543c3006810d7b8fae05d69423fea05691b75441e16fa6f9350cec342bfa098d

Resubmissions

17/07/2026, 12:08

260717-pbbbasat4r7

17/07/2026, 12:05

260717-n9hbtses2x7

Analysis

user interaction
yes
max time kernel
244s
max time network
246s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/07/2026, 12:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
@logsred_bot+[23.html
Size 327KB
Sample260717-pbbbasat4r
SHA256 543c3006810d7b8fae05d69423fea05691b75441e16fa6f9350cec342bfa098d
MD5 489670da2818144bca685bb84b79dd39
SHA1 ee4993e303405fe30859d9a3963ad5b605443381
SHA512 bc050eac3a2f309e71764d43ccabd9a28e26222fcccae6084e378b6856da8c6bbaca9f4d64cc93ec27b31a267183eafe4eb8ec6956f75dace8549c5cb0eff13e
SSDEEP 3072:CYygAkHnjzxQ6KSAiTSH/88aW+LN7jxRLlzglK+f2EcR:8gAkHnjzxQBSA/f88CN7DB+f2EcR
TLSH
T10D643C26E5D2607F682B8033F27F3318B73FA483A101C965BA1CC5D5AFD19862177B99
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
392	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134287637383894891"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{7C9BE7C3-FC54-4983-AAE7-BAC991BE9A79}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5184	msedge.exe
5184	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 16 IoCs

pid	Process
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe

Suspicious use of FindShellTrayWindow 50 IoCs

pid	Process
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe
3436	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3436 wrote to memory of 4136	3436	msedge.exe	83
PID 3436 wrote to memory of 392	3436	msedge.exe	84
PID 3436 wrote to memory of 3296	3436	msedge.exe	85
PID 3436 wrote to memory of 3296	3436	msedge.exe	85
PID 3436 wrote to memory of 3296	3436	msedge.exe	85
PID 3436 wrote to memory of 3692	3436	msedge.exe	87
PID 3436 wrote to memory of 3692	3436	msedge.exe	87
PID 3436 wrote to memory of 1392	3436	msedge.exe	88
PID 3436 wrote to memory of 564	3436	msedge.exe	89
PID 3436 wrote to memory of 1392	3436	msedge.exe	88
PID 3436 wrote to memory of 1392	3436	msedge.exe	88
PID 3436 wrote to memory of 564	3436	msedge.exe	89
PID 3436 wrote to memory of 564	3436	msedge.exe	89
PID 3436 wrote to memory of 3312	3436	msedge.exe	90
PID 3436 wrote to memory of 1596	3436	msedge.exe	91
PID 3436 wrote to memory of 3312	3436	msedge.exe	90
PID 3436 wrote to memory of 3312	3436	msedge.exe	90
PID 3436 wrote to memory of 1596	3436	msedge.exe	91
PID 3436 wrote to memory of 1596	3436	msedge.exe	91
PID 3436 wrote to memory of 2264	3436	msedge.exe	98
PID 3436 wrote to memory of 2264	3436	msedge.exe	98
PID 3436 wrote to memory of 3820	3436	msedge.exe	97
PID 3436 wrote to memory of 3820	3436	msedge.exe	97
PID 3436 wrote to memory of 4476	3436	msedge.exe	101
PID 3436 wrote to memory of 5424	3436	msedge.exe	112
PID 3436 wrote to memory of 5424	3436	msedge.exe	112
PID 3436 wrote to memory of 5424	3436	msedge.exe	112
PID 3436 wrote to memory of 5436	3436	msedge.exe	113
PID 3436 wrote to memory of 5436	3436	msedge.exe	113
PID 3436 wrote to memory of 5436	3436	msedge.exe	113
PID 3436 wrote to memory of 5684	3436	msedge.exe	115
PID 3436 wrote to memory of 5692	3436	msedge.exe	116
PID 3436 wrote to memory of 5700	3436	msedge.exe	117
PID 3436 wrote to memory of 5848	3436	msedge.exe	118
PID 3436 wrote to memory of 5848	3436	msedge.exe	118
PID 3436 wrote to memory of 5848	3436	msedge.exe	118
PID 3436 wrote to memory of 5856	3436	msedge.exe	119
PID 3436 wrote to memory of 5856	3436	msedge.exe	119
PID 3436 wrote to memory of 5856	3436	msedge.exe	119
PID 3436 wrote to memory of 5980	3436	msedge.exe	120
PID 3436 wrote to memory of 5980	3436	msedge.exe	120
PID 3436 wrote to memory of 5988	3436	msedge.exe	121
PID 3436 wrote to memory of 5988	3436	msedge.exe	121
PID 3436 wrote to memory of 5988	3436	msedge.exe	121
PID 3436 wrote to memory of 6008	3436	msedge.exe	122
PID 3436 wrote to memory of 6008	3436	msedge.exe	122
PID 3436 wrote to memory of 6008	3436	msedge.exe	122
PID 3436 wrote to memory of 6092	3436	msedge.exe	123
PID 3436 wrote to memory of 2380	3436	msedge.exe	128
PID 3436 wrote to memory of 2380	3436	msedge.exe	128
PID 3436 wrote to memory of 2380	3436	msedge.exe	128
PID 3436 wrote to memory of 4192	3436	msedge.exe	129
PID 3436 wrote to memory of 4192	3436	msedge.exe	129
PID 3436 wrote to memory of 4192	3436	msedge.exe	129
PID 3436 wrote to memory of 1596	3436	msedge.exe	130
PID 3436 wrote to memory of 1596	3436	msedge.exe	130
PID 3436 wrote to memory of 5464	3436	msedge.exe	136
PID 3436 wrote to memory of 5464	3436	msedge.exe	136
PID 3436 wrote to memory of 5464	3436	msedge.exe	136
PID 3436 wrote to memory of 4180	3436	msedge.exe	137
PID 3436 wrote to memory of 4180	3436	msedge.exe	137
PID 3436 wrote to memory of 4180	3436	msedge.exe	137
PID 3436 wrote to memory of 5496	3436	msedge.exe	138
PID 3436 wrote to memory of 5496	3436	msedge.exe	138

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\@logsred_bot+[23.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffe71f3c188,0x7ffe71f3c194,0x7ffe71f3c1a0
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1812,i,17414350232486172461,4643704273234055126,524288 --field-trial-handle=1896,i,15767673657281729202,14297952978230206522,262144 --variations-seed-version --mojo-platform-channel-handle=1972 /prefetch:3
  2⤵
  - System Time Discovery
  PID:392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,11178709088675025943,17914423556534501680,262144 --field-trial-handle=1896,i,15767673657281729202,14297952978230206522,262144 --variations-seed-version --mojo-platform-channel-handle=1892 /prefetch:2
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2628,i,14241114717441435148,7984138011387486044,524288 --field-trial-handle=1896,i,15767673657281729202,14297952978230206522,262144 --variations-seed-version --mojo-platform-channel-handle=2760 /prefetch:8
  2⤵
  PID:3692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,13371060537461979528,14652337800257306639,2097152 --field-trial-handle=1896,i,15767673657281729202,14297952978230206522,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,4042182765004560252,4761792319536743617,2097152 --field-trial-handle=1896,i,15767673657281729202,14297952978230206522,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4192,i,6740028262831588929,2444524168305409010,2097152 --field-trial-handle=1896,i,15767673657281729202,14297952978230206522,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:1
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4108,i,17178830073012548090,15286541307269769738,2097152 --field-trial-handle=1896,i,15767673657281729202,14297952978230206522,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:2
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4268,i,8448655126255963871,9852831690596230016,524288 --field-trial-handle=1896,i,15767673657281729202,14297952978230206522,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3632,i,4230968788887901351,12813475700742886971,524288 --field-trial-handle=1896,i,15767673657281729202,14297952978230206522,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:2264
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,425802387585250248,1950059723235436295,524288 --field-trial-handle=1896,i,15767673657281729202,14297952978230206522,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,425802387585250248,1950059723235436295,524288 --field-trial-handle=1896,i,15767673657281729202,14297952978230206522,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5704,i,15035910572824387724,4982736482419216228,2097152 --field-trial-handle=1896,i,15767673657281729202,14297952978230206522,262144 --variations-seed-version --mojo-platform-channel-handle=4436 /prefetch:1
  2⤵
  PID:5424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6376,i,1349549409753090362,17446682152506381070,2097152 --field-trial-handle=1896,i,15767673657281729202,14297952978230206522,262144 --variations-seed-version --mojo-platform-channel-handle=5980 /prefetch:1
  2⤵
  PID:5436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6400,i,1515177415203638033,705630759696262080,524288 --field-trial-handle=1896,i,15767673657281729202,14297952978230206522,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:5684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6404,i,14917014251614219440,6523050125626623357,524288 --field-trial-handle=1896,i,15767673657281729202,14297952978230206522,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:8
  2⤵
  PID:5692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6408,i,14473424317957551533,10425663685210844013,524288 --field-trial-handle=1896,i,15767673657281729202,14297952978230206522,262144 --variations-seed-version --mojo-platform-channel-handle=6460 /prefetch:8
  2⤵
  PID:5700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6500,i,2220484927227802851,13625849168918714836,2097152 --field-trial-handle=1896,i,15767673657281729202,14297952978230206522,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:1
  2⤵
  PID:5848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6604,i,1170130593065141058,15285052708531320130,2097152 --field-trial-handle=1896,i,15767673657281729202,14297952978230206522,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:1
  2⤵
  PID:5856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,9319856794179319456,14451331299593509806,524288 --field-trial-handle=1896,i,15767673657281729202,14297952978230206522,262144 --variations-seed-version --mojo-platform-channel-handle=6916 /prefetch:8
  2⤵
  PID:5980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6456,i,12119831085968458376,16795758694578508842,2097152 --field-trial-handle=1896,i,15767673657281729202,14297952978230206522,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:1
  2⤵
  PID:5988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6536,i,18077725693126961673,5806621356781551152,2097152 --field-trial-handle=1896,i,15767673657281729202,14297952978230206522,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:1
  2⤵
  PID:6008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7180,i,10927746062713735890,9741374388025945558,524288 --field-trial-handle=1896,i,15767673657281729202,14297952978230206522,262144 --variations-seed-version --mojo-platform-channel-handle=7188 /prefetch:8
  2⤵
  PID:6092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=7232,i,12826522174642372353,482697327725821209,2097152 --field-trial-handle=1896,i,15767673657281729202,14297952978230206522,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:1
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=6684,i,842140794259473582,9199226186720151994,2097152 --field-trial-handle=1896,i,15767673657281729202,14297952978230206522,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:1
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6680,i,3271916795723878999,14783911108030839125,524288 --field-trial-handle=1896,i,15767673657281729202,14297952978230206522,262144 --variations-seed-version --mojo-platform-channel-handle=4112 /prefetch:8
  2⤵
  PID:1596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6540,i,1612701925869786620,4034537830266805322,2097152 --field-trial-handle=1896,i,15767673657281729202,14297952978230206522,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:1
  2⤵
  PID:5464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=5292,i,18268828116533538334,7891336365548151440,2097152 --field-trial-handle=1896,i,15767673657281729202,14297952978230206522,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=6468,i,10230913224914960683,12839533868388616584,2097152 --field-trial-handle=1896,i,15767673657281729202,14297952978230206522,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:1
  2⤵
  PID:5496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5160,i,1407782830920396813,8316847319801466991,262144 --field-trial-handle=1896,i,15767673657281729202,14297952978230206522,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6172,i,5724151140636836080,7023917389024798931,524288 --field-trial-handle=1896,i,15767673657281729202,14297952978230206522,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:8
  2⤵
  PID:5720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=120,i,9286586470471418215,11526895289858518839,524288 --field-trial-handle=1896,i,15767673657281729202,14297952978230206522,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:8
  2⤵
  PID:5668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,10657256975353043928,17328683588611402027,524288 --field-trial-handle=1896,i,15767673657281729202,14297952978230206522,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:8
  2⤵
  PID:5284

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2356

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 27d61c282e4bf112aed3bd07eaaab8788d75224f5e199bab857064cbd5d982a1
MD5 46e65d035adc969e8d04500bca4c5db3
SHA1 fc81b055409d470ed84cfc8497034037eb5a1ee4
SHA512 26b4bf0615d85574c1a8017270ee3e215341811d6c55c46a00d6a9c6c2e6ebbca4202d7b57c225f8b253c27394d706b1e2825b17c78aa7a2e17599e82aceedfe
TLSH
T13FD0231076397AD3D23A147E54718B01B91581777377F3417151440D9D750C6F68B6D1
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cc11c2ba3ec4cb292b61dd36af338e083bb0ce5868e654b17f3c58ecf3c8fdfb
MD5 22bfe5ff5070c92c37e54f6f278efd25
SHA1 2fc94025f3a738879f1fcececb95937cbaa0cdd1
SHA512 b57abd220e674cf733b39ea299fc66d6fe964ab448ae0758482efe80597e3678909cd989b9635acc0317001af0fe6dbbbccfd3cf110ec5ad1b9e4c084de22188
TLSH
T16FD09220B719A2C3E24704BA94A6AB52A916C57AA0B7F7017232640CAE65089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 201729318e073e437978c4f830a6df095e397d14193bbab8cb94016e3e0e1540
MD5 038903102cb76ddedd18207430e00005
SHA1 e694b970e01eb43fddfb00d36857e2b64f8c931b
SHA512 bacb50167c8d736bccc259f2ffbffff915c7c6dc188c6c2c1476ded8cbd822ff968f690173d1b8e35c352ec62f9ace3913a556b80bc1a59211be000ee9ea7447
TLSH
T17DD092207759A6C3E24704BA94A5AB52A916C57AA0B7F7027232640CAE66089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 4KB
SHA256 e0646888bb47ccb137b33a247a0a8d88fbf2b5bfc7329d936ff553d7cb0fd2f3
MD5 5ee0561cfb6472e141c1e9a196bdfeb6
SHA1 8279ade15b9cee108b07f42349c1ad86b94bc8e6
SHA512 c62cc7a28c0add01c8f15cb8f6d6b590e3863ccc5039fb5b0adb5e61e7bc10ddc854a3986c7d4d8e5160ec5cce8d4c4d1ee90c9a893f39f27e1188dc19e71578
SSDEEP 48:MAFgA//lnNrAfuEHEXBEqU8og+WYwO8r98xH0M51clmJOtf49+SxZuc/:MAFD//frXNU8ogoZ2MTmmJg4QSxp
TLSH
T1B281A4BE18E30FA5EB12F2706AD1025AB13185EBF613EE135D84D3F76D037A14A4A558
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 8baabbf2d9a3d6d88152f232328da4362dd818e73329c9a05fd21381d9c9aac3
MD5 a21141db708f72534db3646bdb56013f
SHA1 bfaf652f265679ddc6577c20b3bbab779b25d7cf
SHA512 d3048c4a94fa343642340e0f419a397211ead0e240450bfab5aa157d44b0504505d9b5387c2488571fa8b952efcfb13777ea2683321d91d2edcb01ccb7479d7f
SSDEEP 48:4UAFgAq/lniYNRCuEH+8BEqU8ug+WYDO8rB8xH0M51clH2U9Rt1SQ9PoZ9uLxZub:4UAFDq/xiwSNU8ug9l2MTmFL6+x2N
TLSH
T1A591B6BA5CE30B9AEB12F2706AD1121AB03589EBF553DE574C80D3F76D037E08A06548
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 19b6706555ade44e1f3c86968d60154e6e9e55be4f1ab92d4ed896b4ae62dbd3
MD5 93e42f65dc0a67710ab1159eebb6dd19
SHA1 1b46f631143dac1e56fbd508e88c76fb6f558e0b
SHA512 caba9bad2da8663cceede61dfab894935f2b4ab0e9970b07188dc6dc20e572f585cdb25845a4932fea3dd73d0f74b4b103ab0bcfd3e96aff0e0fe6d5c974dc49
SSDEEP 48:YAFgAY/lnmNrAgZuEHEXBEqU8og+WYwO8r98xH0M51clHhOtf49PYSxZuc/4:YAFDY/xGrUNU8ogoZ2MTmBg4OSxG
TLSH
T1F891B3FA18E30F95EB12F2706AD1021A703285EBF653EE134C80D3F76D033A04A4A558
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 012b1da43e32ba00de03a2cf3850c9f320362f6a739d6427b333cb2811870549
MD5 9093310fe969b5217d1b1704a3d2b6d2
SHA1 de874af94d35f57ec8e83a71b2934ecc144113e3
SHA512 b74474a544431f9811d788db8d41ebcfdd6d8cd4bd0bde80ca36c1cddbd34ed6ec6c58d9fb567fcd8cb1df8ef41edc2c47b39050aa26bcc57f52ef9f23e93a58
TLSH
T10D714EFE19E30FA5EB22F2705AD10242B13085EBF613ED674D80D7FB6D12731499A158
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 79b50e950f834d3442f8b45937f11c05a72d974a0d94f83c2f457bd1ef19c18b
MD5 86c1d6fe247f95fc417cf0c8741a9f4c
SHA1 1110836160effcb945912a3e2875533c2cb1409f
SHA512 bb6403d3cfb42c0cdcd68148dff51f891090d5012ea9cbd442f76bcaaa26104e19be11ce858389f7b5fa3f0ceb1dadd3453a7fdf9bf70633a0cc4e3126fc899c
TLSH
T1838181FA18E30A95DB16F7301AC1024AB13189EBF613DE634D80D3FB6C127A14A46158
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58656c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58656c.TMP
Size 3KB
SHA256 e869599bd817d126453c63d749c7c067636dc87754cc61a78916712006a91b44
MD5 f73290f687207514adc0d2c80467d593
SHA1 5fdc621acd6815870fee4699a6562086f3456136
SHA512 e614582597c108de8b423307141542e2e547fb9756aa26820d7808960ee17396faa363cce7192fc24ed9e94798f588b8ecc4f169f496a5a02dac3324282303cc
TLSH
T1DD716CFE18E30FA5EB22F2705AC10242B13081EBF613ED238D80C7FB6D16731899A058
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 12KB
SHA256 cdb85fa8254f2ac8d9710f72c96cee52318ce9c13e4b76ad32dea357d23184f7
MD5 92f54aa93020e214bae383fa5bd7d633
SHA1 ea39e25d6a4f9980c29062afaea3469df6ba2519
SHA512 1e4edfba8709c5809b598bcbc75df8db779a955074569671a8cee406011fe1d27a7203a448fa4a1863b347c7a4dc3592253bc464cfaa37a8e200def14da11666
SSDEEP 384:Dzgw5rQP1+etJ4VlKAtGXZx1QAZoRZKZFXPrAvNL3UEu7DU7p89ITfl20T54VYmy:O0iGAU4+xc0
TLSH
T19742AEF7C3E5867E881156F49B24AE1ACE1E165A832C3C168DE4BF4FA3E2471D24164F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 19KB
SHA256 98872c6264b4efb30073def2eafd152266be238bed5ca9371e13849e91fc1cfd
MD5 53acab3eed572b52de46a589b3bf9cfe
SHA1 2f1b0ac8b6b29652e13308db02e351e21a23ea8f
SHA512 a084722f0d782c78f7787ea254204ad8338743f0d6a2d7ee627f517dfbbc0b2d883d90206f11a7e9c89ee471aec16ed0266acf1784a12b18cc23ca8405860c44
SSDEEP 384:Dzgw5rQP1+etJ4VlKHBw6R7jU27++Ute4SHu1XZx1QAZoRZKZFXPrARL3UEu7DUg:b0iGA4NxdG4WXZ
TLSH
T1D292ABF7C2D5862E881216F49B14AE1BCF1D161A832C3C168DE5FE4BE3E2472D15664F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 eacfa7c35a708ebdcec9d5a3f2c1fa223f6a44fec609c1b91701682fcbc615fe
MD5 92d50dd1da1624fded902dcd26d4d996
SHA1 8271c2defb05889d33563a35b50f8d8cb1a55ba3
SHA512 5e4e8e281183225f1bfb47c73cc06cd3bdeaf6008db579ca2b9722c05d9a764e591b3a4dd03a798a97b83a5a0f6ca9ac7328781e46d2c0f244ccd9bb8764be50
SSDEEP 192:sxZpRzdF/fKszJHwIdpbz8keyHHW6+WNXSbCYIU5T+hIg5CJ:sxZpnF/fKszJx7HbVog0
TLSH
T18432D7536A38697B9CC6E219FA55BF43E2F95031A5D05E58BBFC8A0C04E7BDD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 9KB
SHA256 33bedad4be588065a7efd13d08c5ff14e4a3a303198ece6bfa6c85129c92a1f0
MD5 c69d59c6d952b8f1039bae3a02e59f4a
SHA1 a66c37217912aaaa9902dedd9204742a61a6beb3
SHA512 b6d303ef0497b82b830fe4779021b14c4e4e7bdbe3365279304edb71a42281f5ebf90d49b38c96a942802b33e7d676767710b917c9f03a58b29d27cb2afc3843
SSDEEP 192:sxZpRzkF/fKswAdIdpdGHW6+WNGYIk/T+hIgrJ:sxZpeF/fKswAecHbGcg9
TLSH
T1E422B8526E28A47B8CC7E21DFA15BF43D6F95032A5D05E58EAFC861C05E7ADD120B40F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 6de3aba2c96175bf9852628f70117d3562f87d252d71098b02fe6224f5458b14
MD5 7ce126d890d63b545dfdb5909a8238ec
SHA1 6f74ba32ae6f1778b227cee70e60a836dec72d70
SHA512 0cdb0807d518e68682f92ac8643e85e9e2f47c4332c126d3871ec9c9732528fc545a65fcad7b7dd73ef408979be19654de93e19c4609fb16f0d8d1e7c1ad2351
SSDEEP 192:sxZpRzdF/fKszJ5Idpbz8keyHHW6+WNXSbCYIU5T+hIg5CJ:sxZpnF/fKszJS7HbVog0
TLSH
T11532D8536A3869779CC6E219FA55BF43E2F95031A5D09E58BBFC8A0C04E7BDD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 cd847ea0df414dd83ba2a0d47f36e73be3a576d601154c780f8cb4222e502e67
MD5 711d1f12658bad882df40431ed32dacd
SHA1 2c6ffef0fbdb0b4c856d9a16c76751cff7b88df8
SHA512 fdaf3cb6749ef668a27c9af9cf1127376923918a0763bc0c5e41353e455cdafd5c5b6b50cdf0661a104d7b8c8c24cb4ab07fd2cea231267244dc5196a32a7dfe
SSDEEP 192:sxZpRzdF/fKszJkIdpVz8kyHHW6+WNXSbCYI4mT+hIg5CJ:sxZpnF/fKszJ96HbVTg0
TLSH
T13B32D7536A38697B9CC6E219FA55BF43E2F95031A1D05E58BBFC8A0C04E77DD120B80B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 112d916f8af13081d8613645194772efac4eda03e4c38e8742ee0e4141afd9c1
MD5 535a0318df7c4c71bba6590b946cbede
SHA1 84c563f2fa27db9c84800c402f22981fbbc3bebd
SHA512 e5293598ce9343222b4267fe7c25339ea088fee3ff6d1bb5a53a534c38903f426dd04f7918f998d8fcd8b1b7ac51004d4d850a16ea4d20c4f8c40d30c19d0d49
SSDEEP 192:sxZpRzkF/fKszAdIdpdGHW6+WNGYIk/T+hIg5QJ:sxZpeF/fKszAecHbGcg2
TLSH
T1CB22D7526E28A87B8CC6E21DFA55BF43D6F95032A1D05E58AAFC861C05E76DD220B40F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 c0bf71176fd607c9350b1d6708c74241266e93385c8cdb60dd34d829769d5445
MD5 1c6decef0890e71dc11ce850ae400116
SHA1 ab780965bb06ec19a57ec15f4c042881724b2e7b
SHA512 77cc036d373062979d9c8401fb0429b6dfafb0255aed2f3cffdc131f0a1ed8d2b1f25fab1af297222fddcdc893ae99cf8ad93e60a60ffa4282090d41bfb34da0
SSDEEP 768:QnyqbblWvJDjT8F1+UoAYDCx9Tuqh0VfUC9xbog/OVE4Ll6AR7/ropYT:QnyqbblWvJDjTu1jah4LAs7spu
TLSH
T1F6C2F93B654CCB7E4FC00AADDD5A6FD73E9802C7A6588D4047FA994C02C73EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e24ff48a-6378-4a4c-b37a-27e3ca5fe7e6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\e24ff48a-6378-4a4c-b37a-27e3ca5fe7e6.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 b1c8661888afaa6b09b8d44b9a191fc4f8ded4a9557d86a42608b22726746537
MD5 e09757fec848b17f70c6c75a919345aa
SHA1 cf496239bc57bdf580e8ece691339babd444fde7
SHA512 5bbdf5d4ec27b7d5f8dec78fecd3a60ca2a343c989a78b6812b8f7e9cb981e0092a177381c8c60fcd0d8e465463d76fb3388fb05c2e3750547be79a9d732bba7
SSDEEP 384:5iF1tNn/s3n9Sf4sNW8TUNTUlIliFKpbamPVRN3OKZ9QpB9OObjI9G6w7pa:QF1j+9v3wg4S9H3Om9cn29MM
TLSH
T110A27C3358589E3BAEE29A44F94B32078EF440BBD6C5AE84E2DD5F0C01DB5DC030AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3995ae7e8ca33da691668f86b7f0cdef0d1e37e812ac02d1d3fdc74c666ba658
MD5 3241a359425166aa32e758ea76cda463
SHA1 2a9b947746add904f6a7e8e7eb36b5d507b62694
SHA512 2302211bff9f0138b90bb48ef36cd0cb3f3c0465dbfec5eb332d342b1bf518511c3cc3f7fec841b18d566d4c81fa253f21884de5550fe7d18bb475d106612539
SSDEEP 192:tONK6JkRtQmiUyVjW+RN3OmNOmFHh32ROFU6:tONK6UrWW+RN3OKBpDU6
TLSH
T14502E9356D382C779EF2AD09F98B27135FA8206BF9956F84DAD81B0C01D769C1346826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c2452e94567c0fb26a37ae32013980f5c9494bbaa17deb75fd6445702086dc77
MD5 235d3b7cd1b1cc5897aa37da1f6df93d
SHA1 dcef2893bc59249587de8b247c181bcfbef72de8
SHA512 c201c2480e003b744f02519cc54251a9f73c4c442fab4306b4169481d21020d71c38f00dac502cc6c70a8d666aef78997361528935c24de5fbb295f695dadd56
SSDEEP 192:1ONP6JkReQmiUyijT+RN3OmNOmSC9QjMEVc9q8v9U6:1ONP6UarT+RN3OKZ9QcB9U6
TLSH
T10F121B3268386C775EE26945F98B32174FA85127FA896F80D5DD2F1C01DBA9C130FD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 398e529e55d428efe0316dd9d13c4d272b2f09e3d2da56448954e1204f3f1c06
MD5 683446b8a8fc466f18d3b15943b5efbb
SHA1 31b5aed0a661ed5b68249a78d2257c562b2503da
SHA512 ef13c852829ecf1d82bd89cb6b5739b9c6c3b97175e8c77a981cb4ff36e70ee1a4d2eb04be83dfbdac75a5fc49fc3449f976d5511cf858d0d9f6b22341fa447e
SSDEEP 384:LtNn/s3n9ScsNlUiFKpbamPVRN3OKZ9QkB9OObjI9G6w7pa:Lj+9jwS9H3Om9nn29MM
TLSH
T191929D326C285E374DE3A445F94B36178FF451BBA6C92F84D5DD6F0C01DAAEC030A916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 974f470c241651721a5a022768e669bbe6fda764a93fd45b83e5d0dc8a8519b3
MD5 51554509574b0db69ad687d7e41d7cfe
SHA1 e695d89ad7e5139f4cc703195d5bf31aceb4fc51
SHA512 7cb248e62480a3d7509d94159f03f00727bad5706306a851fc9169e025470345f683058f744042e25dacdd2324942fc29193098aa13dcdd7072ecd4e0448771f
SSDEEP 384:+sNlUQFKpbRlhVRN3OKZ9QNB9OObjI9G6w7pu:+quHH3Om9+n29M4
TLSH
T16B727C326C385D779EA3A505F58B36139EF4507BEA882F84D6DD6F0C05DA9EC130A81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 af363782b03527fd421f2478b8130ea600980837e90f576c8e9a63ae3912b90f
MD5 350e8db197468c977dfa51ee6595d683
SHA1 7ec6422b1f2388a650ddce079aa2179cac3a6782
SHA512 91d74f127c6bad4739916dfba9986f03e05c401ffbeab36c251049c836884cc39847af8a6d7c42e9f1b57192b88d0d63da151d4193ebf8e23a60f5090f47ef15
TLSH
T105E00203531000E7C1180B3010C3591139F7403413F34104CD10117418133001D70B40
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 1e459e4e9049aa02ca3f57738da1cdeb85d894a03ac8831b7f5e22c2449019f9
MD5 564eddb21b779f48078325909f3aceb2
SHA1 9efe6bebabd42a5089e91a362f48e301441e9b75
SHA512 9982490bb37f8aab42432f9c4864752de6e187c8cbda1a065c4d82f82abb17eaa32e8104f9d6d4f148bb9ebd8d6201a409c33eeb5026b3c2e9ddd1ad80cf4fb9
TLSH
T144E00203931100E7C1580B7410C359153DF7503413F38144CD10117438133005D70B40
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe59064f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe59064f.TMP
Size 392B
SHA256 9a12b99afe44f2037b7590d9f50dc8c48a306e3570c7959ce6f94572ae386d32
MD5 fd8eada5f97607fa9615ac7329659677
SHA1 e246649e90a86cd6e0e29978f004b265d838a285
SHA512 f2364b004b210ae93cab943f16f467d48b140296de704ad2e6840ac786c37d81b790f349f2fbd4c43ce96c07109771535580ccb13e208a02e3b20ee930172b76
MD5 SHA1 SHA512

Submit Download

17418d35-30b6-4bdd-9606-8653eb468847.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\17418d35-30b6-4bdd-9606-8653eb468847.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 cbc037d69318f132858484fecbe02c23e835b58dca49f473e2fb86373acd4b0d
MD5 ba6277df00cfec0ffd6680deb04a1674
SHA1 0a978bb6fa58afe6588312d8f7eb2fa2f64034df
SHA512 17cccff459ce4891f6aea535757bf77cb202c31cee3fc0b7dbc59479729ae6e78a314a7ddafe12f8e61d339020cccd5670bc85f0e778e3a713872a2f510966b8
TLSH
T16C412B5CAAE91148B3B76E5A9FF7686D487E78772F07909D10010D4E0A63F40C872737
MD5 SHA1 SHA512 TLSH

Submit Download