hxxps://wolemaaro[.]store/app[.]json

Analysis

user interaction
yes
max time kernel
149s
max time network
136s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/07/2026, 17:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://wolemaaro.store/app.json
Sample260713-vnwewset8v

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
968	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134284361793754264"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{214E621F-FEB6-4521-A1F2-288E0F52E13C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
696	msedge.exe
696	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 4304 wrote to memory of 1736	4304	msedge.exe	84
PID 4304 wrote to memory of 968	4304	msedge.exe	85
PID 4304 wrote to memory of 4120	4304	msedge.exe	86
PID 4304 wrote to memory of 4120	4304	msedge.exe	86
PID 4304 wrote to memory of 4120	4304	msedge.exe	86
PID 4304 wrote to memory of 2656	4304	msedge.exe	87
PID 4304 wrote to memory of 2656	4304	msedge.exe	87
PID 4304 wrote to memory of 3880	4304	msedge.exe	89
PID 4304 wrote to memory of 3880	4304	msedge.exe	89
PID 4304 wrote to memory of 2504	4304	msedge.exe	90
PID 4304 wrote to memory of 3880	4304	msedge.exe	89
PID 4304 wrote to memory of 2504	4304	msedge.exe	90
PID 4304 wrote to memory of 2504	4304	msedge.exe	90
PID 4304 wrote to memory of 3692	4304	msedge.exe	91
PID 4304 wrote to memory of 3692	4304	msedge.exe	91
PID 4304 wrote to memory of 3692	4304	msedge.exe	91
PID 4304 wrote to memory of 4900	4304	msedge.exe	92
PID 4304 wrote to memory of 4900	4304	msedge.exe	92
PID 4304 wrote to memory of 4900	4304	msedge.exe	92
PID 4304 wrote to memory of 4508	4304	msedge.exe	94
PID 4304 wrote to memory of 4508	4304	msedge.exe	94
PID 4304 wrote to memory of 4508	4304	msedge.exe	94
PID 4304 wrote to memory of 3316	4304	msedge.exe	97
PID 4304 wrote to memory of 3316	4304	msedge.exe	97
PID 4304 wrote to memory of 3316	4304	msedge.exe	97
PID 4304 wrote to memory of 2876	4304	msedge.exe	98
PID 4304 wrote to memory of 3036	4304	msedge.exe	99
PID 4304 wrote to memory of 2876	4304	msedge.exe	98
PID 4304 wrote to memory of 3036	4304	msedge.exe	99
PID 4304 wrote to memory of 3740	4304	msedge.exe	101
PID 4304 wrote to memory of 4104	4304	msedge.exe	104
PID 4304 wrote to memory of 4104	4304	msedge.exe	104
PID 4304 wrote to memory of 4104	4304	msedge.exe	104
PID 4304 wrote to memory of 4476	4304	msedge.exe	105
PID 4304 wrote to memory of 4476	4304	msedge.exe	105
PID 4304 wrote to memory of 4476	4304	msedge.exe	105
PID 4304 wrote to memory of 2364	4304	msedge.exe	106
PID 4304 wrote to memory of 2364	4304	msedge.exe	106
PID 4304 wrote to memory of 2364	4304	msedge.exe	106
PID 4304 wrote to memory of 4544	4304	msedge.exe	110
PID 4304 wrote to memory of 4876	4304	msedge.exe	111
PID 4304 wrote to memory of 772	4304	msedge.exe	112
PID 4304 wrote to memory of 3528	4304	msedge.exe	117
PID 4304 wrote to memory of 3528	4304	msedge.exe	117
PID 4304 wrote to memory of 3528	4304	msedge.exe	117
PID 4304 wrote to memory of 4180	4304	msedge.exe	121
PID 4304 wrote to memory of 4180	4304	msedge.exe	121
PID 4304 wrote to memory of 1992	4304	msedge.exe	124
PID 4304 wrote to memory of 1992	4304	msedge.exe	124
PID 4304 wrote to memory of 1992	4304	msedge.exe	124
PID 4304 wrote to memory of 696	4304	msedge.exe	125

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://wolemaaro.store/app.json
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffe392dc188,0x7ffe392dc194,0x7ffe392dc1a0
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1764,i,13797602173403067772,6403659667685255308,524288 --field-trial-handle=2288,i,15511471623231239288,8546547394082521422,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:3
  2⤵
  - System Time Discovery
  PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,6979864159375749646,6181918496561359740,262144 --field-trial-handle=2288,i,15511471623231239288,8546547394082521422,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:2
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2460,i,8555771955552280986,6014430123779630639,524288 --field-trial-handle=2288,i,15511471623231239288,8546547394082521422,262144 --variations-seed-version --mojo-platform-channel-handle=2800 /prefetch:8
  2⤵
  PID:2656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,17889793534548727950,11079482206384897567,2097152 --field-trial-handle=2288,i,15511471623231239288,8546547394082521422,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:3880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,17690573592171974259,13893801964410106264,2097152 --field-trial-handle=2288,i,15511471623231239288,8546547394082521422,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4172,i,17343047467708250684,17580638447756034996,2097152 --field-trial-handle=2288,i,15511471623231239288,8546547394082521422,262144 --variations-seed-version --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4184,i,12953944382929978372,12403827161632498185,2097152 --field-trial-handle=2288,i,15511471623231239288,8546547394082521422,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:2
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3604,i,12827809482686831469,13975829340124906416,2097152 --field-trial-handle=2288,i,15511471623231239288,8546547394082521422,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3524,i,15954727827115235563,10726334465016519661,2097152 --field-trial-handle=2288,i,15511471623231239288,8546547394082521422,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5296,i,2523627896915707957,74073878412151160,524288 --field-trial-handle=2288,i,15511471623231239288,8546547394082521422,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:8
  2⤵
  PID:2876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5300,i,2719493948942246630,14652932445714056776,524288 --field-trial-handle=2288,i,15511471623231239288,8546547394082521422,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:8
  2⤵
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,3870397009624156905,1869782875987210291,524288 --field-trial-handle=2288,i,15511471623231239288,8546547394082521422,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:8
  2⤵
  PID:1740
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6040,i,3870397009624156905,1869782875987210291,524288 --field-trial-handle=2288,i,15511471623231239288,8546547394082521422,262144 --variations-seed-version --mojo-platform-channel-handle=6052 /prefetch:8
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6308,i,1213325385133106274,9660302623582133731,2097152 --field-trial-handle=2288,i,15511471623231239288,8546547394082521422,262144 --variations-seed-version --mojo-platform-channel-handle=6368 /prefetch:1
  2⤵
  PID:4104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=3532,i,5968392764294510907,15217958300275364346,2097152 --field-trial-handle=2288,i,15511471623231239288,8546547394082521422,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:1
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6348,i,16867719292226323532,17117556318386774023,2097152 --field-trial-handle=2288,i,15511471623231239288,8546547394082521422,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:1
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4600,i,10501000632069720350,3811251586147829903,524288 --field-trial-handle=2288,i,15511471623231239288,8546547394082521422,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:8
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4240,i,13557951520091631784,7588095196769088132,524288 --field-trial-handle=2288,i,15511471623231239288,8546547394082521422,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:8
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4168,i,16373555067822311639,17650110394416784497,524288 --field-trial-handle=2288,i,15511471623231239288,8546547394082521422,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:8
  2⤵
  PID:772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5340,i,2349254735889785368,4799088727614446955,2097152 --field-trial-handle=2288,i,15511471623231239288,8546547394082521422,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:1
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2752,i,17872800753034265367,3607819582754407013,524288 --field-trial-handle=2288,i,15511471623231239288,8546547394082521422,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:8
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5976,i,2997803308480279791,4542901244254237718,2097152 --field-trial-handle=2288,i,15511471623231239288,8546547394082521422,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:1
  2⤵
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6364,i,2285988121275575904,14438555901801260832,262144 --field-trial-handle=2288,i,15511471623231239288,8546547394082521422,262144 --variations-seed-version --mojo-platform-channel-handle=5380 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:696

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4128

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 994380ffd288a5f1a9acc9eb76a487a55b12cc1daec839d811240f6cbdc4da3a
MD5 f5ed4946834be586ac6410ed88740a7c
SHA1 6108ce368e8b3bb8012956bb25606c3b16835c7b
SHA512 76bf60b37c50422ab125edd3da70629e685408a106655a9b7e5cb6aa7b6a9000c76d8ac2f5dc85e58e893b61bef9b539b9488ac894f1fc1338a58944dc9f4711
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P77:fwUQC5VwBIiElEd2K57P77
TLSH
T1E5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6d0f88884e23b1418c456620b79662feebdfd970ca9325ba2981c94b3b0f0b2f
MD5 7060eae8ec426d15de2849b1f7d261b4
SHA1 b252d90b9d7050d0b9b7c03141d9d3b7cae404ac
SHA512 8791005fae20dc1dc5dc5b0086efe814e0b1e36781ef1931cc1fc699fc4cb34d62ab3f9a83f4967824f3bb71aef6adc6ad457ab7a6addcba99f9e9b473eabb4d
TLSH
T118D01222BE08A415E65BA271A502C7141F5954A124938651E224D86CD9F84D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4d517b88a0fb88494276c126764235de9ee52961c86cc4d3abaf517b10a649a8
MD5 dde9ea8dd9c7e315ef614ab3476af02c
SHA1 e03e201e89770d15b4040d579c2cce8684959a2c
SHA512 410e016336529d709de957d44e67238e4f6592b9ce6646395a9e45ce592e7810b4cb6b1b6df5d8b26875a6aa235b77d41c0983ccc055556f8b8c02224093fdd1
TLSH
T16DD012227E08A415E65BA271A502C7141F5954A124938651E224D86CC9F94D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 de785bcf44611a96dae9e6f5e4e66996b2ebe4cafddaf2e5f739cf292b63cd3d
MD5 235ac08d173d1749c1d8496c2f17faa3
SHA1 2bc8ee7771aa8f97768cdd3799cc373288b2c3b8
SHA512 9ac6f99fca3bccf99b2f00925cb311abe0182a28e9652b815546f5e6ba44df98ca3902b4bbca6e2e4220b9a763cea6f97c66abb50c7886254c5c4e031432197a
TLSH
T15081E6B4810B35A9EB0C4F3190DA0D5A32306AE9FDFF3FAF5D8424B98778355052B469
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe587088.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe587088.TMP
Size 3KB
SHA256 8a5d00fe2cd6411e198f4044ab58239cef983122ab38dbf9d7b2e99d30bb03b7
MD5 40ddf8349fa5e4a9cee044eb0a549d13
SHA1 47113196b66f72149f82107055c3d7c323f1a29e
SHA512 d85ed34f9cfc3df8e5a2abf0130046a046c6707498480d18edf2c3be2894f8e5b21cf865df7b078153edbc6c6397147ad7a54999829090b01df5737f3ac988ec
TLSH
T1B681C6B4820B35A9EB0C4F3190DA0D5A36306AE9FDFF3FAF5D8424B98779355052B468
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

HubApps

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\HubApps
Size 106KB
SHA256 eb2fd7422436fff93f6be09df3294b26cdb7afd18e6aa94dcdc0f208db78b2ed
MD5 25dca813dd764f2197142ef84bc5ce66
SHA1 8d6aefb01ee9f6d1fb0cfd89326cfe35af53a53d
SHA512 a9c8cd547c874b7b69cbb3a0c8214f43837911e522db768dcd075d23d05acfd7122cf2bcad281ea745025e4fb67cc9061b79f9dc1288ac1a113bd0d961841d43
SSDEEP 1536:IfEEtnH74ohBGZqW3iPPDuVvpBI/SvtZsA62UYPq:BuHSRhPjU1
TLSH
T154B35226D6A54C6B01F16264EC794382F325436F9282A82F3B7C5D5C2FBD93A6502F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 dafec460854bc3179c48603738d027d067ebb656190db1290b8635b251dbb7b4
MD5 6bd5b6193ecf91660d9954ebb8faaa65
SHA1 59b7365d9bea44988e31f7bbdb274a69c0b62849
SHA512 71a58e3f6ab47c62059caba4aee9b9b93a78e6f385141718e3867a8dd42eee4e58ee57cb788d7181008845e24957dd927d5094b98bbee5c08553876f7228488a
TLSH
T125117AF3C3E5856E890557F06A28AE2BCE2D0606432C7C198AD4EF2BD7E7075E00265F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 9d401380fada19f7cc8a2d02f17e066e5c57e4d6510a1ba937cd68dd1bad3b10
MD5 00bbe8060eefd512438ef42edadea736
SHA1 884036367cadbe5072e478077562537966d5c8f2
SHA512 c2e17d3fb7fb39b04f8aa1b5e893ace3593dd655c2a558d97e27a07d10cc116aeb083e48ffddae8818daf709fa9c4f961630da9f3ff46d1a91f714f3d6a386fd
SSDEEP 192:sxZ8RfyM/jK1Ml8Mk1/fvsv92BVXIdpZiHW6+WNufob0/YvSI4jxoqIgrJ:sxZ8rM1/fvsV20MHbac0/Ldmq9
TLSH
T12E42E9126B34997BCCCBD20DFA55BF53D6F51572A2900E44AAFCCA0C05E6AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 6f1649d7a13b5a3f75ed8fdc0ce302cba124e7c38340bc030e3faf01c74b6af8
MD5 2dc27dfec899bb8e74c54e6c0d520c87
SHA1 eec56c9eb92cf04f9bc3d7c0d70829ce1c62c3a2
SHA512 8d52eee6e2377b6173a15f8b9948a11af6156a101bfbfc8957b57ebe994fb93ecba4edf462a017c85d433860e70ce3c586e255369e02c46cbac3d3911d713dde
SSDEEP 192:sxZ8RfyM/jK1Ml8Mk1/fvsOb92BVXIdpZwHW6+WNufob0/YvSI4jxoqIg5ZJ:sxZ8lM1/fvsOB206Hbac0/Ldmqp
TLSH
T14952E912AA349A7BCCCBD20DFA55BF53D6F5157292901E44AAFCCA0C05E6BDD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 1f52d31f464149d757a99e086f0bba476039328744f2942f236f9b9d247940bc
MD5 dd81051381b9bd16d864437f1c3d053c
SHA1 6dda7f1d779430ef30f982ec251cd19fd280abde
SHA512 79b6b30710968795ab2bb5ad0b30919ac94e70086fd043a83ff1b6189b566121b2d982aadf8f8ae9f84d3d916d4dac74bdb557089291e8e3521b65d7ea078219
SSDEEP 192:sxZ8RfyM/jK1Ml8UQpk1/fvsOb9DBVXIdpvwHW6+WNufob0/YvS0vjxoqIg5DJ:sxZ8lqq1/fvsOBD04Hbac0/LGmq/
TLSH
T13452E812AA349A77CCCBD20DFA51BF93D6F5157292901E44AAFCCA0C05F6ADD221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 5dc3a7f38f44be69bef14bc9e7ec713542430feee70c9a5ab67af6d1ccff32ef
MD5 a766cf6a5e73bafb3505a882ec6eb5d6
SHA1 f054c40a3918e07d06d09802c38403d5dec05800
SHA512 4ad51f7b7125f815734b9a1a9bbb10e165f2b71e5d9b7b6b50778d91976f71cdf75c6640d5e772258e904aafb48d07425cac085385bf0171e94e549ecb98ee3d
SSDEEP 768:lNseJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0ppuroyU:lNseJ3xWvhfynu1jaVcL88pl9
TLSH
T13FD20B2B280CCB7E4F844E6DEC266F966EE801CB57984D5487EA884C03C77EB51275DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 73e041ecfca6b96b0f398d7a05c46302835a9a0b0d5d450f584af2ffe2a5819e
MD5 0078628750cbea1c99a534ef82e25140
SHA1 29ee154aa2e03d89123cf0ee97737b0602e74f4b
SHA512 301a0b41be1cfd3192b3a45368c7ecadde366a581abcb56919624a7ac5c2bc20b8607fc97359106ae3db8980545bda08ad2703f4f1bd3382cf082f75b10d702a
SSDEEP 24:KdxwLfxwyxwRxwIaxwNdxwBxwhxwx4xwlxwB+xwsIjxwdxwxKixwOhaxwzxwx1EV:KYHIhKggkXyFjIBKEYcXyBuIXKTag7
TLSH
T11891F457753F0212387D254CA6A2A9369E4271A37454A4FFBBB844624F27E220EFCCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe590c79.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe590c79.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 70d46dea19f4fe56c6f180bd8b3e6475847decdc98d06fab7b0f0a256347166b
MD5 61ea852620320b5df432486f79d1a2b4
SHA1 02223962b7788dba653050ab484d3c46779cfca5
SHA512 a41eb30aa353ddf0d788825aac946cda8f1da4d4a898c07896a918e51ab47caf08b727a51cad643dd91457fd8e4567f93677b55e0e43cd17b57542c8f958cc89
SSDEEP 192:uiTSNWMsnMcPPQLz3XX9VofsNV8QneM7X57QmiU1SZZB4MThcC5KopD8z1CqPVjx:7tNn/s3n9SfsNV8i7JtkZuI5KGAPVjx
TLSH
T10A625B726C799D3B9DA3A184F54A33075FF4916B92C02F54EADC6F1D01EB2AC1307A1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 17KB
SHA256 2c8a2cfe04e28bec5ee77f54957158c5921a26abe5cef44171d49ae89ef36b2e
MD5 227bdef4b67ca0af9a9370c531dc17fe
SHA1 536fb047d44e5b245ac167b84ddaf92a02a35815
SHA512 39a8e0fbbd4b8fe9015a799a6f7f18b4a2950b83dcd91e00fff5ac1259b6a29cd4b08f8c487db5d94b347e0b8006d0a35b9305e554765cf5ef07b92d03be3a51
SSDEEP 384:DiF1tNn/s3n9SzzsNv8TUNTUlIlHi7JtkZuI5KGaPVjx:uF1j+90qwgwwXlatjx
TLSH
T11E823A735C688E3BAEB79A84F94A33078FF441A796C1AA54E7DC6E0D01EB1AC1307D15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 43bb714e84007df11185275eed6bc013e90ea86305f7fe0236117d851a98a159
MD5 1751c76aae205c2b7997526f6e0f8ff7
SHA1 2537360a8dc1f13545b0fddfbf4c4c40a6c90223
SHA512 cd2f956bfd1b0767649386d197a0efa77475eaa7f692c10d564939c91e52e2052326f48bcba717b8ffb52918cd467e96466408903173717391873941fe71bc30
SSDEEP 192:lONny6vMtPQmiUyj4ThThcC5KZ847ktU/u:lONny6UtRHTD5Kh8U/u
TLSH
T10802F876BC785C7BEEA3AD46F48E27171FE4516FA5905B40EAE82F1C00D765C2307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 cf0d146a4fc76496a7020d5890a4bcecd4b5740227f097fa9743ce00fcc9edc8
MD5 6acc91b813cc0324e9bb15a12807999d
SHA1 8694c1784b44591e2fa1aff690d467019c08066b
SHA512 1ddee77520fc371a7d74ab40404bc15f1f8245e73cfc8b5a41e580bfcc3734bd6d2b48bd3f30181413ab7f6356a69962021d27eba6765422a82fbd2dbeacaf1a
SSDEEP 192:usTSNWMsnMcPPQLz3XX9VofsNVHQneM7X57QmiU1SZZB4MThcC5KopD8z1CqPVjx:xtNn/s3n9SfsNVHi7JtkZuI5KGAPVjx
TLSH
T1E1625C726C799D3B9DA3A184F54A33075FF4916B92C02F54EADC6F1D01EB2AC1307A1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 7ea581d2ea30f5a479dc00762930a2ccb6650bfd24c8bf5e6b23f759bc2a1b03
MD5 7d41509266d84535abbf7b2b9083343d
SHA1 afee3046f2d97fc3ce8f2d5bbff2a65424b31250
SHA512 66aef29dd7d567c49fd154764ed3465d4a8a3185695fa7e8422c342c444956f5e594a1b7433dc42112642fb62d725b056cabb8ea5380c926f6d7838ceaaf708c
SSDEEP 192:6ONY6vMTPQmiUyl4EhThcC5KopG80ICqPVU/u:6ONY6UTR/ED5KGfPVU/u
TLSH
T14D121C72BC649C6B9DA3B081F48A32071FB4916BE6C4AB50EADC3F1C01EB56C1307916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 f4d90212678b67f1a90e826becc85418791fcd524d784da1a88f1c6c7b898091
MD5 59c28d72be945176ce3b049c282e7cc6
SHA1 ba9323371132ec96a05f3735e9b2ce22cbd6dc70
SHA512 6f3d5d63046ef3bd3c8b36e490d1e54e7417c207c33f9200a902296685da97ebe4147544bc34c9fad92bab34dacd21a0ebad73ac2b041acb3b30abb097f812ca
TLSH
T1E6412858BAF91158B7B76F5AAFF2A86D447FB8372E06C49E00110D4E0632A41C872B37
MD5 SHA1 SHA512 TLSH

Submit Download