abd3832af364e55765abe129a78a58f35a3075af7d2a82aab0fe06cfe3a0d3da

Analysis

max time kernel
900s
max time network
733s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/07/2026, 08:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
email-html-2.html
Size 35KB
Sample260720-j4cryady3x
SHA256 abd3832af364e55765abe129a78a58f35a3075af7d2a82aab0fe06cfe3a0d3da
MD5 41211f4c21d365698b77cd3ff26f5ef3
SHA1 8e3da2885bf99271125a3822917daf7a8815df6f
SHA512 65f8f6ba8480d15d14eebd4c0d05a3cc2a3e734aa373d3d33aa37fb85d147f84e05a3658cb3d3d4efe22539a9cd64254703003d8ec02ffd13d02dbb66829063d
SSDEEP 768:Hh6jYbCbDhJdYDW/5zC6no2X6QD7HDbEehHHoNeaHMLLedGr0Ddn:aeS/5zC6Pz3H0ehHyeaHseBn
TLSH
T17BF2B752E7C12126417689B9E2633FB9EB10010FC75248F0FD9E2B7AEF658B316517AC
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3592	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134290088082785168"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{90E2958B-5AB6-4A22-A6A2-87CC17D6EDD1}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2956	msedge.exe
2956	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 3388	2372	msedge.exe	84
PID 2372 wrote to memory of 3592	2372	msedge.exe	85
PID 2372 wrote to memory of 768	2372	msedge.exe	86
PID 2372 wrote to memory of 768	2372	msedge.exe	86
PID 2372 wrote to memory of 768	2372	msedge.exe	86
PID 2372 wrote to memory of 3304	2372	msedge.exe	87
PID 2372 wrote to memory of 3304	2372	msedge.exe	87
PID 2372 wrote to memory of 4316	2372	msedge.exe	89
PID 2372 wrote to memory of 4316	2372	msedge.exe	89
PID 2372 wrote to memory of 4316	2372	msedge.exe	89
PID 2372 wrote to memory of 3420	2372	msedge.exe	90
PID 2372 wrote to memory of 3420	2372	msedge.exe	90
PID 2372 wrote to memory of 3420	2372	msedge.exe	90
PID 2372 wrote to memory of 1996	2372	msedge.exe	91
PID 2372 wrote to memory of 4160	2372	msedge.exe	92
PID 2372 wrote to memory of 1996	2372	msedge.exe	91
PID 2372 wrote to memory of 1996	2372	msedge.exe	91
PID 2372 wrote to memory of 4160	2372	msedge.exe	92
PID 2372 wrote to memory of 4160	2372	msedge.exe	92
PID 2372 wrote to memory of 1564	2372	msedge.exe	100
PID 2372 wrote to memory of 4444	2372	msedge.exe	101
PID 2372 wrote to memory of 1564	2372	msedge.exe	100
PID 2372 wrote to memory of 4444	2372	msedge.exe	101
PID 2372 wrote to memory of 3848	2372	msedge.exe	103
PID 2372 wrote to memory of 3652	2372	msedge.exe	106
PID 2372 wrote to memory of 3588	2372	msedge.exe	107
PID 2372 wrote to memory of 4152	2372	msedge.exe	108
PID 2372 wrote to memory of 3352	2372	msedge.exe	121
PID 2372 wrote to memory of 3352	2372	msedge.exe	121
PID 2372 wrote to memory of 5104	2372	msedge.exe	122
PID 2372 wrote to memory of 5104	2372	msedge.exe	122
PID 2372 wrote to memory of 2956	2372	msedge.exe	128
PID 2372 wrote to memory of 4416	2372	msedge.exe	135
PID 2372 wrote to memory of 2216	2372	msedge.exe	134
PID 2372 wrote to memory of 4416	2372	msedge.exe	135
PID 2372 wrote to memory of 2216	2372	msedge.exe	134
PID 2372 wrote to memory of 4064	2372	msedge.exe	136
PID 2372 wrote to memory of 4064	2372	msedge.exe	136
PID 2372 wrote to memory of 2752	2372	msedge.exe	138
PID 2372 wrote to memory of 2752	2372	msedge.exe	138
PID 2372 wrote to memory of 3640	2372	msedge.exe	146
PID 2372 wrote to memory of 3640	2372	msedge.exe	146

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\email-html-2.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2f0,0x7ffef4a8c188,0x7ffef4a8c194,0x7ffef4a8c1a0
  2⤵
  PID:3388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2004,i,3893483219931508081,6516046526689251109,524288 --field-trial-handle=2240,i,17876827586961881032,12166737442752185229,262144 --variations-seed-version --mojo-platform-channel-handle=2276 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1892,i,4019275920471036027,9203112396763013899,262144 --field-trial-handle=2240,i,17876827586961881032,12166737442752185229,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:2
  2⤵
  PID:768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2568,i,14290188032056090813,1740673561661443782,524288 --field-trial-handle=2240,i,17876827586961881032,12166737442752185229,262144 --variations-seed-version --mojo-platform-channel-handle=2516 /prefetch:8
  2⤵
  PID:3304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3408,i,5379976875318042627,392140797776081852,2097152 --field-trial-handle=2240,i,17876827586961881032,12166737442752185229,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,3030806650886661460,2013297328753209882,2097152 --field-trial-handle=2240,i,17876827586961881032,12166737442752185229,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4164,i,9644314616011478873,3762972043665073439,2097152 --field-trial-handle=2240,i,17876827586961881032,12166737442752185229,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:1
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4188,i,2504287497917135174,18025760409294064274,2097152 --field-trial-handle=2240,i,17876827586961881032,12166737442752185229,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:2
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,5427161565918868340,5584516662044606466,524288 --field-trial-handle=2240,i,17876827586961881032,12166737442752185229,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4412,i,15933774209093584695,534024256981925541,524288 --field-trial-handle=2240,i,17876827586961881032,12166737442752185229,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,2500038988795933263,6338865171477566201,524288 --field-trial-handle=2240,i,17876827586961881032,12166737442752185229,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,2500038988795933263,6338865171477566201,524288 --field-trial-handle=2240,i,17876827586961881032,12166737442752185229,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4284,i,16090475042817053497,13069333538267807437,524288 --field-trial-handle=2240,i,17876827586961881032,12166737442752185229,262144 --variations-seed-version --mojo-platform-channel-handle=3564 /prefetch:8
  2⤵
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4596,i,6614735989951869854,4175802661466715625,524288 --field-trial-handle=2240,i,17876827586961881032,12166737442752185229,262144 --variations-seed-version --mojo-platform-channel-handle=4576 /prefetch:8
  2⤵
  PID:3588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4572,i,16020148588808336300,11159940903778469839,524288 --field-trial-handle=2240,i,17876827586961881032,12166737442752185229,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:8
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5208,i,9970109447834835052,8301506909690681738,524288 --field-trial-handle=2240,i,17876827586961881032,12166737442752185229,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:8
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,15243735521197374804,17487309332902799018,524288 --field-trial-handle=2240,i,17876827586961881032,12166737442752185229,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6132,i,4739817358574712492,18326477544596972928,262144 --field-trial-handle=2240,i,17876827586961881032,12166737442752185229,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1012,i,4417383027324953426,10770477063883602803,524288 --field-trial-handle=2240,i,17876827586961881032,12166737442752185229,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:8
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3492,i,1258749196873805366,17580712247534392452,524288 --field-trial-handle=2240,i,17876827586961881032,12166737442752185229,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:8
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5696,i,11441290786904867468,208291222744104657,524288 --field-trial-handle=2240,i,17876827586961881032,12166737442752185229,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:8
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3320,i,11340749407557375264,2244440963295516359,524288 --field-trial-handle=2240,i,17876827586961881032,12166737442752185229,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:8
  2⤵
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5840,i,13902373126094536925,16518198247652382017,524288 --field-trial-handle=2240,i,17876827586961881032,12166737442752185229,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:8
  2⤵
  PID:3640

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8c5b1a407270ca9ae8bec8f20cc56244f3bde6f042890a4cabcdf4df3d21fdad
MD5 16f782e6f4d4592598936b2f29b6b339
SHA1 5c8c22b7f56af2b2e0d9978418f077cc8fd13c41
SHA512 28b2f7186b910539fa22408b47131fb16874b4c2192a721a69393efd7812da561ea9977b8af678cd3a9e37c23f186f876d7086a20afe28b16659db70955cf16f
TLSH
T15DD09232B7C9E241E14232BAA81447826E2A4A68259AC2176478844CEC6984AA79D28B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b28cb7be2bb68a6cda7ff7689f0ec4acdf8699e4818545d4dd692148ce1d64d2
MD5 a712889d00fb4f0945d13b925681156a
SHA1 1448cbfbc2c620e016aa5e6fccd0ac75e74ef2d1
SHA512 65f51cf451d5f77c9e695462e66abc873922db3c3999c172526727c2356a5a29052ce4b77ead44b02780ca80f6b290696b7633f537570254f36e7374ce0d04a5
TLSH
T12ED09B3277C5D541D5423276A41447816E164568159AC2175474444CDC69445579D147
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 291844a1e1b5294af975b5cba1eb1d253ec9377e8a1573babef8ccd911849170
MD5 8456ed402a12233de098563906478aef
SHA1 8c86256ad998631f84be3ef84cf80f4e5619eb99
SHA512 f6fa5b6c2e2ba802142697b0514e8c1b7f1a1b43dcb0378a96fa759f4b45f3c4604743b66c3307044796a0b32ba63141328b23a99e7d7d19584f97313899dbd6
TLSH
T13DE086E917CAC26EF204648747F8634CC3B0370A96C9695A2B08899C7645554EFB66D1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 341788b78ce2e4bc5f96567037666c00df804b3a235fe5e5de2d0ad427fa7529
MD5 318cd0a6b5613d184d1d5130fbf8e3ba
SHA1 ae6c55e642a4e790b3f8adcbd46b8da97d056129
SHA512 7f4c6555d314e860690dee48b43ec9dad6c89d78794468ebf2c6971d730551461951b383aa0bf3006a88dfac4d190bd9b9fc5f3adcfe8134048740386cfd88ac
TLSH
T1B4E026EC46E8C26EF306648B83B8470CC3A0370A92C8A95A7B09848C71820A1E7A6690
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 38349ba5658d3124dc698a9fb3823eb4d7b1f45686a4dec98fa383cbde1e469c
MD5 5243f89e40f42905d42ad4f5a0240b75
SHA1 258e79f470f1dea8a2369e054e81d39ebce6dc1f
SHA512 971858a63a557593e4a9874431afea17dc63711d473aaef13b84d0248a7e63b1b45c359c5a2a8dfd6178362031c54cf57b6e452caa15732a1f1d495d232c14b9
TLSH
T1BAE086E40BCEC26EF225648B47B8974C92A0371BA7CDAD7A3B0D859C7142584E3E2690
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 2b48ba84a417e2edd17032350b295f34fbe112a4090b11ff5f26a1382a11838c
MD5 97e079dca1c569bd8bb0de0b830e6d6c
SHA1 ed6b7cecc5609b08685c35772433a35af0f1f313
SHA512 7b1e31bb34d34744b9b651734f76b4617b36797ee552332f25b9c87c63434638c037cd7d0f00440bd59df65a74c8bae2f959c07c73f9e30470cd26b691325b94
TLSH
T1B3E086E807DAC2AEF704A45747BC434DC3B0374AD6C9B95A2B08C49C7581554E3A3790
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 592184afc44b76f97051e1e6747e32037959d9024f3cc6d09f0ce0246acd60d2
MD5 c7e5a8f00b77f5d6f9bbb2ce5b82086f
SHA1 746bed162c4bbcc34a40b5cb6a59675fd77de43c
SHA512 1cc9512c72800b7d4447ef253d02493bc218c3214c0d7e726d0269c7484e4d5e7e937a24cd6b708650240e93bdbbe799c988473382bfef4c9939613ad477ce54
TLSH
T19771F755334248B6EFD6013DCCE206C17AB1B299491B0E6A15709F7E37CC72F0D2048C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b7d2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58b7d2.TMP
Size 3KB
SHA256 09cab5d79dd9f3d88fc79d1dafbd79dd6168ab131f721bf7422aa03b0fc246c1
MD5 6e313edd91c8ba14ee389d256c7c5c56
SHA1 dc643faec2d7b5c36ccce1bd2cfefc7b13685b81
SHA512 d9aed98516d746fdb73eab5d825becb9ee17982a3312bdc4f3b32dd59229c2be0ac112027e610f4ba121f2357402d95d7bf506b6a50641f33547b9c1cff15ded
TLSH
T1B171D655334248B5EFD6013DCDE206C57AB1B199495B0E6A15B05B7E37DC72F0C2048C
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 966B
SHA256 20f7a5878183a08111357e0d8489c0b48d4e6c5d98ed5a735738d8c8ffd72fde
MD5 c41e72de669f58a55a5b223378c868a1
SHA1 832fd609facd3d907d93d7dedcf27aea635c2b53
SHA512 e595a59a08248fa17d9d1d0d730faa78c539d76a709a3d08d0767465e7c8aff663eaf02e3200bf3710e74fdfd75380834bb085f418e562a71a204dd9211c6073
TLSH
T103119EF783E1856EC91116F05A14AE2BCE1D0501421C7C5985D4FF27C3E3075E102A5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 24e32e0eb0e981c2833afc63afc86bf1fad189d836f698cfba34250915e5436b
MD5 f6724ceb6e8e114db50d814092a8067d
SHA1 260207aad1965b29b77a668e45cd06b3735b3a70
SHA512 8d2822ce5ff3da5f789cd0c9e99b9773691d7d1c05066eb44c5d0804fcdeef283670b2784add8173c377f7145cab18f474ed35874da11da2fdc1112ab7bf5762
TLSH
T187115BB3C3D585AE891116F06A24AE1BCE1D0515821C7C15C5D4EF2BD7E3479D10255F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 0eccd1f5a95d6d4c121c8ad3aab34179087b50a792ab619d4e311f5f38937a61
MD5 c8d88650f16109e29eb12de12748e3e7
SHA1 aaebaad53c2319aebecca3c5828eb1a3fd3de44d
SHA512 3cd006422def052e451a0fee9b692e4ecf5c1e053d978139f245a1cdd7adb80acf7a69e492a258c061ae9c9f41f8bd964f7cc6df70cadeb96533efe917424e04
SSDEEP 192:sxZtR/UDyM/jK1Ml8MkO/fLsuOWCXCIdpdpHW6+WNGY4wWX2IgrJ:sxZtiFMO/fLs9WC7XHbG89
TLSH
T18642D7166A34597BCCDBD209FA55BF53D6F90472E6900D44AAFCCA0C05E6AED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 671761a91c9d77d6cf1ff52415f78b3370ea8cfddd2cab9131e42e49d17bf11e
MD5 9239e7ab856b80757f34af5de0a7db02
SHA1 a17e5b6a6ff81c090b76a0ceb22f9c6f4c681f5e
SHA512 9eef54997790018388ad4ca2775edb3449d2e01e2177695e9405c937e4140e33410e8f2608932e68d5da30a4fc1d734d35b082ba116461d15576df556610a03b
SSDEEP 192:sxZtR/UDyM/jK1Ml8MkO/fLsuOWzKXCIdpdpHW6+WNGY4soX2Ig5EJ:sxZtiXMO/fLs9WzK7XHbGgi
TLSH
T14452C616AA34597BCCDBD209FA457F53D6F9447296900E44AAFCCE0C05E6AED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 4ff3af5d2452e82e953dde69d12b18de04e23d89ab1fb34415cc1c6436f1d0a9
MD5 f789bf378d39abbe60d7294a5c86249b
SHA1 2fb21478fc38130333e2d9b3da3a54489e98dc1b
SHA512 bd2cd89d04a8d597f3e9c08073bac10cf61e41018c23dc5f4199c31276eba739f791033db408b9c93922630311cb65f32d14dfc1f2de54e8675a7442dfed0c47
SSDEEP 192:sxZtR/UDyM/jK1Ml8UQ6kO/fLsuOWzKXCIdpHpHW6+WNGY4p/X2Ig5EJ:sxZtiXqJO/fLs9WzK7JHbGai
TLSH
T12552D7166A345977CCDBD209F945BF53D6F9447296900E44AAFCCE0C05E6AED2213C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 814562f78db5d9697352d94cdad31acc270dead87c3c78dde7a98a5c7779bbd5
MD5 52cbe894e2e586395d993cc056f0763f
SHA1 e5e424ceebf94b7cf212ceca86400950e33c48c9
SHA512 624f9bf92687fe2b6607dcae305bd1aa41ea1365a93627b8cb04fee12fec4d07a5e1a8ed3bf84e3c1b26a7823c113449c4c4053b37abf2b37788a87122b11d27
SSDEEP 768:EO8iJPNWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsALl6opdSroUkiUnY:EO8iJPNWvx76ru1jahALocdJCUY
TLSH
T19ED2FA3B680CCB7E4F844E9CEC266F966DD801CB5B988D5447FA884C03C76EE512799B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4a9d8211-7182-4c12-98f6-a69f4033bc23\index-dir\temp-index
Size 1KB
SHA256 c8cd98c793e0cc9e6bfc172e14d71ffdea467d4123648dcfc08246a36d747b4a
MD5 8fdf7fdd657e2a903612ff3f26caa3f0
SHA1 d1e104f810d1ca04d3ece563d7f2d0fc98121383
SHA512 e69726f70eb841f016589859a784212f49c23362e1192c72c4efe9487ce8741ec79a18576972ae3d580c77c99bccd5cb6a7218694f8e521e660a16a3ac27e731
TLSH
T1B43166494DA1CDAFE8B042B2067168A4737084DC1715B713583C31357E2336A264B9EC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d5547.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4a9d8211-7182-4c12-98f6-a69f4033bc23\index-dir\the-real-index~RFe5d5547.TMP
Size 1KB
SHA256 da62142a29e74aae29c7dc2b7205101e678169be19b2a5aff2547dc3f1c21cc3
MD5 c943fa81628c501c6bbe32351625569c
SHA1 fc03a1d7a065b9ac3355ec1a75a540041e5346ca
SHA512 0658e2207fcf1c5fa470120ed2d0994f3005578036f8ddd69d7c9c2368f9cebfc3c568c0542c6d8ba2ff7f9025e4c71475f11e3b2fec7aac245e1e3695c96fd7
TLSH
T18231325A4A918D1FF8D4507B0E63F8B8733588404311B793A97C6239AD25B9D2A4F0DD
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 286bd47e042369f51ff42dab6988c939683fb73712867f9d3f428015468c4aea
MD5 327b11a06e6f58e945c1f1e1caf470b5
SHA1 9ea368fe2a96740cb2286be7f33b1255c221f79e
SHA512 7f3ebd0aac93c0bbe5785dcc6872ed84480f3c5ae9db60736954a07735bf0152222bd20ab1a4f67eec42fb22e6bf1f45235af23e4859177bd5b9f3d7ec928ba0
TLSH
T19AE0C0F72EE72880FEBF63E1147198B00281B459D584BC8F2416FB9324613533406C22
MD5 SHA1 SHA512 TLSH

Submit Download

9e65dfb6-4796-4a77-b56e-d7e1dfb9e7a9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\9e65dfb6-4796-4a77-b56e-d7e1dfb9e7a9.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 6127defca84762316e1247616b2eb266edead05959ab34ab8823af1cd1bdbfc7
MD5 2b591e38b2c582ed99f286676319fcc8
SHA1 a8f865a550cc6d0e7acc793ad7df1e02c790af66
SHA512 3d796651e61380456d45fa46940deedcaf84568a62dd4b559de95d54b8aefcee4191ae05f231945e29560b751f8619d02edd7d142c41fa4ce46ebfc45e171390
SSDEEP 192:uqLsN/3Qa1BYmt4QmiU1gup4k03tjzorYbraEXH6FJLIJq2OOZljYRHKKGn6w81Y:rsN/3l1/ah2kM8YyEXWObOObjI9G6w7F
TLSH
T1B1726C36AC385D7B99E3E561F04B36235EF4816BDB882F84D6EC6B0C05DB5AC5306C1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 6027e7444c5ba39bc1e1755c32c222a8b111dbb9bf0a7d0de3fd788515a64b45
MD5 91edce2e38980c9a688d1ee095998e95
SHA1 b962786d1f631c1f684c6e5dab63db15b5e1d7c7
SHA512 903ddb2cb402a6886f12f8ee69b686271d5b58f1f9cee776f289ec1678d67f42de1ba0330e52e7515af267e601fb15db6149e717ff55d77d8773313f1b2ea757
SSDEEP 384:SiFszsNq8TUNTUlIlAl1/ah2kM8YyEXWWbOObjI9G6w7F:ZFQpwgqMHM1b29MF
TLSH
T18A824B379C688D7BADE39A51F54B32139EF1816BCB896B94E7D85A0C01DB1AC0306D1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 efa2bb311a0efdbb06110fde9d420eb9b4d4eb24a75ce82a934763bccf695fe5
MD5 3f24039104143dd03b4fed69d45fb237
SHA1 cda9e90b43d74c7a36afa9c55ec87a32e934f327
SHA512 6886424ee08f820adc5a443f5d5a9b99b47a78b433f986c10844864f4b1488d83f1ea26f22f2757721842300e2b69da1c77f8285f0986add4b2f3672cdd5c7be
SSDEEP 384:SiFszsNv8TUNTUlIRAC1/ah2kM8YyEXWWbOObjI9G6w7F:ZFQawgfMHM1b29MF
TLSH
T178925B379C688D7BAEA39A55F54B32139EF1417BCB886B94E7DC5A0C01DB1AC0306D19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 4e8caac66b0ff5189080ab448ef265c4540ccf07426054c586194b579007f104
MD5 4fcd745ccf43e6867e462bc3b19a0e49
SHA1 ebc3b03bb03f68936dab901a42406353cdd839c8
SHA512 5279d4f05b7981c01abf1d4110283869628e8d2346c6d977fdbe0e8154c2e96bd387d63ee31022029b0a45f3fdc6b5081eeb1cbf658dbf49b3135a8ba1a80afd
SSDEEP 384:SiF1tNn/s3n9S6zsNv8TUNTUlIRiC1/ah2kM8YyEXWWbOObjI9G6w76:ZF1j+9BawgBMHM1b29M6
TLSH
T12EA26B339C688E3BADE28A95F54B36179EF4817BCA852B94E6D85F0C00DB1AC0306D19
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 dfb523d5ebf3dd77298f7e7d3017d81bcb059f2efbf0e9b69e2a561b4a3c3d1b
MD5 55facde2c2c34f97d73011576cd9c03c
SHA1 92674a90fa42c183e0f989a758e5c1436effdafe
SHA512 829ebe73f698cc6400891efe202daab0ff3875b16e5ed374514d7279c2cdb13e22fc51e93c4e19f64e749e9144d433c4f19e6f9749ca3bebd92d085f943efc11
SSDEEP 384:SiFszsNh8TUNTUlIlAl1/ah2kM8YyEXWZbOObjI9G6w7F:ZFQ0wgqMHMgb29MF
TLSH
T17C825B379C688D7BAEA39A51F54B32139EF1417BCB896B94E7DC5B0C01DB1AC0306D1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 a3437c5dfe9d83ce1395ad1b89d829fe4f213ac479e15a16a6594778515b0bbb
MD5 ee77c375d3a069fd5915bfab2e2a24cf
SHA1 4ab5e597cd63ee09783824fdd7dee5ad1aca83fc
SHA512 40f8fd48a71cbebcdd5d0aafaa72f1c214b97bd08b69fcc79a23f5b0a4bacc3fdb7026abebc9051a5b6311bff776814d18b2bb2a4c72dfcd5593520e8bbebdff
SSDEEP 192:u1LsN/AQa1BYmt4QmiU1gup4k03tjzorYbraEXH6FJLIJq2OOZljYRHKKGn6w81Y:qsN/Al1/ah2kM8YyEXWObOObjI9G6w7F
TLSH
T148727C36AC385D7B99E3E561F04B36235EF4816BDB8C2F84D6EC5B0C05DB5AC530682A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 1d9deaf294e0ed23cc944ff745d3cf104636ca306246160fdf5c6c50ea20b8e9
MD5 6d75a32bb580a2564f9f97ef09c4da99
SHA1 9790835e7a74dcf07cfc4fc88f2c0b9a8ff2c41d
SHA512 d70dd7ecbab3770903e54ccf84cfb109c83d6eecedd4cb9f434f1406040ff08fe61ab13cc0e8bd035f1ad959f1ddb7828a26847ddb403a394adbf467a0fdd7d4
SSDEEP 192:gONS6kDfQmiUybAZ903tjzorYbracQiIzU6:gONS6ghxZ9M8YyKiU6
TLSH
T18802D9356C782CBB8EF3AE49B44B27275FE5112BEA952F84DAE81B1C00D765C1346837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f30ab9971d94578b68c711952d455ba8e8bd4820e91145f89a1579ae3e1b69bc
MD5 9aae9211ce2b2aef7cc047b34807231a
SHA1 ce882155f2bed85cc446e192b8c51bd083fad60a
SHA512 7f3bf1931b8355563e9d0e5ecaaf31b74457f73e21975cc291c0ddb0f2c51bc665d178bda25c1773c80057df0fab8802a60a3e6febfc21aab1320c2749af054a
SSDEEP 192:8ONq6ksQmiUy3Ai903tjzorYbraEXH6FRcRJq2U6:8ONq6p9i9M8YyEXW2bU6
TLSH
T1E4121B36A8786C7B5DE3A955B04732235EA5412BEF897F80DAEC1B1C00DF65C134AC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 b4dce69fbac43ef7fa66d5913169f9af9239ba14f258cf95a0d31f0868e7b09e
MD5 d4895372ba2dd584d75b5bb03d5a44d8
SHA1 840a9db99107a029d31b83284af994ba25b54429
SHA512 61561889c8b80c14ad72d22fa9b6626512619edd4e3b05a9bbfc43318779960521075b80aac0f5f7937d81e1faabbdfdc4037365d3f30d86ca3450ae73cf383e
TLSH
T155410C58B7FA1144B3776E5AABF7A86D447ABD772F07D49D00110D4E0623A01C9B2737
MD5 SHA1 SHA512 TLSH

Submit Download