93985035d9d6292f3974a46a8fa6af777e4e42804755
MD5 d9c0171158bc922bcc46e0bac0334f18
SHA1 b4f03228e9e9456144eac270a64aa57d756f0f26
SHA512 2d90909d7822be8d82bed1fbfa280c48d9fac36b957e49970364fd152f7dec5469bba0a44bf02d8ee915c724be2c919e07bf78834b9565086ebf347bf3e24dc9
SSDEEP 192:1GNM6t6H3BQmiUyuHBHX2Qq/rUH5mZnGfD9MprU6:1GNM6MXf9F2Qq/E5cdpU6
TLSH
T13402EA387CA8ACBB9EA3AE45B48777179F95116FE7946F84D9F81B1C01D728C1342832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c14d3998-40d2-45a9-9d71-ee5d8c5ad3f6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c14d3998-40d2-45a9-9d71-ee5d8c5ad3f6.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download