dc2878d9bf6ef5fca45737536272a7a1877e0c6f89cb9578cb0f956781102986

Analysis

max time kernel
598s
max time network
512s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
20/07/2026, 19:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LICENSES.chromium.html
Size 9.0MB
Sample260720-x14cdacy8m
SHA256 dc2878d9bf6ef5fca45737536272a7a1877e0c6f89cb9578cb0f956781102986
MD5 11ee9d008e924e19b33e0b45fdf145df
SHA1 140773241b15513e9d7a7aff4d1c1d8f7e0b7e41
SHA512 4acd065ffee81972fb1cfbe11507aab75c883aa94e359f3c455f87813925bb2d3416ce440561b430d6dedcc2f566d5cb74de139e181da68507ad36e69a672662
SSDEEP 24576:h+QQf6Ox6x5n1nZwReXe1Gmf36k6T6W6r656+eGj/dBIp+:oABeGLp
TLSH
T15796A52F7B48037306C642627B8B65CAF21E903F3B561A54345CD1681F6BA2983FF6D9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2300	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134290491434027929"	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2058276091-3280583803-376660292-1000\{920A65E7-9615-4E8C-A9E2-DA9F8CB100FA}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4376	msedge.exe
4376	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe
1164	msedge.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 1164 wrote to memory of 3380	1164	msedge.exe	84
PID 1164 wrote to memory of 2300	1164	msedge.exe	85
PID 1164 wrote to memory of 3348	1164	msedge.exe	86
PID 1164 wrote to memory of 3348	1164	msedge.exe	86
PID 1164 wrote to memory of 3348	1164	msedge.exe	86
PID 1164 wrote to memory of 3652	1164	msedge.exe	87
PID 1164 wrote to memory of 3652	1164	msedge.exe	87
PID 1164 wrote to memory of 1776	1164	msedge.exe	88
PID 1164 wrote to memory of 1776	1164	msedge.exe	88
PID 1164 wrote to memory of 1776	1164	msedge.exe	88
PID 1164 wrote to memory of 3268	1164	msedge.exe	89
PID 1164 wrote to memory of 3268	1164	msedge.exe	89
PID 1164 wrote to memory of 3268	1164	msedge.exe	89
PID 1164 wrote to memory of 2496	1164	msedge.exe	90
PID 1164 wrote to memory of 2496	1164	msedge.exe	90
PID 1164 wrote to memory of 2496	1164	msedge.exe	90
PID 1164 wrote to memory of 4596	1164	msedge.exe	91
PID 1164 wrote to memory of 4596	1164	msedge.exe	91
PID 1164 wrote to memory of 4596	1164	msedge.exe	91
PID 1164 wrote to memory of 2088	1164	msedge.exe	98
PID 1164 wrote to memory of 2088	1164	msedge.exe	98
PID 1164 wrote to memory of 2748	1164	msedge.exe	99
PID 1164 wrote to memory of 2748	1164	msedge.exe	99
PID 1164 wrote to memory of 3860	1164	msedge.exe	101
PID 1164 wrote to memory of 4620	1164	msedge.exe	108
PID 1164 wrote to memory of 1380	1164	msedge.exe	109
PID 1164 wrote to memory of 4600	1164	msedge.exe	110
PID 1164 wrote to memory of 3572	1164	msedge.exe	111
PID 1164 wrote to memory of 3572	1164	msedge.exe	111
PID 1164 wrote to memory of 4376	1164	msedge.exe	112
PID 1164 wrote to memory of 4724	1164	msedge.exe	113
PID 1164 wrote to memory of 4724	1164	msedge.exe	113
PID 1164 wrote to memory of 2540	1164	msedge.exe	114
PID 1164 wrote to memory of 2540	1164	msedge.exe	114
PID 1164 wrote to memory of 2004	1164	msedge.exe	115
PID 1164 wrote to memory of 2004	1164	msedge.exe	115
PID 1164 wrote to memory of 4292	1164	msedge.exe	116
PID 1164 wrote to memory of 4292	1164	msedge.exe	116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffe6733c188,0x7ffe6733c194,0x7ffe6733c1a0
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1804,i,1922275041643599592,15669759176171303819,524288 --field-trial-handle=2956,i,12124604626132539666,2180371996931563091,262144 --variations-seed-version --mojo-platform-channel-handle=3032 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,11386090991384976452,6922114691058857852,262144 --field-trial-handle=2956,i,12124604626132539666,2180371996931563091,262144 --variations-seed-version --mojo-platform-channel-handle=2920 /prefetch:2
  2⤵
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2304,i,12469128518402405909,11495806824717830201,524288 --field-trial-handle=2956,i,12124604626132539666,2180371996931563091,262144 --variations-seed-version --mojo-platform-channel-handle=3056 /prefetch:8
  2⤵
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3408,i,17672222686114691086,10695477767449057799,2097152 --field-trial-handle=2956,i,12124604626132539666,2180371996931563091,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3420,i,16200666751445011995,5987227625872479913,2097152 --field-trial-handle=2956,i,12124604626132539666,2180371996931563091,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4128,i,5131709919252201477,10417728170432913772,2097152 --field-trial-handle=2956,i,12124604626132539666,2180371996931563091,262144 --variations-seed-version --mojo-platform-channel-handle=4132 /prefetch:1
  2⤵
  PID:2496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4192,i,15024103519111719671,14359646297123818907,2097152 --field-trial-handle=2956,i,12124604626132539666,2180371996931563091,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:2
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,10171737404139095630,86988509114820899,524288 --field-trial-handle=2956,i,12124604626132539666,2180371996931563091,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  PID:2088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,15307834351779411475,9556202911440591532,524288 --field-trial-handle=2956,i,12124604626132539666,2180371996931563091,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:8
  2⤵
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5700,i,3165681547124659991,15937376853473325070,524288 --field-trial-handle=2956,i,12124604626132539666,2180371996931563091,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5700,i,3165681547124659991,15937376853473325070,524288 --field-trial-handle=2956,i,12124604626132539666,2180371996931563091,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  PID:3860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4820,i,15215707970075038876,13097432576962717216,524288 --field-trial-handle=2956,i,12124604626132539666,2180371996931563091,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:8
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4804,i,4506998371979309590,17771950253235590692,524288 --field-trial-handle=2956,i,12124604626132539666,2180371996931563091,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:8
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4808,i,11057963022911788177,16971440310366791710,524288 --field-trial-handle=2956,i,12124604626132539666,2180371996931563091,262144 --variations-seed-version --mojo-platform-channel-handle=3404 /prefetch:8
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5256,i,4446189163543823793,14222200163359394389,524288 --field-trial-handle=2956,i,12124604626132539666,2180371996931563091,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6048,i,17301274178912583548,11992398119641212127,262144 --field-trial-handle=2956,i,12124604626132539666,2180371996931563091,262144 --variations-seed-version --mojo-platform-channel-handle=6200 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5056,i,6224531786709683225,6652160903410471823,524288 --field-trial-handle=2956,i,12124604626132539666,2180371996931563091,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:8
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,16007041511312198757,13996922092424405888,524288 --field-trial-handle=2956,i,12124604626132539666,2180371996931563091,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:8
  2⤵
  PID:2540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5492,i,1856633980146526868,2425317034532599087,524288 --field-trial-handle=2956,i,12124604626132539666,2180371996931563091,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:8
  2⤵
  PID:2004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,11460234421918963481,2511333296192673611,524288 --field-trial-handle=2956,i,12124604626132539666,2180371996931563091,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:8
  2⤵
  PID:4292

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1052

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f581ea565cf0ece39a0cfdc05cae1573d34e8544d3d072c3f0598034de5e42f8
MD5 c80cb3ee13f62b490ae95d8bb68bb8fa
SHA1 a3baa3d078eae3e3de53faaf8b92df67f056d9e2
SHA512 f385ff91fe9914b069144548f6f36759de4228b81878118a49bc5d05a8f3055bf5724ef0be68d53b91691f095dc1736b8d3458eace80a0e31689f3d0c8f3f5eb
TLSH
T168D09B34F75AE445D1074531582C4711D9199DD014A6870B5160D41CABA401C73BF457
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e091ac4f88db5453fb07661c5eb4ebedb553cc507ac11d855633af4bab0e74e5
MD5 2838a244aa4c14dbe7e2001806498b05
SHA1 1bb0bfd8bcc597bb5720c8093ec3d161d4012357
SHA512 6358674a949e5a667206cc69b328000a2144ad81bfbf5a0bb9b6cbf06ade5970c22882481326552ea44f9f58cdb8985b2fbafe455767bbc68818a67d9a6dc41d
TLSH
T160D09B34B75AE445D5074531582C4711D9199DD014A6C70B5160D41C9BA505C73BF457
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 5KB
SHA256 51d3cfc2bb36392f6d81849615bff8e5ad0bcfc4bf4d1c802910f5d3d1297e45
MD5 12ce3a80c1369808973e96c58e825876
SHA1 2a42d52f3276ad7c7e275968d38a7ca6ec06b736
SHA512 e569dc56d84d9290511279435ae69b96076209764bdc5c4bcfc1a1ae5fb6602765c03c97a40c373fb2f5fd5d417bdd671f1f09d1033b031c0e6ccd5786387af4
SSDEEP 96:BmJj1mJ8mJtmJpmJAmJAmJAmJAmJAmJAmJAmJAmJAmJAmJAmJAmJAmJAmJAmJAmU:MjwFI0555555555555555555555lLO
TLSH
T192C1B10243D5D75ECF05608A49B4935C5071370AEBDCF588134E89FE314E99ABAB7AF2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 5KB
SHA256 e71c0ca2bb16fc3b3639d8809fc3667a45ea3ca873487c6522be380334e91b04
MD5 e37ee04111eff84eb9250a22d18b395a
SHA1 870155a2cfb252639aa4dd3f281c2cdf9c76314e
SHA512 cbb74fdb9ea6024bb45621f6bffedef1fd61f8b30d2507f1b2aa537a5326e3564dd82b21f8a55041c49e5d78ed4b9c66d59e67f62bb738d6373ab01c4bc4459e
SSDEEP 96:FmJjUmJAmJJmJbmJWmJWmJWmJWmJWmJWmJWmJWmJWmJWmJWmJWmJWmJ6mJ6mJtmr:gj95Uqjjjjjjjjjjjjj33IIhhhHJLO
TLSH
T111C17A4682E4C79ECF06509A4AA0535C1074370FEBDCE508138D89FF324E59AB6BAAF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 0d3a49ea94139899abb0e7b3efebb2cf9bf3e9880dc81310e869d07c5f12edd5
MD5 abdd1505b5d02ad154e554beab4cc9e4
SHA1 b30a0944d75ded188696b16cc8c7d81be941d109
SHA512 3b917fd129733562441eb0a60e30743dfe89b2d38df3798a36b2ba2513bf74d2984af6126ea403f9d81189b575c4cfc366084d799637ae044d2084732d9c674d
TLSH
T1A071FA5C000619A2E3B22332A6F2969DB77360DEFFD3EE691304617CE51FB51B138469
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58aa35.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58aa35.TMP
Size 3KB
SHA256 73c22efa94393de5512a058873fc0c9488434223b7cee12ce970325b33adcc54
MD5 83f15f9e2cf4376b86c5cd5be1bceb4b
SHA1 c8a5805c0c995793e271a43e1e15290f4cb034aa
SHA512 e8829368cb932cf8cf886d3b67295dec9397afa6d3558b1500d15dbcc5c38491ddb4c9cc2e81b697c82973b0c03e78fb5eb823baf04efe00a0085a4367d24427
TLSH
T1BB71E95C000619A2E3B22332A6F2829DB77360DEFFD3EE691304617CE51FB91B138469
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 966B
SHA256 d62ad1aea623e83e1f306cd325290f2bb66d904502a69d65c74dafb8b660d607
MD5 e13103324a23456bf0e553add82a6968
SHA1 14f614817b572a8cf1766063d262781ac4e82894
SHA512 05d4697b43180ea2f50ebfc0bed805def0f18a79100687042ff186d10441a39f15bb57e3afdd0b2e5f36291030955733ad3349cde390d9c077e98c412cbebf92
TLSH
T1AB119BF383E1829EC91116F05A28EE2BDE2D0502821C7C6985D4EF27C3E3035E002AAB
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 18bf0492d5499818bc0ac6e4da2463ca90d2925bf4069ba74fa7cec4c3ab1970
MD5 79ba4481c03e62f8ecd811cc13a59059
SHA1 7b8b2bcc27a9251918283c5b8db1bba4a8ad1e99
SHA512 5cc92dc5dfc0ac495da507240336bfc6e371044487e6b23449179d2df86e183635b286a0bafc0f3e46c041004935306827680eac6b77909b9e9fc4cdf60ca933
TLSH
T1FB117DF7C3D5896EC90116F06A28AE2BDE1D0605831C7D1A85D4EF1B93E3475E10155F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 dddc3499778e3fc27ffd701917037d5eb5a843e738660cf3b9ef42d945be37be
MD5 70d07065dc870dd49a462d2f8efecaf4
SHA1 82986fff4c7717614d1a8624b2f13488aee8ff7f
SHA512 11911b5e829d09320752042b8032f17d0b268962c97ffab93d42f295873261a13bddd6e03483f1b95b305c732ddd029ca176790bd39ffd0ffbcd8451907ed092
SSDEEP 192:sxZIuxRLwyM/jK1Ml8UQbCkbX/f7DsbEV/kI6LhIdpHIYHW6+WNGYrZZItsLenUr:sxZXuqNr/fnswVci9HbG8Vlh
TLSH
T11552D716AA349977CCDBD209FA41BF53D6F55472D2940E44AAFCCA1C01E6AED231382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 7b0cdf323ad7a7565995d26869c162417bfff29e65eea4266efe67b424efc09e
MD5 4b3af36ffc56db3ac62531f49786341e
SHA1 dcc263d68c97f10ba8f30aa4f86fc1621d966c4d
SHA512 5f87b139712b406acd77d77a632435270c4c850979dce8b1be316a7cac7be0049c6f5c877d2440df7a6d8cdb3827b7c5d41919aee239057ed9b432651e875f24
SSDEEP 192:sxZIuxRLwyM/jK1Ml8MkbX/f7DsEV2I6LhIdpdIYHW6+WNGYrXZIasLenU1IgrJ:sxZXuMr/fnsEV2inHbG2el9
TLSH
T10542E816AA349977CCDBD209FA41BF53D6F51572E2940E44AAFCDA0C00E6AED231381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 bb09a1bca0413cccf45078e98e8ac14b92d0cce58c3da077190b803a0a4525ac
MD5 764e491c7abf0fadfc34db6166b0fb53
SHA1 6342869d496cd9e9aa4eac1a1fb94b3610a967be
SHA512 52fcf38a0dff8010a01153ee0bbdee3617c0d6662f776fbe0db05589422f30577af742f4d701284d71612c33b2405ef49a77be68d3013b7929e6de3a6b8c16ed
SSDEEP 768:ujgL6XeWviSZq8F1+UoAYDCx9Tuqh0VfUC9xbog/OVXJLlZzaRBroWZmT1G8:ujgL6XeWviSZqu1jaSJL7+R6WcG8
TLSH
T154D20A3B680CCB7E4F840E5CED26AF876DD801CB5B984D5447FA494C03C77EA512A49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\57d750f3-c826-47b7-bf25-098068661651\index-dir\temp-index
Size 1KB
SHA256 212018270ea35c788f902a620c5b609822e808e15818ba4a61898b1a7d5db9c4
MD5 39ab95b2b6cd8ed02a520b54282c7673
SHA1 ea38f2c2a7cf482265ac17fedab63d1ad2ba2241
SHA512 80d089f647cdb57d56090a198f80aeb310bd442b983d55bd4d78ea8981366baa4275fbe7de39ed6d115958d0a0f48eb0fac22fef71e5a3780d09df44d8e6e12b
TLSH
T1B121618C4EA09A8FF89645F211B2E5E47370A8DC5B25E3235C3C32322E2334E261B5C8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5cfab3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\57d750f3-c826-47b7-bf25-098068661651\index-dir\the-real-index~RFe5cfab3.TMP
Size 1KB
SHA256 60de8b84e4afae92a23ce1c820bea6400318c0dff65cdf43f1919aabf094aab4
MD5 23b997547920507e323d757267bf956f
SHA1 e019c4f4910a8a32bf6d1ca95ccef8d69a3e3c5e
SHA512 7dfa0187a6132aebbdc1a10ee7414d4223774ce903597697902caedd299a02356c05e4117f8178478be4c742ad3d14133c87ed0cb1bbc4f92414376130822c84
TLSH
T16721148A4AD18A0BF884517B0963B8F8733188009722B393993C62395D25B8E1A4F0C9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 bf851a9e020cb57555780f6cec2304a22f0a79ed06fd469940a04ef82ca58f9c
MD5 5a44c0bea0ffebeb5e71ca23629ef81f
SHA1 2d998cbae31ae9c4d525a6735392915e6fd47b06
SHA512 10da9b57f897b4044ba1171cd8181c7e28d7d8e2fac9734646c8e3a12b30168c6dfb4db553b40048c00163fddfb0851da185f7e9feacbb28b7e0657e514552dc
TLSH
T1BDE0C0B71CDB1A00FDBBD7E724324CA44101B984C548EC0F1025A28352F2318344DCB2
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 91d674bf4c361f22152fb9c1b9d92c586111c6aa42aa4f63109de549c742a295
MD5 9696f0b08b36d969f8c9ac89e8f23958
SHA1 3dfc5ae7025022fe0de69c5c8537e2df5de59df4
SHA512 e6169ccb81d5e01ac16446c08843e5b5d8994b6d3281e32294c65e82126c74db94dbba89256b9019f580722220a7a73b455c26aa7a22b023b029846b010e0be9
SSDEEP 96:KwX+KUs+OUKP6KyesKXqqo0J0u010Z0X0r0n0gz:oGXPHooxyGoCyt
TLSH
T193914801717B029339FF294891A5952B9D8231A73698E46F3FB914B20F27D111EFE9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 1KB
SHA256 797468cad07bb7ed5e21cfa0386d2897a161a2cc4ad1732190645992579ceb55
MD5 449c918621241944b7f893da99c0b387
SHA1 11dfbdd1af2e64df8239340058f2269330a67c02
SHA512 14523a0ffe36c3bb7d6d71bc727c40664878a82f4f696f2ef0afabb98c2f40b965a2a12454e33fee71192f8a4645f9d642eeb7aff7d060e737db67a204e3d29f
TLSH
T1422112C093FE10E79F49A542D1099407F0E1BD5A268DE8B2331D54F44F858160A7FF69
MD5 SHA1 SHA512 TLSH

Submit Download

d3abf9ee-b724-49ce-bdfb-8a61bfdc6a2a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\d3abf9ee-b724-49ce-bdfb-8a61bfdc6a2a.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 4395e4cf34b09df37fb49216933c21a8824b707afff73cfee7848d916bc959d7
MD5 a1b98c93c2a25393e08226b77432a87b
SHA1 d47c882151a9eeb3db47ab2c7ba3ac57e9b6e0de
SHA512 28085ccd305fa5d6fab1dd08dbe0083cb04ea68a0c89041ede9544a0e17c3c11a6d61921fb95833c50baeb9a350e93aeb9294694498366382bd701bf53b9bd32
SSDEEP 384:UiF1tNn/s3n9SazsNO8TUNTUlIlksy6g858S9uO8iusVpuwoOObjI9G6w7bp:vF1j+99rwgK8nd1jno29Mbp
TLSH
T1D4A26B3798188D7BADA26F84F54A362B9FF5516BCA803F54E6DC6F0C02CB59C130AD25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 1623e17b93fee6f06c98be09082c0571b932b3ce28f56cb751810080c86c16fc
MD5 6e775a33480fe67aef6e47b55a7f564d
SHA1 f74dc7b14397b7bc4c61fa04fe286719a61512e5
SHA512 9f689bf353f956bed61c3df3c1a5119bc66396483ac98ef23e700007274ea543cb046b332cb6a24442487e58eb4650695fc0ef83193302818c3949c182f02fc8
SSDEEP 384:TtNn/s3n9SfsN+khy6g858S9uO8iusVpuHoOObjI9G6w7bp:Tj+9Uf8nd1jao29Mbp
TLSH
T17A929D37AC294C739DA36A50F44B362B9FF4512B96803F48D6DC7F0C02CA59C630591A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 42b845393bc3fd36ff5e03119c81ad753f7d924816066110fcaacd233914c73f
MD5 155471f908f9206653f0aedb22fb12bd
SHA1 cf99a0ee20793c42fe79d6b47c26a170b35b27a0
SHA512 0f5a8c179d65de148770e5e0110e6d071efb517eada7b612bba00a629208dafafd87296966e57d91ff3ca9d33fd1e33da450818f82b61af868a94740527c4085
SSDEEP 192:YONT6LCWtDQmiUyIbI1ILSuOCz3Sus6WdsEJYAU6:YONT6mg1gImuO8iusVHTU6
TLSH
T10F02C83AA9686C779EB37E44F58737276FB42127A9903F54DAE81F0C01DB64C2306936
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 841ea74f6ebea78ac1b4fd9c2b2972d274abb14958b3a5521b1c0977edc82e69
MD5 1d11fd2ea6c85ecb25af86a91d3f809d
SHA1 62520aa10a67c6b09221cc66a01d7b2b6b21efc0
SHA512 3d3988b8c17b5b7ad6c2895c366b0162935328778b4b61474f9e0f51db2fb08faebae8e780893deabc91a2e98a5dae24166a8e2d0ff2af71abe5e1081d7317bb
SSDEEP 384:1tNn/s3n9SfsN+ksy6g858S9uO8iusVpuHoOObjI9G6w7bp:1j+9UG8nd1jao29Mbp
TLSH
T186928E37AC294C739DA36A54F54B362B9FF4512BD6843F48D6DC7F0C02CA99C630591A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e50fd531bd85c4c3f998a716550c793d10a40c4d8738ce3f48fb1a0069de3eb7
MD5 c705fba27f1ec3f2a36ddff82905d820
SHA1 661ef9623ef6f18ef26459d06f5d50a41345d05c
SHA512 148c74a82c6353a7f8a2b518a5c359e4afb98fae58683b1c44301f9e5c5a8db99de8e0f6f71edccdd82fece52f27b5432ee4b9736395674bd63b1fd05f5dde5e
SSDEEP 192:XUONSa6LCWt6zQmiUyIgI1etLSuOCz3Sus6W+SulGeI/JXqBU6:kONv6mgYzOmuO8iusVpuUoU6
TLSH
T112120B37A428AC679DA27A44F48736175FB55127EE843F44DAEC2F0C02DF59C230A966
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 4c66768912b97c16559f243d628371705f2fd3391b69b242ad99eb695bad8650
MD5 35a10f6e95b2bf87445f674b9dcc4761
SHA1 fd6136062356629edf24a20e13643aab7b1db62f
SHA512 259a30f9732c059cf0c32a3a6719c721613cbcc113c60a0cd7a6d2a3c8f37142847a144d3b24982193e6ff523a59ed2d6674d67d3f61ae3a8b993fe0f36bba64
TLSH
T1C941DC58BAF91148B3B76E56AFF6A85D487BBD372E4AE45E10010E4F4622B40CC71737
MD5 SHA1 SHA512 TLSH

Submit Download