caa9472c344d8ce4cbf1a76f0e5986ba36ef7d0a5b4d11f3059a24a30fb7e0b9

Analysis

max time kernel
898s
max time network
752s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/07/2026, 17:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 3KB
Sample260716-vs238sdy2x
SHA256 caa9472c344d8ce4cbf1a76f0e5986ba36ef7d0a5b4d11f3059a24a30fb7e0b9
MD5 7c7590bf7b1f1befdf2fff7cfaacce66
SHA1 64adac17a20903064b5bd99f26ac0530230165ee
SHA512 b2f732a1cd0d280ba01ee4de83b7e89be8ab868c00810574f27b58ea661610c921122429d852e5a0fa60cee86b7cdca088f6154022964b2646699c743ff33a26
TLSH
T1B67164478DA0C479136B51A9499BB244BF259943E368EC11778C105F2FC1AE9D6F73C8
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4860	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134286957732575815"	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-552508041-2681165170-3229858294-1000\{4BE5C538-9DB9-4F5A-9248-FE5B86FB6E4F}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-552508041-2681165170-3229858294-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1444	msedge.exe
1444	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe
3144	msedge.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 3144 wrote to memory of 2504	3144	msedge.exe	87
PID 3144 wrote to memory of 4860	3144	msedge.exe	88
PID 3144 wrote to memory of 4512	3144	msedge.exe	89
PID 3144 wrote to memory of 4512	3144	msedge.exe	89
PID 3144 wrote to memory of 4512	3144	msedge.exe	89
PID 3144 wrote to memory of 4276	3144	msedge.exe	90
PID 3144 wrote to memory of 4276	3144	msedge.exe	90
PID 3144 wrote to memory of 2744	3144	msedge.exe	92
PID 3144 wrote to memory of 2744	3144	msedge.exe	92
PID 3144 wrote to memory of 2744	3144	msedge.exe	92
PID 3144 wrote to memory of 2636	3144	msedge.exe	93
PID 3144 wrote to memory of 2636	3144	msedge.exe	93
PID 3144 wrote to memory of 2636	3144	msedge.exe	93
PID 3144 wrote to memory of 5032	3144	msedge.exe	94
PID 3144 wrote to memory of 5032	3144	msedge.exe	94
PID 3144 wrote to memory of 5032	3144	msedge.exe	94
PID 3144 wrote to memory of 3400	3144	msedge.exe	95
PID 3144 wrote to memory of 3400	3144	msedge.exe	95
PID 3144 wrote to memory of 3400	3144	msedge.exe	95
PID 3144 wrote to memory of 4296	3144	msedge.exe	97
PID 3144 wrote to memory of 4248	3144	msedge.exe	98
PID 3144 wrote to memory of 4296	3144	msedge.exe	97
PID 3144 wrote to memory of 4248	3144	msedge.exe	98
PID 3144 wrote to memory of 4668	3144	msedge.exe	100
PID 3144 wrote to memory of 2052	3144	msedge.exe	104
PID 3144 wrote to memory of 964	3144	msedge.exe	105
PID 3144 wrote to memory of 4140	3144	msedge.exe	106
PID 3144 wrote to memory of 2092	3144	msedge.exe	107
PID 3144 wrote to memory of 2092	3144	msedge.exe	107
PID 3144 wrote to memory of 1444	3144	msedge.exe	109
PID 3144 wrote to memory of 5024	3144	msedge.exe	110
PID 3144 wrote to memory of 5024	3144	msedge.exe	110
PID 3144 wrote to memory of 1840	3144	msedge.exe	111
PID 3144 wrote to memory of 1840	3144	msedge.exe	111
PID 3144 wrote to memory of 4288	3144	msedge.exe	112
PID 3144 wrote to memory of 4288	3144	msedge.exe	112
PID 3144 wrote to memory of 5224	3144	msedge.exe	113
PID 3144 wrote to memory of 5224	3144	msedge.exe	113
PID 3144 wrote to memory of 2260	3144	msedge.exe	121
PID 3144 wrote to memory of 2260	3144	msedge.exe	121

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffd6c40c188,0x7ffd6c40c194,0x7ffd6c40c1a0
  2⤵
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1884,i,5931205838130674668,9345118593857297654,524288 --field-trial-handle=2636,i,16285077750764266933,6709418466263239477,262144 --variations-seed-version --mojo-platform-channel-handle=2692 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,14938423189103502425,2242829928286917806,262144 --field-trial-handle=2636,i,16285077750764266933,6709418466263239477,262144 --variations-seed-version --mojo-platform-channel-handle=2632 /prefetch:2
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2236,i,9607544060893422214,9658160953940164380,524288 --field-trial-handle=2636,i,16285077750764266933,6709418466263239477,262144 --variations-seed-version --mojo-platform-channel-handle=2660 /prefetch:13
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3572,i,16344075803154911449,7418446841079934548,2097152 --field-trial-handle=2636,i,16285077750764266933,6709418466263239477,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
  2⤵
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3576,i,12496762239637014195,10649329688266647347,2097152 --field-trial-handle=2636,i,16285077750764266933,6709418466263239477,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:1
  2⤵
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4408,i,11732262481701634692,12852430327321227690,2097152 --field-trial-handle=2636,i,16285077750764266933,6709418466263239477,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4424,i,14143185221145630474,10365885450220836675,2097152 --field-trial-handle=2636,i,16285077750764266933,6709418466263239477,262144 --variations-seed-version --mojo-platform-channel-handle=4812 /prefetch:9
  2⤵
  PID:3400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3768,i,3163894589805468330,2137868454856256593,524288 --field-trial-handle=2636,i,16285077750764266933,6709418466263239477,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:14
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3756,i,15013391573759191722,5688328587010763805,524288 --field-trial-handle=2636,i,16285077750764266933,6709418466263239477,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:14
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,562613912965934475,11577466845392868066,524288 --field-trial-handle=2636,i,16285077750764266933,6709418466263239477,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:14
  2⤵
  PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,562613912965934475,11577466845392868066,524288 --field-trial-handle=2636,i,16285077750764266933,6709418466263239477,262144 --variations-seed-version --mojo-platform-channel-handle=5940 /prefetch:14
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6548,i,8172642266748224599,14373800486883954910,524288 --field-trial-handle=2636,i,16285077750764266933,6709418466263239477,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:14
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4844,i,10994443061322404836,3904472481007595564,524288 --field-trial-handle=2636,i,16285077750764266933,6709418466263239477,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:14
  2⤵
  PID:964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5044,i,721677042118240597,9928802816288455754,524288 --field-trial-handle=2636,i,16285077750764266933,6709418466263239477,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:14
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,12116791580710036491,9305095063561752745,524288 --field-trial-handle=2636,i,16285077750764266933,6709418466263239477,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:14
  2⤵
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=808,i,13801176329597675207,2127219386551826044,262144 --field-trial-handle=2636,i,16285077750764266933,6709418466263239477,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4140,i,8162778337140389610,7345742744132911846,524288 --field-trial-handle=2636,i,16285077750764266933,6709418466263239477,262144 --variations-seed-version --mojo-platform-channel-handle=3760 /prefetch:14
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6084,i,16809748788773023368,11903491749903544535,524288 --field-trial-handle=2636,i,16285077750764266933,6709418466263239477,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:14
  2⤵
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6728,i,9959067747580942174,16865393863373888892,524288 --field-trial-handle=2636,i,16285077750764266933,6709418466263239477,262144 --variations-seed-version --mojo-platform-channel-handle=1108 /prefetch:14
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,9405031481101421248,4932390195434714905,524288 --field-trial-handle=2636,i,16285077750764266933,6709418466263239477,262144 --variations-seed-version --mojo-platform-channel-handle=1104 /prefetch:14
  2⤵
  PID:5224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4868,i,746773526058920304,284807503347004548,524288 --field-trial-handle=2636,i,16285077750764266933,6709418466263239477,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:14
  2⤵
  PID:2260

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1852

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2904

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5752

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:1352

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f8dff5315a0bd3856381f405c1a16257337fd6ff2d8043dd8bea22404cd35129
MD5 5e53a2cd139f0cce4f8ceab3e015f7da
SHA1 1bd884dbaaa352a724c53bfb8f4bfad2623c93f5
SHA512 27cc4cb62f9aa4af6b521efd824b001f3b689bae2ffe57263da18e2bb22d0b13ba656141d7e6ea1d1c202d5f461a44243a00d604f78bd5b04fe6b8512e260ac1
TLSH
T178D02B1463108D04D441F13214D13311B1110833A80C96440050E1284CB634206738DD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1f3bc43c50f7d0fa02f98500baf5d78052a5560603459a9325b17de989d121f4
MD5 46a6445fd2c83830bb8c6e03f85bafc0
SHA1 46b07e35efbd47692fdc81ef0e82e2964da2831b
SHA512 800f82b05756fd6fab3fe29924147f0b86afeec21da661e646b431c6ca03903eb45bb09803f5cdaf3d2d1bb16f95d0f2e53a1f9ddde57505b0f3e1580c384ed1
TLSH
T188D02B1063208C04D441F13214D23311B1010833540C96440150E1384CB634206728CD
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 334B
SHA256 5849630bd5dd888bcd7055fcaa7bb8922dff41a5270d4f911ad330a2df9714f3
MD5 ebe562ca1399423e9438a00707414dfc
SHA1 758086bad275daf1e4788b7160de5eff8cf044f0
SHA512 4c4de95e3fc3f614acba31ab4bafc983bbb5edb7a9fea78f168b41441ea84d745fa64cb31e4740959f2ef74323f344a9e4be2c6bd65a9998895efd30bcd2aab4
TLSH
T135E07DC88CC8C22EA696A8CB4179575C8280368BE3C87F0A771098E87445240B7C2790
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 897ce83301bd9bf5b01e4ff6bfc1b878a72ac770a7a46ed84aa4adc430477f5c
MD5 4642cf74e9126d8abd8748dd6ccda6ff
SHA1 305972b3f490a8b1d0bae44e58bf681c5b36c020
SHA512 2f8bc140c3086c68d505440f93be92cc0c064439e54648e1d9ab6f36f2c2ebf7f37967527899921ec747a1293e3a7e3c11626b5f8f5c7f0e31fe415422bfdec9
TLSH
T135E026A40AC8CABEB68674874268930CC290364AA3CCBB0A5708C9DA7485050B3927A6
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 9810b72b190462ffac2711fc0c9aeb57a71b1cc3a5d4c5c4c21ed033dd380df1
MD5 798f3f50aa10127a235af438f4a3addf
SHA1 e5d48a13c5c9451b1630bbe7b652b349d43c57cf
SHA512 5bb8f44c955a97a80d6daa816c06191436f15daa0bb88dfde321830114cf19119484e7d697976e2f79a3907b0d025712cbf4d6cd2bb3b74fcf2e68149c164a14
TLSH
T153E026C854CCC2BEA640B447426C534CC2A0364FE3C87A8B5B1889CD7485040F7827A0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 720489981ada7c7e366b48e9c59f9c525eb001bb5bc6b987f37f1a35241c3731
MD5 f20d240cfeab200d4404a7799f298dee
SHA1 5063d8961801c1b55044cec5f31722cf7a6f6366
SHA512 bd5c08746e18011c9f0fd4bc8c7df4757883e5736eea9e7cccce30d9b2105aa2ce8fd370da5a682a0dcc12f2ae2119e52aec2a240523d254bb6f104145e5b3c4
TLSH
T1D7514D07333267ADCBA155B250E8B8D636F2B56B407B5F2088102EBE0966F38D4DD9D3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe594443.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe594443.TMP
Size 2KB
SHA256 579b54cd2bdf2fbf0715b43b969bbeb09ee09110a239487a5000b00c97f6e801
MD5 3a141eeae4d9bcbf29b3b4e78cb31055
SHA1 da169280d263d914b0c07cb3cb9229e79f172fac
SHA512 ac99f6e88e9ed35091225044d7dada08cf694b2da3bfb9fe4b020c7f3dc50b7d49c3a933397296cb2910a60221fb4732b0f996546afd5c2ea721e723f86cfd25
TLSH
T1A9512F07333267ADDBA155B250E8B8D636F2B56B40775F2088102D7E0966F38D4DD9D3
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

762c6849-391a-49a7-94cf-942c60d96b2a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\762c6849-391a-49a7-94cf-942c60d96b2a.tmp
Size 2KB
SHA256 bedf3543e37198c905008a4a60d8941a2186f848462ed12ddb71cfe72a419a7e
MD5 c2e3e0dfd8d1ba4f48a2efe3e7f16103
SHA1 f81257e292f2ddf34df4341ecd7238f1fcaac30d
SHA512 0205fafa709e39e5de3df65134081213c31cedc45e288bcc8d4249dc7ecd6bf62f2066bf243c663b083bd3ce17111bcf85272e63095eb915863d0e67f0307033
TLSH
T10241BEF3C7E8893E890156F0AB147E2BCE1D0915432C3D5AC9E4AF1BA7E2471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 4807d521bc57442b11fc9becdbf166d15fe82f13340d4c40455eadccbf7f527e
MD5 d73dc3f13a4e5e673b0df3527f816d1a
SHA1 7698833098b2c8470dd94bc79e0cba490317a36b
SHA512 2e001e3fa8aecbe923e45d80fde6c7722d6b5a8dddff1585ef0c33eb475d8803a01ec3698a48ecc65e219aabe5b9fea8672d25c1518ff7cf3e6e29a2f5827df2
TLSH
T10C41CFF3C7E4866D890156F0AB147E2BDE1D0915432C3D5AC9E4AF2BA3E3471D141A9F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 a72e134ce9b6ddb820e3c4cef77385188200a32066108b9ba7f32265b78be658
MD5 fdff6b723f8653e6c5c606bebe2eeebd
SHA1 06e2832ccadcbce87a1d6ee9598b398a9a98c7d4
SHA512 9f6dfec5f80581bb41739ae40ff63e1ffd554cde0d549fda7b454cf950bde628f78e7ce79f86c62f288132a6f4486ae9e17ad8d544c14cd69f9c7515c2edacbb
SSDEEP 192:sxR3R5ba1/fWsxRRDde5lS4KzoD8p4u/g6+WNIYCyuOqGaIgIJ:sxR3ra1/fWsxRRc5lb2P/5IQ4s
TLSH
T1FE32B7166A289D3B9CC7E21DBA557F93D2F95032A1D02E58A7FC860C54EA6DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 443851a4decef4cd3e011f2b251b5bb7ac358479b524dcf5aef1e78fe423dd7a
MD5 b7eb9f834c5bf020545a952683e75a30
SHA1 fd82839c0b1b7164d3a6dd5e567315829c249def
SHA512 4c89bc847e265755a9b6ebb130fc0df14e97f41ba2547c827a9dfadf7d23fc766d028d627fbebf20c127b6cb4d5d2e250f268473eccbe70bdc6dca1d60cadb98
SSDEEP 192:sxRUR5ba1/fWsdRVDde5lS4KzoD8p4u/g6+WNIYCruOqGaIgDmJ:sxRUra1/fWsdRVc5lb2P/5ID42
TLSH
T1C242C7169A289D3B9CCBE20DBB557F93D2F9503361D02E48A7FC870C14EA6DD220741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 091ef3ff0314136ec8cd7e89601912d3e99e28e4b2bb51f560ace2175dcfa03b
MD5 756ff81fd27749c935557faaf6015c09
SHA1 96e77ecf85b0bca962d6cbf0b1e791ebc017f0d9
SHA512 b628d8e52fe5f6ceb0c2d5defabdd3b3e38d679ee38e46900ddd2d3481dcc170c53b7a06572521ff8cd0d858c1b2be821ef1044c4eab17a5a46089187933a9cf
SSDEEP 192:sxRUR5ba1/fWsdRRDde5lS4KzoD8p4u/g6+WNIYCyuOqGaIgD0J:sxRUra1/fWsdRRc5lb2P/5IQ4M
TLSH
T1F932C716AA289D3B5CCBD21DBB557F93D6F95032A1D02E48A7FC860C54EA6DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 7613be54a0c0dc8dd9c0accdc20ae86efe137db6cd6b55b8c78d574552849262
MD5 42e0d6f5fea2237dafc786f68425eae6
SHA1 48bcc0bf1de43c9c076dc88193e90e3dc2889db6
SHA512 e700444c44591fea30e8cf9c0a11dee261c9b213cee37e3fc1c62b7b9705ab5f015782ab10c1c7f64f55718494da186a23d1e167eb106cce9d00912467fdbad4
SSDEEP 384:jjm+vhKfCtgQCFf4+KhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVmC9qyRv9roZS1:jC+vhQWgQ+f4+8F1+UoAYDCx9Tuqh0VY
TLSH
T19AB2EA2B600DCB7F5F800AADAC196FD76DA802CB97589D4047FED94C02C77EA92194DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c45185de-afc4-4384-a56c-169c50c12187\index-dir\the-real-index
Size 312B
SHA256 880ca9ff64d05a150642f528eb699b30b3420c415648b4daad637c8c45209fbf
MD5 e1014fed31082bff0effce2c39b771c7
SHA1 d075fb4bb7668b28ed19d6bb3681e26784711219
SHA512 a316e4ec98597b65ea3b9f065dbe3ed05553fbdd502163d0c258aaaa5151b0d8dbf5ab0aa57a2ab27c0f18163e0d581c47a93513936cec8639384cf29c8e3605
TLSH
T19FE0978EAC92A817C33A387A15B3201D333B05FE2002AF2BA0BE102D5954B2C8A45202
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d86a7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c45185de-afc4-4384-a56c-169c50c12187\index-dir\the-real-index~RFe5d86a7.TMP
Size 312B
SHA256 c13c2d7d38e0865d4dec162326352a266f6e3c19c855d24eb006ee4424f81dd6
MD5 a0daed61b7e83ce12cdcb0a07f76642a
SHA1 6198aa02f6c30396798a5a4a71afb3f9a356c195
SHA512 563eaa28bca9c0c363493663b457d6833dfdb3ce358c69203e8c5d8ac222e001bd0470a21441e1ee146af7db2dc6cb6c39eb8bb70597efae5118066134e47eb3
TLSH
T1B7E097CF50A16C72C726697A3003910A337F0C202111EA2A20EA082E052129C894120A
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 807dcb4bc171061be8acb98301ded2f5b7aef6418d500233580008226e5e88aa
MD5 9afd2e0f1c8060e75dc668a8fda4d036
SHA1 89478b54d70cc5b06d8b3b4a2a81be10ec21ba69
SHA512 bee8c2ce93a161f059731bdc1fef477f74e68f6cc19023dc1103b8bc3f32a16471ae579a8d50eb041a78691d6e87996bf501d7a5f87d3015d6e27ae83fc66010
TLSH
T170E068FB39E31C30FE6B97E6207104A801857848D905EC4F101AB2C310F1256349ACA2
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 bd9e99066e9d8da0e608c0cd074d97419cf836b7593a84e6bb8e5f2075587ed5
MD5 15c246b8c1f06da8adf3266bb2e7ccb7
SHA1 56fbbf2fcb9644da77c5bd9f548e9bb3885829e5
SHA512 efb3e83ec97eb0884e3a308271791537603e5cb2c49dcbcc062737f5b04c1a0c90d12a866a103a857fd1542c724c703aaa2517cf2143aa20ddbe4b195cb2963e
SSDEEP 768:0rv+4UNbd437AU5uVXp8+p3bd66j+4BRv86aLIWB2bwClP:0bsbe37QZ8+p3Z6n4yH0w6
TLSH
T11D13BF72E8A89D739CF6C644B1467A837FB8419396C00E94E5DD6B4E019A1AE630BC37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 98fe23300cd53a8cf94326c3394e3ced7b74e9bb66e3e9b92e9e3cb8ce680d2e
MD5 b0480ca667da9db34dc704a5bc84f1bb
SHA1 178e2407de7eab38367c85de28cb2abd5db4c0df
SHA512 394be4ad3653f77e5fc86736af6748e584a5b217ac1f0e44cacdb300a3b58e8ada6179a0be06852e51bfded5a6e08d67bffa3f0bcc312075fe5a414471ae5388
SSDEEP 768:Crv+4UNbd43kgU5uVep8+p3bd66j+4BRv86aLIWB2bwClP:Cbsbe3kwY8+p3Z6n4yH0w6
TLSH
T16113BF73F8A89D739CF6C644B1467A837FB8419396C00E94E5DD6B8E019A19E630BC37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 f6bb56f088c38a04b0498a764ba0deee6471f57e95303ec11328ff2ab3dff2e1
MD5 bdf30d026040f9489aa9d527129c8052
SHA1 0b91ceb05058fabea91feadbf1762a4c7cdcf12a
SHA512 11ba9c5814a3e6151c32bf33bd593d9b6c43190b5c5025a7dfb91f668cbda601691ce35e047e505ff2e4eec9ceb28b130e26a60747e906e531296b4153ec6a28
SSDEEP 768:jrv+4UNbdq38jgU5ubp8+p3bd66j+4BRv86aLIWBb9Mra:jbsbU3WA8+p3Z6n4yHb+ra
TLSH
T10F13CF32F8699E739CF2C654B18A3A437FB8519386C00E94E5DD7B4D469B0AD630B837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 bee6a0ac9e71f9db9da5b1b2ed6fca0ade993375fe8c6b1aef467a25802e9b4b
MD5 258a4be60fe020c515da3541e474ae09
SHA1 f50d976919e72985b6f813e4c64e939d973b0188
SHA512 2a17a29d1b39435ae71e275181d470791f13ee03ed01c35119c720ea06a2b1bf8e08bb2d3b38c0ef8f455202db9869e9fd51c32186d7528fb81976ba0d289f2e
SSDEEP 768:oj+9Q3hgU5u/p8+p3bd66j+4BRv86aLIWBb9Mre:39Q3hM8+p3Z6n4yHb+re
TLSH
T14CF2BF32EC999E739CE6C695B28A3643AFF445A386C01E94E4DD7B0D05C71AD930783B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 330fc6f109b743857f3bb42009411ba1a3bd439ea46768eebf46e0a93ade10e7
MD5 0d36302d2772853e85d9bf22478e12ff
SHA1 e7596ff090d94eaed95dda849dea41d398740539
SHA512 b3ae0215a68de50f64c26407fbb8461d30cc17d901a49fa7a1f2fe6b863e43c3ed12eebb00ddc388415538231647b2cf38b60fcea2ef670beb7efa51e5c62a47
SSDEEP 768:Irv+4UNbdD31c5VNp8+p3bd66j+4BRv86aLIii2bwCl1:Ibsbp30L8+p3Z6n4yE0ww
TLSH
T10903BE33E8A899739CF6C644B24677437FF851A396C10EC0E4DD2B4E419A19E630BC67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download