bd3ee49a5ab19d15ddc44b421b0bdefce587790786989ae77cf3ddf1e6a2ba8d

Analysis

max time kernel
898s
max time network
743s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
12/07/2026, 12:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LICENSES.chromium.html
Size 7.9MB
Sample260712-ps65asbz4x
SHA256 bd3ee49a5ab19d15ddc44b421b0bdefce587790786989ae77cf3ddf1e6a2ba8d
MD5 0e3e4362f785aff0b9e1852b1064c0f1
SHA1 a42ccb51e72bdcb5bb905a62efaa28857def3a17
SHA512 193b57efc5f5971fbd9e4ea1a80b34aadcc2a814ff49c4c06afe972bf327e98ff0498217a8bdef984b10fdec6e7858a6fb88c0b14936e0c6b404387a426b87f2
SSDEEP 24576:dbTj6ck6f5kVWS6RqLsWN3Omfpe666A6f6X6TTHW9GqpaE:tEx/i
TLSH
T1A786942F7B48037706C60262AB8BA5CBF21F903F3B561654345CD1681F6BA2583FB6D9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
636	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134283336897463978"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{69E5ED59-4A30-4FB9-8C68-8AD247470B49}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe
1168	msedge.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 1168 wrote to memory of 1920	1168	msedge.exe	83
PID 1168 wrote to memory of 636	1168	msedge.exe	84
PID 1168 wrote to memory of 2432	1168	msedge.exe	86
PID 1168 wrote to memory of 2432	1168	msedge.exe	86
PID 1168 wrote to memory of 3456	1168	msedge.exe	85
PID 1168 wrote to memory of 3456	1168	msedge.exe	85
PID 1168 wrote to memory of 3456	1168	msedge.exe	85
PID 1168 wrote to memory of 1236	1168	msedge.exe	88
PID 1168 wrote to memory of 1236	1168	msedge.exe	88
PID 1168 wrote to memory of 1236	1168	msedge.exe	88
PID 1168 wrote to memory of 4040	1168	msedge.exe	87
PID 1168 wrote to memory of 4040	1168	msedge.exe	87
PID 1168 wrote to memory of 4040	1168	msedge.exe	87
PID 1168 wrote to memory of 4516	1168	msedge.exe	90
PID 1168 wrote to memory of 4516	1168	msedge.exe	90
PID 1168 wrote to memory of 4516	1168	msedge.exe	90
PID 1168 wrote to memory of 2936	1168	msedge.exe	91
PID 1168 wrote to memory of 2936	1168	msedge.exe	91
PID 1168 wrote to memory of 2936	1168	msedge.exe	91
PID 1168 wrote to memory of 824	1168	msedge.exe	96
PID 1168 wrote to memory of 824	1168	msedge.exe	96
PID 1168 wrote to memory of 1208	1168	msedge.exe	97
PID 1168 wrote to memory of 1208	1168	msedge.exe	97
PID 1168 wrote to memory of 452	1168	msedge.exe	99
PID 1168 wrote to memory of 2792	1168	msedge.exe	105
PID 1168 wrote to memory of 1708	1168	msedge.exe	106
PID 1168 wrote to memory of 2564	1168	msedge.exe	107
PID 1168 wrote to memory of 3972	1168	msedge.exe	115
PID 1168 wrote to memory of 3972	1168	msedge.exe	115
PID 1168 wrote to memory of 1856	1168	msedge.exe	116
PID 1168 wrote to memory of 812	1168	msedge.exe	117
PID 1168 wrote to memory of 812	1168	msedge.exe	117
PID 1168 wrote to memory of 3800	1168	msedge.exe	118
PID 1168 wrote to memory of 3800	1168	msedge.exe	118
PID 1168 wrote to memory of 1568	1168	msedge.exe	119
PID 1168 wrote to memory of 1568	1168	msedge.exe	119
PID 1168 wrote to memory of 1596	1168	msedge.exe	120
PID 1168 wrote to memory of 1596	1168	msedge.exe	120
PID 1168 wrote to memory of 4412	1168	msedge.exe	121
PID 1168 wrote to memory of 4412	1168	msedge.exe	121

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff90992c188,0x7ff90992c194,0x7ff90992c1a0
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1756,i,14701758558459431857,16086894224282311166,524288 --field-trial-handle=2304,i,18040363823369981243,8011239932810630863,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:3
  2⤵
  - System Time Discovery
  PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,6049883788765018855,14761680096866984697,262144 --field-trial-handle=2304,i,18040363823369981243,8011239932810630863,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:2
  2⤵
  PID:3456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2436,i,17923820937348531972,18221081479027283640,524288 --field-trial-handle=2304,i,18040363823369981243,8011239932810630863,262144 --variations-seed-version --mojo-platform-channel-handle=3076 /prefetch:8
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,9968728259661127712,4375999032962409610,2097152 --field-trial-handle=2304,i,18040363823369981243,8011239932810630863,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,7470329263547474900,3505005381199833267,2097152 --field-trial-handle=2304,i,18040363823369981243,8011239932810630863,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:1236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4168,i,16171783168406688326,18106555083123686258,2097152 --field-trial-handle=2304,i,18040363823369981243,8011239932810630863,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:2
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4144,i,7728784666939309504,12188089691908044843,2097152 --field-trial-handle=2304,i,18040363823369981243,8011239932810630863,262144 --variations-seed-version --mojo-platform-channel-handle=4128 /prefetch:1
  2⤵
  PID:2936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5052,i,8138958455862574425,5169982034344599347,524288 --field-trial-handle=2304,i,18040363823369981243,8011239932810630863,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:8
  2⤵
  PID:824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5068,i,860986641640586467,7548900277271573850,524288 --field-trial-handle=2304,i,18040363823369981243,8011239932810630863,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,3010617434103408173,10070086295769331216,524288 --field-trial-handle=2304,i,18040363823369981243,8011239932810630863,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,3010617434103408173,10070086295769331216,524288 --field-trial-handle=2304,i,18040363823369981243,8011239932810630863,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3640,i,9891499360340996445,9232625730413334852,524288 --field-trial-handle=2304,i,18040363823369981243,8011239932810630863,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:8
  2⤵
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4324,i,9789302279068512591,13963195444422672809,524288 --field-trial-handle=2304,i,18040363823369981243,8011239932810630863,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:8
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4308,i,16911504267453579723,8849340603168167362,524288 --field-trial-handle=2304,i,18040363823369981243,8011239932810630863,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:8
  2⤵
  PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5260,i,15745807550204482887,3309357018726118003,524288 --field-trial-handle=2304,i,18040363823369981243,8011239932810630863,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:8
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4208,i,1854514113300203007,7614346158665139216,262144 --field-trial-handle=2304,i,18040363823369981243,8011239932810630863,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:8
  2⤵
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3360,i,16900265575085878113,14058268668646922689,524288 --field-trial-handle=2304,i,18040363823369981243,8011239932810630863,262144 --variations-seed-version --mojo-platform-channel-handle=3364 /prefetch:8
  2⤵
  PID:812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1288,i,4211903215115682364,17073678530051300823,524288 --field-trial-handle=2304,i,18040363823369981243,8011239932810630863,262144 --variations-seed-version --mojo-platform-channel-handle=5900 /prefetch:8
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,8629664056656835291,9775447360964474899,524288 --field-trial-handle=2304,i,18040363823369981243,8011239932810630863,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:8
  2⤵
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3344,i,7858389570297661740,16128585575714018870,524288 --field-trial-handle=2304,i,18040363823369981243,8011239932810630863,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:8
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3840,i,9982677648376896993,10356002605291843434,524288 --field-trial-handle=2304,i,18040363823369981243,8011239932810630863,262144 --variations-seed-version --mojo-platform-channel-handle=2692 /prefetch:8
  2⤵
  PID:4412

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3216

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ab98da7535c8de464335204ae97fd672936e639269325c3a388b3039d8396b83
MD5 1656a3560c7aeae221756f3891b89fd3
SHA1 e48441fe2b843ba3bd0bb7799c07b22a27db8eb7
SHA512 c06d7152d11e33601716d4c5c33c7373ac4e0c16571e80ac4a8ffb9cabb52fae51d4fe8d808fc75be943287b55a320e90a186d71a5f06e9db006f6ab89266400
TLSH
T1CFD09B307B597042D3074031E8074790169E84B5249B86066554410D7D5A485E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ec6419a915c6f94199df67c6cf1d67bc666c22ef160c8377d6792913a6518679
MD5 a8d0099e5966b86c13c6997282a63770
SHA1 df541b93a0caebe364906ec90c768bb625495f4c
SHA512 a2093c42c3f547b910f560ee7a58cb187cef96045e8e335276c7bde87fdc5e9894b670421e94170d0878e86a2bea8125d914e11181882004f966732f9670a693
TLSH
T135D09B303B597442D7074031E8064790169E84B5249BC7076554410D7D5B4C5E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 8eb3794adcc0d992cb8f9dfcfd1f068297f20b56d09c36bc551b25cce4c886bc
MD5 35775c5f0648d3747b48a8bac8bdb5da
SHA1 5e523cf5390ef8f97190bdcc062ae5a240d5199c
SHA512 92b6f3e9f02f82c80cbead7afb454eddfcedd7093fdd59a42af6e5341468a8da9778e20c180f42208c4b4e2d00cf24357df3c6b54ee8b385c53cb91625886a1b
TLSH
T124E078D439D4C25E514C658B43F4D74C8D93360FD2CC6A0F6F048C8472418407FC7550
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 ced9042fa5e4ce50192328cf0abda045d89e6c130cd92613e759b9c48757a58c
MD5 6c3b624cad73ea87fe5207dbb902f898
SHA1 d180490d4bfb662bcea0b1635a07eba5b8a220e3
SHA512 c35006baa021f29ddcbc9434c738b0c8644b188f6b4959409faa5a1ba2cfb8ee26f6855db5f2467d9c1d72bd0007d47a07d298d9f61b88fb844e2b8761c9c41c
TLSH
T16AE0DF8523B4C5E443A2974FA2E8E36E5013700B99CEC69E334476D82C408898386980
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 448c9783dadf46a5c71780515ae404ebdd3dba0dbbbb82ea06086b4924cad23e
MD5 bde5912352bbeb49ea24e65106a58fb8
SHA1 1f0ee600b3dc82668af02a33b633c72a80269399
SHA512 f8cbef279460af8571eb2f05d05c9a29d296a668911a99eebffe86d43dab322f3d120537267703921a2f9ae5c8980c79b7475cc039927684ab6aa70205cb8327
TLSH
T14AE0DF18A2B0C5E843859B4AC3E6F63C5002B007F2CCDABF324AA8A42402902A353C80
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 274B
SHA256 03c949d303f47091509350b1f5c5cbc4174626adb67e7d7de8ced472d6dd47be
MD5 f2bd07f146a1f32ce5ed38b023a386eb
SHA1 5967561ad29a37badcf3046f7dfe00f15c20ed53
SHA512 0d61ac541dcb5223aa5f662f700c15fa429ed6fb2ab7c101f17df3396b87747e882cc6bf4ed4c0657b33049d7fa377f289ac71bbe18fa1d1d061669a869daa74
TLSH
T168D0C2F8B8CC684FD7E52AFD4266B0400F5442E29416DE120129F98132549F01F56070
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 8282774af1fe0323b623abcaef9901b1fe5fcfc21985cd43bb0d0b81025e5fc5
MD5 5c2ea07a8236b3a543cc8820cfb84af8
SHA1 29ec11b2e8ff2229537dcd57161e82a934960b9c
SHA512 fad20a740c6145797a415103a928c97f0177350d72bc2125faabeb359a43734ad686ea15868ca9629a74a8844dafa0ac0209475de28d7eaa2ffb98b64a27a247
TLSH
T140714C360087DCAEE75D00706CC181F334718DEAF9471E9B91BC2EB41A1AB63B22B588
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c501.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58c501.TMP
Size 3KB
SHA256 4d6b51d0ded8bc4453e39ea91be8c6e68ca9ea8e043e0e323d49c2f56298c324
MD5 4b5c9f2938e99aceb8d26d736f06695a
SHA1 eb9f5ac95249323561272463945a02a026571520
SHA512 20ac984f88321800f6bbc9d23a3777c831d9a1fb63d584e940477f3af78b137b4b0e9435495f63b8067a73030f3b2ef84d2cfada8483d3f77eac3c9a1658486c
TLSH
T1A7714D360087DCADE71D00706CD181F334718DE9FD476E9B91BC2E741A16B63B22B588
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 7180f2b04bee441076dcb0e70992a26c1d39a4eb1e3773bdaf4beda808167aee
MD5 e9b06f6947d58f151621b319d21fd165
SHA1 085f5dc000686971e22b2c67c70fdc331ed278cb
SHA512 7b802b149713f0c47924a2c917bbe1d5cdd20617622b997910a23ac55c092f19c74dc337d3a78b41ef9884c9dbe6b9a4aacdcf02d1caca5cc11f1f3bda40c2e5
TLSH
T1D521D0F383D0856ED91156F06A18BE1FCE1D0602431C3C558AE0EF5793F3075E00295B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 211a4fdc740e3a95cb1162d96fbae6eeef8ebe7b09ac020f46add455520946eb
MD5 7a3e484a9aec014d21b29106d177e70d
SHA1 dd0e1646b5562a88298f3f7430d6776e7d8dcb6f
SHA512 64bbc2f20287c459b8a095840ab1289d670d2dd46f0f13dbb1849d049483db71bcc84988f227fa1e420e3feebbd914b03ade34c16bd5a48201ff03f6a47698b1
TLSH
T124218EF383E185AEDA1156F09A18BE2BCE2D0505421C7C6986E0EF57D3F3075E102A6B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 7f2e171a702cf0a398bda67cd724f36247c42dcda0ae6398d5268c5c68d814b9
MD5 524f1b98b79664618449cc6af71450f2
SHA1 d844c307800400dc33261fe513a3042fef826a9e
SHA512 abf8a0c2dbe4e48c595444ca0ca12841cc439fd0b182df228909b952a9903193d6f967994dabd1262503546d4caeea434b0fa5bbfe57c7c08d37806447e00479
SSDEEP 192:sxZFRIyM/jK1Ml8UQVkn/fHsypjqIdpHpHW6+WNGYzGPxTIg58J:sxZFOqen/fHsypvJHbGXe
TLSH
T17852D9166A34997BCCDBD209FA45BF93D6F9147293500E44AAFCCA0C01E6BED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 8c85dfa71d58bf0745fa8b542d1e70e2ec87c3f6e19f79bf9eaef269c751ec0b
MD5 8d0e15b7437106c6328ddf1700e29c1b
SHA1 27638e9ab75cf3a045679d71fd70818296b2db9f
SHA512 612c7b08126f907091f49bde3cebb72f8d01b2a1c8490d39d69640ac7d1fccd6825075ddf5e406c3dc62575ac18daf2c5a22d9481c7f9624f880babfac94c0b4
SSDEEP 192:sxZFRIyM/jK1Ml8Mkn/fHsUajqIdpdpHW6+WNGYzQMxTIgrJ:sxZFOMn/fHsUavXHbGY9
TLSH
T15E42F9166A34997BCCDBD209FA55BF53D6F9047293900D44AAFCDA0C04E6BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 c0674168e0aff246606748b79c056bbe75a1553f396ab9d38394e638749e207b
MD5 415f41286704317667e5e778d58245c4
SHA1 6d7a91ca898b9517df2be201a410571a21433d8a
SHA512 21aca5ed2a0d92c1da42960906d68ef841c8773f132acb12a78c3bbdce2bb2efbf9bcde381e3d089436e2fcac43a35429dddb2979e8d1d65e3044c4232ba8777
SSDEEP 192:sxZFRIyMqZjK1Ml8UQVkn/fHsypjqIdpHpHW6+WNGYzGPxQIg58J:sxZFpqen/fHsypvJHbGYe
TLSH
T14B52D9166A349977CCDBD209FA45BF93D6F8147293504E44AAFCCA0C05E6BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 2c4f85407fca803f1c7ccc660bb9ce18c9fea4905701866ca986cc6055c2c0e3
MD5 564b572e40f9d269e22b7d75c881db31
SHA1 fd26a22ff8f28bf0387e29e297a9d74aeef4357f
SHA512 7a87d3f34642b3dd22761b9cd81f3153016624ab7a7c1eb20799199dda7ff92a5240d2f31ae54783ece6a9e82d3cfacb50a0d2d19f983acbbdb3066e5ec43ed6
SSDEEP 768:FFYhW7kf0Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX5LlWYSjYBroIZitYX:FFYhW7kf0Wvqidau1jaa5LA3jY6MX
TLSH
T1DFD20A3B680CCB7E4F841E5CEC266F966ED801CB67988D5487FA884C03CB6EA51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4520dadc-db5b-4f2e-9026-0b551f142464\index-dir\the-real-index
Size 1KB
SHA256 7864c80fe1ee2e602f80143b7c58f12283a421ce7c7af0dffdf28cbd4c93a26d
MD5 3ed44d5c79cbf32d681dc5e16cde5347
SHA1 7bd5f5b061974e8faf0fbb920263c32a9f0efe60
SHA512 2afdaa64833fd846a836a2dd8f37645a2f32ba263fa60e5f4f57c02d825efdf3b07fa7ca64afaaf6a90f6575b519af00060a827c65f8e65dd0a3b21caf296e17
TLSH
T167213E898E90956FEAA489F20077B1E03370D9CC2712A3A3483C72362C223992A0B084
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d1456.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4520dadc-db5b-4f2e-9026-0b551f142464\index-dir\the-real-index~RFe5d1456.TMP
Size 1KB
SHA256 de457cd913dd41afb0a7101bda7822ccda7bee81787be0ccde8a31578eacf689
MD5 83452bac2dd1788b02194354f9b8cb7e
SHA1 d9b7c6607cd99df4115f09f2d8622e3bdbe1da7d
SHA512 f4c809e67117cb7c98b9adfe2309d5696afe137c69be1cba08d5f4fa504b7d563cc9598a80e2c63eb32efb297369e1818d9f4cc22df6709f46fff38241735eea
TLSH
T1F9211C8A8A96590FE8E085B60552A4B83374C900A322B3D3987D633E5C3579E6E4F0C5
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 2fa378e5ff212d5b5b1cf07a91d58661ea1908ab82f17e050f4d2aef2f67f38e
MD5 2a6230722a370d2bd529e6f4606f6f85
SHA1 d4e26f31e8006c5de15dbc4725510eeee7447982
SHA512 100736e1d11f1b7e9bc47c0f4ce40b993625aaebacd988c12d0933edf8e6a69aae33693378a7806a16a7ba18f32c8cc2ad84fe89bcc2e7deab28e3fee147f94a
TLSH
T1C2E0D8BB2DFB1824AC7F97D538B1A5A1858539589514EC4E3167A29770F2761280AC21
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 f47cfe5217a785a1818812a3b635429aebc00635afa8203628d0fb314cef0178
MD5 2bd39639c25c9af391ece6e1e993b6cd
SHA1 84eda23bc94759554755d8964528596b420b3662
SHA512 57b4eb4dbe24e7198e77e71c1945c6c79b969dbc0854284a06d5da57ea4501d381e7a922557bd02a0d4b3e80d42fc0b55df10f9eab9bf86ca68e8a9947ec84c4
SSDEEP 48:KfSVOyIQA2aQL9IZy2KYTvNIZKWcM60IrKxCsTyVFI1Ke+:KIbCKcvNSKWc10YKxCC+FSKe+
TLSH
T1B3916646703B164138BE38489295CA36DE8375633419B56F3BE808A24FBBE125DFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5960f2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5960f2.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 00c82921de1af6f7ffaae31b45041028c2fe90d56f579f2495f92d923696df59
MD5 3398dfc3bae547357e2156b5caaf0925
SHA1 8c56b3c52af5e8134849420f83b0dbd6645154cf
SHA512 58ba0d5deca18f9139e46e2adebe3a2c911bd9df852fb2148cc954b62c590934dc1285ab068338cb6066e71fd4432c7c1fadcf05b52e6d26ae6a88a1089691bc
SSDEEP 384:htNn/s3n9SfsNjTATSHbi0ks7LCB/fOObjI9G6w7Yl:hj+9U/TSH0Ga329M0
TLSH
T1A392AE36AC695E6A5D939111F08B3A0B5FF841BB93842F44E6ECFF0C05DB6AC531291A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 d2c3129cd072701787c31976ee0917cf336ca841b79eef6f8d7cb143344ff5be
MD5 4de41ed2e43d85df7030fd792ba08a57
SHA1 d5d3367b416061c333ecc3d719a7ab0cfb7611c6
SHA512 b05de6666c5e9e0bc3324ca11543ba6dfdca2fcc97695b87642824f66967580330598eb47c8fe4658ab5aa23d8fa8330b4c3fa91b58b0f1283c33688394c3cb5
SSDEEP 384:7iF1tNn/s3n9SpzsN98TUNTUlIl4ATSHbi0ks7LCA/fOObjI9G6w7Yl:WF1j+9+UwgrTSH0GZ329M0
TLSH
T17EA27D375C548E7FADA29A51F58A360B8EF841BBD2806E44E7DCAF0C01DB1EC5306D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 00b8e7c430f5e7f35f007c0a5a1071a115516f9959a07ef2af62a987a64b6903
MD5 832e1d39e1c5d1d09bd4c4f2f9848b74
SHA1 cde184ea92458fa0b6c327bfbe9ba9bb36069fcd
SHA512 c5343eab94a2997ab7ed608dcc467d557505305721c7ef94ff065410f018a15b84a9dc60b31af3d92ee057e575c70279b8da5dfd7214962a1fc8158cd68d7fe7
SSDEEP 192:MONx64BAQmiUyj1eW5GBPKIOCHruaD2jU6:MONx6eAooW8LL8U6
TLSH
T12D020B396C796C7B9EA2AE05F88637175FA8113BB6945F40EAE45B1C00D724C230382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 06c2d4fd783755ad60eb04abc91e52af7b4ac55c2ca504cc1a9cd4ffd13befc8
MD5 71cb8b44e37e96dc5ac19e3cbcd7dca2
SHA1 3de5e1a6f737c6d5763d6b79947f6f458fb73017
SHA512 a77cb9acff3d2182e7e2ac0c577297a7d1e1bab235f466d1f41b1ba842a0f2dee61e384caa422b557ea6dc5e75e9b742d2248b5f29cd06cc836e2ae8b8457a97
SSDEEP 384:utNn/s3n9SfsNj4ATSHbi0ks7LCB/fOObjI9G6w7Yl:uj+9UkTSH0Ga329M0
TLSH
T1B892AE36AC695E6A5D939111F08A3A0B5FF841BF93841F44E6ECFF0C01DB6AC531291A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0b62934bf0af14dec1b38e10fd76de53f7abd19640ba48c0b5ee862de79d8479
MD5 b4c8688f29848c03f50ec142b0ebd3b3
SHA1 f53d54abbad7179a3628aa53d6b4a3bc77b26431
SHA512 cba27409435fb1af9d928de95113c0a0c3f9f32d41765a8916fe65e69329a19bb25479ba85da9b68b36814eaf461933d653641fdac7371f6b761237e114f3d69
SSDEEP 192:nONu64BDQmiUyUe85GBPKIOCHrWTPNvWw/bqcU6:nONu6e1M88LCb/fU6
TLSH
T10C120C36ACA56C6F5EA2A541F4C632075EA94177F7846F40E6EC7B1C01EF69C230781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d433fb72-8211-41d9-b53d-0d074d87466f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d433fb72-8211-41d9-b53d-0d074d87466f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ed4732a0766badd39a77f7f7afc19b71b0f8cd5972f9f676ddd60e3f9e6e8f9a
MD5 db0f2c0f1d88302cb603fb77630641ed
SHA1 33db9030e34eefb65f30ac32f32967202d1a4b2e
SHA512 7809017afe1c4548c75bf343788d8980d6e59e25d288e647305b6e2f06c653419da16e7ef1c5b89aa90f7af621c869d61b1563364b7c780f91ab6f470aa3c5fe
TLSH
T147412B5DBAF9114873776E4A9BF3695D847FB8332E06D44D10120E4F4A63B40C8A1B37
MD5 SHA1 SHA512 TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads