hxxps://app[.]perfectvenue[.]com/events/2901370

Analysis

user interaction
yes
max time kernel
148s
max time network
147s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
10/07/2026, 18:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://app.perfectvenue.com/events/2901370
Sample260710-xe4e9ae14p

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
860	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134281828282172460"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2409539145-3342400454-2096821238-1000\{6BB223F6-E86E-4430-A1C3-5042F723D6DB}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2096	msedge.exe
2096	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe
2628	msedge.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 2628 wrote to memory of 1720	2628	msedge.exe	78
PID 2628 wrote to memory of 3432	2628	msedge.exe	79
PID 2628 wrote to memory of 860	2628	msedge.exe	80
PID 2628 wrote to memory of 1404	2628	msedge.exe	81
PID 2628 wrote to memory of 3432	2628	msedge.exe	79
PID 2628 wrote to memory of 3432	2628	msedge.exe	79
PID 2628 wrote to memory of 1404	2628	msedge.exe	81
PID 2628 wrote to memory of 4120	2628	msedge.exe	83
PID 2628 wrote to memory of 4120	2628	msedge.exe	83
PID 2628 wrote to memory of 4120	2628	msedge.exe	83
PID 2628 wrote to memory of 1044	2628	msedge.exe	84
PID 2628 wrote to memory of 1044	2628	msedge.exe	84
PID 2628 wrote to memory of 1044	2628	msedge.exe	84
PID 2628 wrote to memory of 3980	2628	msedge.exe	85
PID 2628 wrote to memory of 3420	2628	msedge.exe	86
PID 2628 wrote to memory of 3980	2628	msedge.exe	85
PID 2628 wrote to memory of 3980	2628	msedge.exe	85
PID 2628 wrote to memory of 2148	2628	msedge.exe	87
PID 2628 wrote to memory of 2180	2628	msedge.exe	88
PID 2628 wrote to memory of 3420	2628	msedge.exe	86
PID 2628 wrote to memory of 3420	2628	msedge.exe	86
PID 2628 wrote to memory of 2148	2628	msedge.exe	87
PID 2628 wrote to memory of 2148	2628	msedge.exe	87
PID 2628 wrote to memory of 2180	2628	msedge.exe	88
PID 2628 wrote to memory of 2180	2628	msedge.exe	88
PID 2628 wrote to memory of 652	2628	msedge.exe	91
PID 2628 wrote to memory of 652	2628	msedge.exe	91
PID 2628 wrote to memory of 652	2628	msedge.exe	91
PID 2628 wrote to memory of 444	2628	msedge.exe	92
PID 2628 wrote to memory of 444	2628	msedge.exe	92
PID 2628 wrote to memory of 444	2628	msedge.exe	92
PID 2628 wrote to memory of 1784	2628	msedge.exe	93
PID 2628 wrote to memory of 72	2628	msedge.exe	94
PID 2628 wrote to memory of 72	2628	msedge.exe	94
PID 2628 wrote to memory of 1784	2628	msedge.exe	93
PID 2628 wrote to memory of 4580	2628	msedge.exe	95
PID 2628 wrote to memory of 4580	2628	msedge.exe	95
PID 2628 wrote to memory of 224	2628	msedge.exe	97
PID 2628 wrote to memory of 2368	2628	msedge.exe	98
PID 2628 wrote to memory of 2368	2628	msedge.exe	98
PID 2628 wrote to memory of 2368	2628	msedge.exe	98
PID 2628 wrote to memory of 2704	2628	msedge.exe	99
PID 2704 wrote to memory of 5072	2704	msedge.exe	100
PID 2628 wrote to memory of 992	2628	msedge.exe	101
PID 2628 wrote to memory of 992	2628	msedge.exe	101
PID 2628 wrote to memory of 992	2628	msedge.exe	101
PID 2628 wrote to memory of 3124	2628	msedge.exe	102
PID 2628 wrote to memory of 3508	2628	msedge.exe	103
PID 2628 wrote to memory of 4760	2628	msedge.exe	104
PID 2628 wrote to memory of 4268	2628	msedge.exe	105
PID 2628 wrote to memory of 4268	2628	msedge.exe	105
PID 2628 wrote to memory of 4928	2628	msedge.exe	107
PID 2628 wrote to memory of 4928	2628	msedge.exe	107
PID 2628 wrote to memory of 4928	2628	msedge.exe	107
PID 2628 wrote to memory of 2096	2628	msedge.exe	108

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://app.perfectvenue.com/events/2901370
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2b4,0x7ffbff2ac188,0x7ffbff2ac194,0x7ffbff2ac1a0
  2⤵
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,7022507907024398864,10021378983238683806,262144 --field-trial-handle=2164,i,2768087524257144114,6158376174446264247,262144 --variations-seed-version --mojo-platform-channel-handle=2160 /prefetch:2
  2⤵
  PID:3432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1848,i,10865071632835512092,11635242491852262601,524288 --field-trial-handle=2164,i,2768087524257144114,6158376174446264247,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:11
  2⤵
  - System Time Discovery
  PID:860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2384,i,8926671840004191240,15065604501535314807,524288 --field-trial-handle=2164,i,2768087524257144114,6158376174446264247,262144 --variations-seed-version --mojo-platform-channel-handle=3100 /prefetch:13
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,2728608666782708767,15790738701882263067,2097152 --field-trial-handle=2164,i,2768087524257144114,6158376174446264247,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,714758096929058205,7004138913469842791,2097152 --field-trial-handle=2164,i,2768087524257144114,6158376174446264247,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:1044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4132,i,16767675837692843378,8569120114840704575,2097152 --field-trial-handle=2164,i,2768087524257144114,6158376174446264247,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:1
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4148,i,5763956414603274553,6321036880103047220,2097152 --field-trial-handle=2164,i,2768087524257144114,6158376174446264247,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:9
  2⤵
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4160,i,8152458988339405797,6625099727594415023,2097152 --field-trial-handle=2164,i,2768087524257144114,6158376174446264247,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:1
  2⤵
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4204,i,8571493099894631336,11556332562595177467,2097152 --field-trial-handle=2164,i,2768087524257144114,6158376174446264247,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:9
  2⤵
  PID:2180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=3512,i,13453405763079332318,15260584663525754606,2097152 --field-trial-handle=2164,i,2768087524257144114,6158376174446264247,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:1
  2⤵
  PID:652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=3636,i,1722238503080458236,12814835881615042730,2097152 --field-trial-handle=2164,i,2768087524257144114,6158376174446264247,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:1
  2⤵
  PID:444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5676,i,6868007683218029914,14097279858046818239,524288 --field-trial-handle=2164,i,2768087524257144114,6158376174446264247,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:14
  2⤵
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5672,i,13572011150251366992,9156753230732647478,524288 --field-trial-handle=2164,i,2768087524257144114,6158376174446264247,262144 --variations-seed-version --mojo-platform-channel-handle=5384 /prefetch:14
  2⤵
  PID:72
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,11232408427276369881,16488348975371453949,524288 --field-trial-handle=2164,i,2768087524257144114,6158376174446264247,262144 --variations-seed-version --mojo-platform-channel-handle=6100 /prefetch:12
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6468,i,3655078719019577468,176929408985780901,524288 --field-trial-handle=2164,i,2768087524257144114,6158376174446264247,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:14
  2⤵
  PID:1792
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6468,i,3655078719019577468,176929408985780901,524288 --field-trial-handle=2164,i,2768087524257144114,6158376174446264247,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:14
  2⤵
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6480,i,13545729289828823574,5162722277526410739,2097152 --field-trial-handle=2164,i,2768087524257144114,6158376174446264247,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:1
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6788,i,7956938406448051021,10715621648587051925,524288 --field-trial-handle=2164,i,2768087524257144114,6158376174446264247,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2704
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1128
    3⤵
    PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=7064,i,6168284123978592439,5154445272667629907,2097152 --field-trial-handle=2164,i,2768087524257144114,6158376174446264247,262144 --variations-seed-version --mojo-platform-channel-handle=7024 /prefetch:1
  2⤵
  PID:992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4912,i,8674563166159347723,14517956424798657385,524288 --field-trial-handle=2164,i,2768087524257144114,6158376174446264247,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:14
  2⤵
  PID:3124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4196,i,13532156284915398578,3840306470797702965,524288 --field-trial-handle=2164,i,2768087524257144114,6158376174446264247,262144 --variations-seed-version --mojo-platform-channel-handle=4852 /prefetch:14
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4412,i,2982117690472069947,16779736537524365107,524288 --field-trial-handle=2164,i,2768087524257144114,6158376174446264247,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:14
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4916,i,6653154637832225217,2195928556966185469,524288 --field-trial-handle=2164,i,2768087524257144114,6158376174446264247,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:14
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=5672,i,15461081822796230996,803367952253319553,2097152 --field-trial-handle=2164,i,2768087524257144114,6158376174446264247,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:1
  2⤵
  PID:4928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5076,i,15274788747423465517,10120383744587387771,262144 --field-trial-handle=2164,i,2768087524257144114,6158376174446264247,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2096

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:808

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 9420686d12b2cba6dc69896d607eadac629280a010e5358a4872ab9753f24ed7
MD5 8be6e81804d8b903ae07c11b2e53e3d9
SHA1 817c41cb00b05a8f2040323b93c6416b92dbc01b
SHA512 c2cfff48ebb312975aa2615d841d0badff185589ad3a3f5e8420c2ea0eb5dc0e5354d917cc43d57bec169a63d4fa21d66e91dc3e195592ece23d37fff7c04680
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7R:fwUQC5VwBIiElEd2K57P7R
TLSH
T1CDB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0b5dc1bf65a27f8ea20844919d7db192caf7a54fd791434a1304a7df2e9b496f
MD5 5de7bfd3f869f48e7255b6bdc532c4bc
SHA1 c26027eb70bc9887bf69c2b22be60226b685dbae
SHA512 0e6af8c455f57dc816a2c01366f46a0d069e8f41cccb1f7565e2afd873b71ffd5f135649fb4bf44d1a15a9efd68dc59696dc74a971b3483ec9d87a4323b2b4f2
TLSH
T112D08032FB5D6052E7455230D893DF10276644A12C974B41E325C84CD5B80D493C3282
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e3c932e879f8a7071362a654b47cd73c05f90d7fe66be785d811b84b86743e1b
MD5 8c92d931ed33c3d779a020ae7e111fb4
SHA1 de123f6d92bf24747affe820aaa8be3785388fae
SHA512 5be895d6a61eacf4f3117293636fb4890abbe186ddcbfbb3c8d3aa0fd1aa59519bbdd86e552732d2ded27aae5be1ffb0d6d9f6ccaac824d1b13ed03a12a438dc
TLSH
T13BD08032BB9D6452E7455230D893DF10276644A12C978B42E325C84CD5B90D493C3282
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 c7eb9e1edffe34c1a3e52102a6a6bca6527d5acb828ef2eb5ec7e9d5a4fa1ca8
MD5 dc367eeacf8d5047b1ed955688e64bf4
SHA1 aeec352899aa665a4add36ceeacfe6414d81b7ad
SHA512 5d30fa0f74892b69dfec1173676353f622e642eba0779de29c4483ad86a4793bc55337501952bcd4c970198e70855ff62fa6e744f77f1723c381b354237c3af1
SSDEEP 96:oynAlJwZnFS0ZXGgFpKUNKqKbg9XqmGnxnqAvUNfAgavtySN9wf4NOAEhbw+J1eA:NZzr6BvUK5RAAE6DjJz7gUQ1
TLSH
T146912B18C4C200AFF3A0E931B7E9092437FD90C655B35F2A1AD4CA7A682AF5CC565F59
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 b7cc84458429ec512ffcf23bc14351427c96fd65a6a2f62fefbe9fd1fdf11922
MD5 7385a23955048d13f9053a521a2b2fa7
SHA1 a23b5bf642dfe157efa004eab9fa08e7abaa6a90
SHA512 c6445ded5ecd18bb2cac1f806166922013dd52b55cec80e03d017b06256ff1d04ecf556987f933bd9af93bff91f22fbd6444cd0cb7deaa90002d467c59b0d14a
SSDEEP 96:2VynAlfwZnFS0aFpKUNKqKbg9Xqmh4xnqAvUNfAgavtlSN9wf4hvOArhfJ1Tzh7Q:2GuzriBvUK5WVWAr5NqNKzjJz7vPpe
TLSH
T15FB10914C2C128ABFF98D831B3ED092433FD90E555B78F390FD489796816F1AC829E58
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58d666.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58d666.TMP
Size 3KB
SHA256 75d27d8fd354a5d44611e12ee034766885106a6281f47de1f0f4c7a760843d6c
MD5 ee262a1dc5918932ca0891b12aeefc15
SHA1 6c81c311630d333c83affb0a8fdb38ef4c69cdab
SHA512 a5d3d63d014e0f3b5b12c9947041e1b638eb620aa48bb19a6d1ac63198bda5c5f7440049018497e9178ca7da2f804c3a49efd71ef27bf495bb37cd29f6ecd6f7
TLSH
T1DD71922944D2009FF3D0E930F3D1463437FEA0DAAA939F2907E88975A509F10E975D2D
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 279030adcffcde17cab6add25929ce6ed70bdf605acfcae25e6f22a88dcb05a6
MD5 d67bb009978fed7c9c948e4aa2e1de49
SHA1 f5bd9e61df6b506fac06052a0f4eb2b7af8bfa44
SHA512 520513f543028d3a9387deff93f1a1fe581cd048ef856bb0f0a2e675a62d366459d1dc47cb4cf7a6f8a000930d64e5a0d7cc7991a89599cbccdf8c3792e605b3
SSDEEP 192:DAJomQUNhSeumDrvemGHaBwkdcALkQI4Ovctr1hhBpUsRYggb3Egfs02sodN4KL:DAJomQUNhSeumDrvemGHaBwkdcALkQIM
TLSH
T17822A8E383F48E6EC85151F97A646D1BDE280969076C385E89E4FE0AB7E3071D32065F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 050065228440d5dc7e4861954728a73ec4088b84fa48405df90143ed5c1b7aa7
MD5 897908a12164be9f89d44d5319bd5d2e
SHA1 990266355432b702c7e6b8270d12541fd427cc5d
SHA512 de1aa8ea19c61a4d8570cc0c803862da335898a5a4deb59d373166e279fab4f552d7059d8d5731add839ffaac669d7ad0951967a9d482b6390b892002e9229dc
SSDEEP 192:sxZNRQyM/jK1Ml8UQaFB/f9sm/ZIdpoNV4/W6+WNKNEyXY0ohmJcIg5KJ:sxZNyqAB/f9sm/yJ/bSX5c8
TLSH
T1EB62D752AA345D77DCCBD209FA45BB53E6F9147292901E44AAFCCA0C01E6BED621381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 31KB
SHA256 c18d4e3cb13dbc73606f114c25ada68d2377c2ab00d491450ed81afd55c72fb5
MD5 20b065928c23a13d63ac32560b120301
SHA1 afc8ad2d8901c3fccfbec09e80138f67df108c1a
SHA512 b5f742a78947d21bb45777a90268d6435e0d926d6c69add8856ce73a63898644d4708374415b0d7c41b1acbe4525f52a7851ec0eff7f12b19f35d325c2fc2c4a
SSDEEP 768:9Pc0s8Ww2YfWRm/JQg18F1+UoAYDCx9Tuqh0VfUC9xbog/OV3BOLl/TB0OZ8roDY:9Pc0s8Ww2YfWRm/JQg1u1jaKBOLpTuOm
TLSH
T1CAE2F93B284CCB7E4F840E9DEC26AF967AD802CB66584D5447EE494C03C77EA521A49F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 42a572dfcafe010893b88f3d99410b1fa51eec75f04a3c9007c1a76a36e03bc2
MD5 dc8d18efc9618c93f4c3b5aafcb475bf
SHA1 86458e53770061b4b619b26a5728e331f591e0c4
SHA512 ef91740fedd210a6c60bb79fba5a4424387c3e3eeb726e38d994c5a773f574d6dec3343b88b7d9413adbf3c72aaaff9384892027cfdddb915b41b9f908970f32
SSDEEP 96:KUgAK12CBJ4/7JvPBWbWcgDBKYogJBsxZeDvCBobcYa2KgWedzgggKY1gSgsQgtX:6DvTJf
TLSH
T10191494776BF02023D7E29099295DB961B41B5A770B8742B3BA900BA4E6FF110DFE4CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

fe3913fe-b472-4747-bbfa-dfcff7c128f5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\fe3913fe-b472-4747-bbfa-dfcff7c128f5.tmp
Size 13KB
SHA256 02f00796091c805c3920325944e8797cc6e387139285e337996c450ed1cf765d
MD5 2716003d7386af6c54ce9d664df331b2
SHA1 6fa9a9b3921ca0e9e567921a33b97eb8fc8cd551
SHA512 9273250c0468047fbe8e91f72a1ac399e01972ccd3245632a20c68f76e8bbce0df0ba90be910870a22e66ecba678d17ae4932ea0a54175faf4f714809b7fb14d
SSDEEP 192:sxZNRQyM/jK1Ml8MFB/f9sCcDIdpuNVn/W6+WNKNjb/Y0oi/WcIgrJ:sxZNydB/f9sCccw/bc/5d9
TLSH
T1A952E7126A349977DCCBD209FA55BB53D6F91472A2D00D44AEFCCA0C05E6BED621381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

95b6cd13-d31f-474b-8208-a061c8bdf955.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\95b6cd13-d31f-474b-8208-a061c8bdf955.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 60cd748a1ed596060777636d35647898c75307ed5a727a5b8c488a112b6d68fa
MD5 057655491b2db03ba39487578ba2a0bd
SHA1 7b0d52e5361814a5dbd614518f06c59867cd4c69
SHA512 5c577c96edbcc4744fc7931a4caa93db98e3c94e596583010aa55924a805cb92b12402c2da4e6d4e58a13a11bb720b6b45e3fef92d16d0dd7929c303c7cd4c49
SSDEEP 384:xtNn/s3n9Sf8N0BRRwC8aZVUu8YEus8W1uKYozyJOObjI9G6w7bW:xj+9UH3FSCE1D1BLyJ29Mq
TLSH
T179929E321C29AC33ADA356A9F54B3A279FF4553B9AC52F48D9EC6F0C01DB1EC4311915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 44a3d40ca10cb86ceaf8c0d75181f9ffa54a18fbe8995472c050f03687c994ec
MD5 07f65420d97f32166e88e6d64c91b631
SHA1 8f66291ad59aef35720e6a619d9da19990b193c6
SHA512 1bca91c8a78e6bf3a9438a40c05626240c0c4e6cfddbc5bfacb799e5403b93eb23b0d57383c1b205d36fb24b9cc6bd43c3fdff09749c00cd616c3649beb3357c
SSDEEP 384:yiF1tNn/s3n9SF8N88TUNTUlIlKRRwC8adVUu8YEus8W1uKYo23yJOObjI9G6w7q:5F1j+90VwgI3JSCE1D1BO3yJ29Mq
TLSH
T171C218F208D78836ED6E4B5BB77E2E129EBCC167B5852A44B7985A0CCC961BFC305811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 4f06dac567c765e9df12b1d2516ec4bf7cadefde445e47cae7bdbbe69973bd58
MD5 c6761c5e184dc65c061bb6e5a742984e
SHA1 a6bfca07ab3d25447fc22d47f1c009a50822bf8e
SHA512 24c5a9b45e1323fcd0b66eaad71224cca1ce6e7aaecf0276b54d1f9b27bc5a405768d2a53e1794b793a519c9e682dbab231140992b6c92a928bfd4c6b66d5f5d
SSDEEP 384:stNn/s3n9Sf8N0KRRwC8aZVUu8YEus8W1uKYozyJOObjI9G6w7bW:sj+9U+3FSCE1D1BLyJ29Mq
TLSH
T1A0929E321C29AC33ADA356A9F6473A279FF4513B9AC52F48DAEC6F0C01DB1EC4316915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 60cdd98fba36995ad2c864d7e32f3e997baac61a4aead90c4bae1468cc420204
MD5 de789282a2b32a65fff6460bb9230078
SHA1 85b9f44106e8a570f32911b697256b117cbf7e04
SHA512 e3902418259078bc539ffe656512fab77d326a076ec41b33377b4c79c7eb5e22d24152fca902590267c276a0be310dbabd41dbc2470e65d2ee1cba33b36139a4
SSDEEP 192:XGNV6jCQmiUy1IAf4SufoPxzY5Sus6l1okSnVsTfU6:XGNV6qW/fju8YEus8Wx2TfU6
TLSH
T1D802B9356D68687BAFB36E45FA8737139FA4112BA9852F44DAF81F0C00D769C2346836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2ab1ef02b4590bf70e80cf831a434c18e95276840c4a935830bc8d061d62c137
MD5 4ea710640ac9597af2757d19ff943207
SHA1 bb1054ac9e081ca18519fafb8aafba02454fe12a
SHA512 affc2189f855947b31c548040e8449faec1ddbf0c6cc9c88eb5cad5b9f4d6ae1689c55f60a395038e1d28f770bb5a0d6b509b784b1a3123f3c799ea871057afe
SSDEEP 192:ZGNN6jGQmiUyEAn4SufoPxzY5Sus6l1oaSuKPwoDOMBqZJU6:ZGNN6Winju8YEus8W1uKYobyJU6
TLSH
T1C512E936686CAC27AEA36594F58736139EA55127DE893F44D9FC2E0C01EF19C630AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a50ec7f5-4c1e-4041-88de-d25847209860.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a50ec7f5-4c1e-4041-88de-d25847209860.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download