hxxps://ywbaqr5i[.]emltrk[.]com/v2/ywbaqr5i?d=[UNIQUE]

Analysis

user interaction
yes
max time kernel
148s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/07/2026, 04:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://ywbaqr5i.emltrk.com/v2/ywbaqr5i?d=[UNIQUE]
Sample260722-e1kadsdj5w

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4628	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134291678840710638"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{C5321E59-1C83-454C-A173-1BD8C7D6BCA6}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3876	msedge.exe
3876	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe
1144	msedge.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 1144 wrote to memory of 3712	1144	msedge.exe	85
PID 1144 wrote to memory of 4628	1144	msedge.exe	86
PID 1144 wrote to memory of 4836	1144	msedge.exe	87
PID 1144 wrote to memory of 4836	1144	msedge.exe	87
PID 1144 wrote to memory of 4836	1144	msedge.exe	87
PID 1144 wrote to memory of 4632	1144	msedge.exe	88
PID 1144 wrote to memory of 4632	1144	msedge.exe	88
PID 1144 wrote to memory of 3828	1144	msedge.exe	89
PID 1144 wrote to memory of 3284	1144	msedge.exe	90
PID 1144 wrote to memory of 3828	1144	msedge.exe	89
PID 1144 wrote to memory of 3828	1144	msedge.exe	89
PID 1144 wrote to memory of 3284	1144	msedge.exe	90
PID 1144 wrote to memory of 3284	1144	msedge.exe	90
PID 1144 wrote to memory of 2980	1144	msedge.exe	92
PID 1144 wrote to memory of 3504	1144	msedge.exe	93
PID 1144 wrote to memory of 2980	1144	msedge.exe	92
PID 1144 wrote to memory of 2980	1144	msedge.exe	92
PID 1144 wrote to memory of 3504	1144	msedge.exe	93
PID 1144 wrote to memory of 3504	1144	msedge.exe	93
PID 1144 wrote to memory of 4768	1144	msedge.exe	97
PID 1144 wrote to memory of 4768	1144	msedge.exe	97
PID 1144 wrote to memory of 5048	1144	msedge.exe	98
PID 1144 wrote to memory of 5048	1144	msedge.exe	98
PID 1144 wrote to memory of 4356	1144	msedge.exe	100
PID 1144 wrote to memory of 1296	1144	msedge.exe	105
PID 1144 wrote to memory of 3896	1144	msedge.exe	106
PID 1144 wrote to memory of 4264	1144	msedge.exe	107
PID 1144 wrote to memory of 1928	1144	msedge.exe	108
PID 1144 wrote to memory of 1928	1144	msedge.exe	108
PID 1144 wrote to memory of 1928	1144	msedge.exe	108
PID 1144 wrote to memory of 3628	1144	msedge.exe	109
PID 1144 wrote to memory of 3628	1144	msedge.exe	109
PID 1144 wrote to memory of 3628	1144	msedge.exe	109
PID 1144 wrote to memory of 4212	1144	msedge.exe	112
PID 1144 wrote to memory of 4212	1144	msedge.exe	112
PID 1144 wrote to memory of 4212	1144	msedge.exe	112
PID 1144 wrote to memory of 1976	1144	msedge.exe	115
PID 1144 wrote to memory of 1976	1144	msedge.exe	115
PID 1144 wrote to memory of 3384	1144	msedge.exe	119
PID 1144 wrote to memory of 3384	1144	msedge.exe	119
PID 1144 wrote to memory of 3384	1144	msedge.exe	119
PID 1144 wrote to memory of 3816	1144	msedge.exe	120
PID 1144 wrote to memory of 3816	1144	msedge.exe	120
PID 1144 wrote to memory of 3816	1144	msedge.exe	120
PID 1144 wrote to memory of 3876	1144	msedge.exe	121
PID 1144 wrote to memory of 788	1144	msedge.exe	122
PID 1144 wrote to memory of 788	1144	msedge.exe	122
PID 1144 wrote to memory of 788	1144	msedge.exe	122

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://ywbaqr5i.emltrk.com/v2/ywbaqr5i?d=[UNIQUE]
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b0,0x7ff81128c188,0x7ff81128c194,0x7ff81128c1a0
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,10869868679807715942,3352267779337653573,524288 --field-trial-handle=2720,i,11099366786324320912,16641433635617418163,262144 --variations-seed-version --mojo-platform-channel-handle=2760 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1756,i,1568075731553498750,14836332911686136370,262144 --field-trial-handle=2720,i,11099366786324320912,16641433635617418163,262144 --variations-seed-version --mojo-platform-channel-handle=2716 /prefetch:2
  2⤵
  PID:4836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2280,i,14453952921864466342,6235706473436928104,524288 --field-trial-handle=2720,i,11099366786324320912,16641433635617418163,262144 --variations-seed-version --mojo-platform-channel-handle=2784 /prefetch:8
  2⤵
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,13777149858585703902,9123853843594604027,2097152 --field-trial-handle=2720,i,11099366786324320912,16641433635617418163,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,16094306902169653102,1303252193556123816,2097152 --field-trial-handle=2720,i,11099366786324320912,16641433635617418163,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4160,i,12621174213399819054,588284600881014612,2097152 --field-trial-handle=2720,i,11099366786324320912,16641433635617418163,262144 --variations-seed-version --mojo-platform-channel-handle=4156 /prefetch:1
  2⤵
  PID:2980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4220,i,11701072673232376905,5820122023844918255,2097152 --field-trial-handle=2720,i,11099366786324320912,16641433635617418163,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:2
  2⤵
  PID:3504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,8083328741625399614,829016985786586454,524288 --field-trial-handle=2720,i,11099366786324320912,16641433635617418163,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,1609971406387631697,12713425554897223100,524288 --field-trial-handle=2720,i,11099366786324320912,16641433635617418163,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,5515447573379963230,17640554740358204460,524288 --field-trial-handle=2720,i,11099366786324320912,16641433635617418163,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,5515447573379963230,17640554740358204460,524288 --field-trial-handle=2720,i,11099366786324320912,16641433635617418163,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4216,i,8019051093641648533,13498130137165923502,524288 --field-trial-handle=2720,i,11099366786324320912,16641433635617418163,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:8
  2⤵
  PID:1296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4256,i,927236112710944425,4029731688906790369,524288 --field-trial-handle=2720,i,11099366786324320912,16641433635617418163,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:8
  2⤵
  PID:3896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4212,i,11698233623318997540,9644493846374138610,524288 --field-trial-handle=2720,i,11099366786324320912,16641433635617418163,262144 --variations-seed-version --mojo-platform-channel-handle=4804 /prefetch:8
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4212,i,17041178471028423404,6791512007479477523,2097152 --field-trial-handle=2720,i,11099366786324320912,16641433635617418163,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3720,i,1535946626309930631,13197737242635551350,2097152 --field-trial-handle=2720,i,11099366786324320912,16641433635617418163,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:1
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5672,i,13575337444177796128,3838340789834927578,2097152 --field-trial-handle=2720,i,11099366786324320912,16641433635617418163,262144 --variations-seed-version --mojo-platform-channel-handle=5024 /prefetch:1
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3588,i,1623874698742659981,7814740003013219697,524288 --field-trial-handle=2720,i,11099366786324320912,16641433635617418163,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:8
  2⤵
  PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=3748,i,12228198248990251594,9831968875241876166,2097152 --field-trial-handle=2720,i,11099366786324320912,16641433635617418163,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:1
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5740,i,7271447622529713401,11050910541354083396,2097152 --field-trial-handle=2720,i,11099366786324320912,16641433635617418163,262144 --variations-seed-version --mojo-platform-channel-handle=6684 /prefetch:1
  2⤵
  PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6788,i,8945247055297898360,9804541840388821472,262144 --field-trial-handle=2720,i,11099366786324320912,16641433635617418163,262144 --variations-seed-version --mojo-platform-channel-handle=756 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6832,i,3651723432390709959,12834295416456940606,2097152 --field-trial-handle=2720,i,11099366786324320912,16641433635617418163,262144 --variations-seed-version --mojo-platform-channel-handle=6844 /prefetch:1
  2⤵
  PID:788

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4008

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

263d29af-0de2-4472-8a77-cd6c68e42c28.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\263d29af-0de2-4472-8a77-cd6c68e42c28.tmp
Size 12KB
SHA256 f1397179373fcc6fe256393b87fc4fa518bc64ae62430041da0cbdcee118ac38
MD5 f96aaacecdb06c603696cb3a41513641
SHA1 cee4cbe14df8bcfb280a08c16c72581d414b7e0e
SHA512 b216416011dc1239a6427a29ba116d02d28030c9af7fcb6b0328b4259b44cb05f02f4ca0e7cd9b8cfb8bfa63dddc346af200e06c96a06dc689927fcee27df29a
SSDEEP 192:uZNsXcsN97Qrb8MZ3+M7lEtQmiU1Yq+8BMTFp+FdLXKxzSJrb8D1wPqe5l:MacsN97gf7Gr5+2ldLKoJrAwF5l
TLSH
T1BD423A76B8748C2B69A3B686F54A37135FF0916BDBC42F54E6ED6F0C01CA6AC1307816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bba2e49c11cb10e1da3782e96a0839de38ec558ccceb0d68515b04792179f852
MD5 34d661b06bc0857903247c15b32b3124
SHA1 72b12aeb58848c0b8474acb525b5e3c41cf32367
SHA512 ff623932c1d85ab3c9cf10c993d26b94c5e1d9968c6a6f9a48925137edcf7379ba3bc8d216e7fc052000ec59dab883f4b498f2262f7941a46d3328c62092e788
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7U:fwUQC5VwBIiElEd2K57P7U
TLSH
T1E0B3A931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6d0f88884e23b1418c456620b79662feebdfd970ca9325ba2981c94b3b0f0b2f
MD5 7060eae8ec426d15de2849b1f7d261b4
SHA1 b252d90b9d7050d0b9b7c03141d9d3b7cae404ac
SHA512 8791005fae20dc1dc5dc5b0086efe814e0b1e36781ef1931cc1fc699fc4cb34d62ab3f9a83f4967824f3bb71aef6adc6ad457ab7a6addcba99f9e9b473eabb4d
TLSH
T118D01222BE08A415E65BA271A502C7141F5954A124938651E224D86CD9F84D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4d517b88a0fb88494276c126764235de9ee52961c86cc4d3abaf517b10a649a8
MD5 dde9ea8dd9c7e315ef614ab3476af02c
SHA1 e03e201e89770d15b4040d579c2cce8684959a2c
SHA512 410e016336529d709de957d44e67238e4f6592b9ce6646395a9e45ce592e7810b4cb6b1b6df5d8b26875a6aa235b77d41c0983ccc055556f8b8c02224093fdd1
TLSH
T16DD012227E08A415E65BA271A502C7141F5954A124938651E224D86CC9F94D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 c3b243ca194bc13bc69b8cf9ce19d81c9b443a4dcdc0a1052bf23bb0b26f7c4e
MD5 348c8ffc4fca308bbc22fd57e6813e93
SHA1 e718b64f4a252e7cb1d4dfbe0b961db03326eb0e
SHA512 fa9c08596dfb5378ae2e31b466676eebcb81bb6b8e8242fa391aaee885b5cb437225bad515e7a861eb76bf7cf8b3ec249b9b206b8f19ba41c950c2a9f9f97be8
TLSH
T1B28150F43891076EFB300271ABED152174347AD8F0077FE62264A836590E7EDBC6A42B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 812ca04e4eb88be71f2b09f1f46d2ac7354e112d271bf76cf10bec91aeb034b0
MD5 20fde1e755aa3189a025dd1c3d40a140
SHA1 4d1290f7f858993b1ea9a2b1e30a468ccd3b5378
SHA512 a242dd651b95499827c8b92009a89bed61f9014427c9e25c6bf12f8446ac29140faeb977997bb8f40d8bc99b5382c7332aac0ca9eb54d2ffcfbc6075c088feef
TLSH
T1B08150F43881072EF7300271A7ED152174347AD8F0037FE62264A832580E7EDBC5902B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 5d1d114d1744913f07d4cf1d58a5eae5aa7cb8e03b9594c9644699ccb856a4d1
MD5 128bc21fe667df0f84038a026b10dc4c
SHA1 266b2fd38fb7aee633e3e38111f27205f04f9396
SHA512 0b20180d22257ff6098e22bcc6bbf4dc219a35951be4bd752280770a52def7200e84ead38c481e0b8071e3b39a013e9cecc9028daeb31514c0f84e854bf231e6
TLSH
T1FF814DF438511B2EF7300171ABEE162175347AD9F0077FE62264A832581E7EDBC2A02B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 1b70b006d1576e297bf8842991ca2162fe48c0ab56009d8779ee61201f53b8c9
MD5 a81b25391ebd29663b1e9c9c76fa8674
SHA1 519f7279a26a7bc55ead34ca56f330e79f2c5098
SHA512 5bb72d1ac7ab77499f3b873fbba91cec5d82a4da25672c80bb820b132b2618980eb103cd7da94ccf6cb74ff2b881766733e2f21b769f88d264573f643ab6c673
TLSH
T1E57160F431111B7DF3300271ABEE02217539BAD9F4477FAA1060A936590DBED7C2842B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5867fc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5867fc.TMP
Size 3KB
SHA256 2316eb4e5b640b8741e5c5ae94a864778493f0fdd5255c71e56d9fb3259c81bd
MD5 3a98395f609944eb7e2b9d7686c0838f
SHA1 7ea319e593ac8d94d4488c97cba17c3f240e9787
SHA512 7af7a6fdb16c3cde95e0bdc8842fc9974f02481a01ca9dda775a7f1cf7b86a7c6454e3761510b37a1a67f3638937a0e5e03e58450ff9b06759e2a0a391ad1326
TLSH
T16A7160F431111B7DF3300271ABEE02257539BAD9F4477FAA1064A836590DBED7C2802B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 bd05a12431dc3ce8ea50de0eabf72eed0befafff7f31a303b888e3030f27faa4
MD5 c41800292e3ea2fd363a4ca499b39fb8
SHA1 9e8eba5056f838239cfbd8c93ac1aba4bc9fc375
SHA512 9104b6f942d27718961422cf00747850b01b8aa90d542313aeb75fcc0b4fe3405325d0fdc75446d93c5b736a2f386f2173f6b517b54fc5df2baf25953b6bbd85
TLSH
T1A5115BF383B1956E8A1196F09A14EE2BDE2D0516471C7C6586D0BF27C7F3476E00265B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 4c848259acf6ca78c403733a3bedb6d816bec578f3ae813f3d3f74f6e9ecd6ab
MD5 70e9b1d9ba529f472e68859065665296
SHA1 03c126a7027d284fb1a3273e9e512f3646732f4a
SHA512 0894dbd76e425cf050760576fd086989f0ba6c980fef9a3b5f06a8ad6a066604b546c7512c26cf43a741fd714b30a12327d8394ca5684759abacf67937a243db
TLSH
T1A34179F747B1956E8E1096F09A18EE2FDF2C0216475C78658AD0BE33D7B3072E00265B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 eeb113a81293371601d0a7dd22c8ec5674f6d1b489f7059841eac2e75ad42a01
MD5 e69c2901eeffda0201cceefc84085b09
SHA1 defd49e198faf9f8d8ebf4671d4f9d87d4e670aa
SHA512 8b623be910fcc5633cfad5562d71e0c29634b834596c8217ab08fc4a436766b3bc82f7ab3ee78edc8393fbbc2d716041d1f5e395ffc9dbde5d4327515b2a4c75
SSDEEP 192:sxZYv/yM/jK1Ml8UQmBky/f0sDwfJJS1V4IdpDqNSHEc6+WNQ/Ez/YvJLyXhKIga:sxZYv7qVy/f0sD6TS5dH+F/JXoa
TLSH
T1DE52E716AA345977CCDBD60AF941BB53E6F54472E2901E44AAFCDA0C00E6BED6207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 9fdf086da49ed25776f7d1d7bbf7a39f3bf4a673d6025d550b38103989319946
MD5 a8593fd08a6e167146920ba4e07ff06e
SHA1 af752a5d3f732a68c873d4df306fedd0dc2eb880
SHA512 f08d53ec3b597cd87c462cfac35ead919998e9d1e413043c8fb568da0d77769d5df93c94a39bd12b2b2d9dd7759286408543025091748b1d300e453d67c16616
SSDEEP 192:sxZY2/yM/jK1Ml8Mky/f0s6fJJlwV4IdpJHW6+WNGYvxsywhKIgrJ:sxZY25My/f0swTl2JHbGUwo9
TLSH
T17242F816AB349977CCCBD209FA41BF53D6F94472A2901E44A9FCDA0C04E6AED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 d08764883e1647ef6ecb31f5a680ee246ab01dbf8b4c39081c6c926b229ad62d
MD5 5fc02d402fb78ac6a61612a6d33d2a0c
SHA1 2d1254ee1070172574b63cc107bfe51c7f9265d5
SHA512 ce9cd5cf6abf989aea6b6577d97317e7f8f94361d28b3f73167f158c26f9be22839292348267e4b86054689cf4bfa54f9aa2faadf81ec03ddbbaa1fad288ab54
SSDEEP 192:sxZYv/yM/jK1Ml8Mky/f0sDwfJJS1V4Idpo9HEE6+WNoEz/Yv/cywhKIg5sJ:sxZYv7My/f0sD6TS50H+n/Mwoa
TLSH
T11F52D716AB345977CCDBD609FA41BB53D6F54472E2901E44AAFCDA0C00E6BED620782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 8f5dd61ac58507e4022748a1c8c8c13600ff6a665afd49bebdacb5bae2fb427a
MD5 b3fdd43191934e33b71fd730e0969d6c
SHA1 70acfb93257683870cf6defd4630f07a6791b622
SHA512 6e70add8dbe23e11715e6e23915a773892250731a48ec470cd908d60358e1ae78a601fedfb7170c225d7d35d37877f1172dd7f6693d63420f7bf5b8d42752119
SSDEEP 768:TPseJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0ppIroRE:TPseJ3xWvhfynu1jaVcL88pzm
TLSH
T1D6D20B2B280CCB7E4F844E6DEC266F966EE801CB97984D5487EA884C03C77EB51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 42c4c49a0b88b2f7b63da92248b4a521b215281acdd621a397dc326cfcf4f68a
MD5 a4cea58753d1e70a88a8d56789a6378a
SHA1 197eb21fbd2efc0ef9c434f432ea555ecf7ac342
SHA512 85de25aef2eadd497c02b9235e3d27a8a00627d9736e9bd5c663ef6d10c01de3b73e116632d647926dee7bf55028d6c9570e554393bc48f1c5f09b30e3b2ab3b
SSDEEP 24:KdxwLfxwyxwRxwIaxwNdxwBxwhxwx4xwlxwB+xwsIjxwdxwxKixwOhaxwzxwx1EI:KYHIhKggkXyBcIHK5W8Ty95I5KSEcK
TLSH
T14B913312347B12023C7D254DA6A195368E4331E375ACB4AF7FF800A51E66E224EFE8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 fee75de7c93344fde7dd50a5d7fcfa5d178f5fb0d62d2c664db2afa9ba544a79
MD5 248f020dfa2df0def34463181148ea12
SHA1 1c3c69002f765d8855420c9fdc0f6157d4e9bfa1
SHA512 3e4c8d8f5820598aa10ba7dc4d026b7b8aeb6eb26f865cc993a2f13900a64825f157ca1f202ebf4c145788017a71835e873b1daaeb06f3c600c42ce3e7c32a00
SSDEEP 192:uJMLsN94Qrb8MZ3+M7lE0QmiU1GqK4MTFp+FdLXKxzSJrB8z1wPqeUMZ:mqsN94gf7GE7VldLKoJrmwFUMZ
TLSH
T177422A72AC749C2769A3B581F44B37135FF0816BDBC42B94E6ED6F1C01DA66C130A916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 17KB
SHA256 683b68e3e2ed9cae67bda524e4643eb119527d0724f8a3941915ab3eb78fa960
MD5 14fff21e2ce5b2caffa6e439983fa65a
SHA1 3f55815b8dd62bee464d03fd9101e7d96797ed62
SHA512 0e624afd7db2d5dab40f5d3f59b10a68368413ecea6c810e78904b250fb46d0449d096eb0306132f7b71ea5a00d2cfe424f0b50cf14fc7d3bebe61fa08632528
SSDEEP 192:uZNsXcsN87Qrb8MZ3+M7lEtQmiU1jIIeaq+8BMTFp+FdLXKxzSJrf8U1wPqe5l:MacsN87gf7GrVIIeB+2ldLKoJrnwF5l
TLSH
T1B582A3F568E74836D59EA343A33E2E135EBCC067B6802A54B7D85B0CCC8527FD306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 6ffac7a6d1f1981964231f99866a7b3b40bfd4fe77cda236769eccb3ff946e14
MD5 4e3b29614588855b0bf2d7ad3130e7f5
SHA1 870d923c1cb96d5435ee73de4e3ff6880c318590
SHA512 dcc51f7a38d0837958897a66df23e88847d4531496a961aa6dac70b2ff70e573abe03e434fbbe95eb40b3bac18c4bffc2e8e6d8ac2b1e0792cf3c54ca3f03560
SSDEEP 192:HONo6vMqPQmiUy/nnhTFp+FdLXKxzSJro80IwPqeU/u:HONo6UqR2nOdLKoJrtwFU/u
TLSH
T1A9121B32B8649C2B6D93B585F48A37175EF0D26BEAC56B50FADC3F1C01DA66C1306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 9866d30b59150b2a2ec83650669c579fb2cc207ac24de9de7a2ada1fdc36b14f
MD5 5eb3d6aa3db9d29a821f2b7fec4c2c10
SHA1 2a52c4480b8fe849cf83374dacceccda0ff33487
SHA512 9a877145db40cd300b054740f224041b1032bb9443244966e4ea1919cf4439453e253d82c7f69e3a9ba60fd48f6b8e3be16abc7240023feafdf940caef871f1c
SSDEEP 192:u7MLsN97Qrb8MZ3+M7lE0QmiU1GqK4MTFp+FdLXKxzSJrB8z1wPqe5l:UqsN97gf7GE7VldLKoJrmwF5l
TLSH
T19D423A72BC748D2769A3B582F14A37135FF0C16BDAC42F54E6ED6F1C01CA6AC130A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 fc5be1846846738b8cb37b32052e7974e52d83010c2c3ed1037b8f0cbaa0e824
MD5 81ac939de4337f42795f8a983874a712
SHA1 7347cdbb3e8e62e1e9d9f31cbaa50171c50cbe4f
SHA512 aa050c414f1c856d98ea5d999c0476c11a74bc8a2a27ec1999ccb4d2a315413c81899a07fb7b400d69a520e7ed42103cb3aa5dc8a8a0dc4d86ae134d755ca126
SSDEEP 192:lON76vMtPQmiUyinThTFp+FdLXKV847wLFU/u:lON76UtRhTOdLK1w5U/u
TLSH
T119020935BC785C6B9AA3BD86F58A27171FE4216BE5D05B54EAE82F1C00D765C1303826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VariationsSeedV1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsSeedV1
Size 2KB
SHA256 f4b258a392de88663c606f4638a9ef5dad2172976da05f679636a73b3c41de03
MD5 7b75869e8c01163f519211b00cf6a45e
SHA1 9e8f402e8a1462314899d0311b4c992b1333e917
SHA512 f2d742f08aa222f15a8a1c47a6066cd371c5c9655d44839f39fd04e6a626f092678c33aea6b298d10bf0b5a4e5aa5cb5ae9999b2576b7a7d76524b1d5d2a6b19
TLSH
T1BE515C0330840AAF38D80C1159CA4DD3EA7244F6DB59BDDAE0EA7D5FC2244C1482B276
MD5 SHA1 SHA512 TLSH

Submit Download

659e299a-ebd4-4324-b15e-4c33c2f876d6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\659e299a-ebd4-4324-b15e-4c33c2f876d6.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 0a4980a982f71177db2ddd76361887bc4a8c2d604e8f379e7dfec3dbdba3d276
MD5 d053728e4b758e08c5e37c1935dac4d4
SHA1 4d1472a3ade766da07dddf691a29ee244cff4692
SHA512 ed640d7c8de2089e58e8374729c72d0703129f4cebd00bfd9a5284ab0b7761f909b852e38b7235b8f37253d6b697efeba64b7f94638baf6ad14d4ff4b4859e8b
TLSH
T107414859A6F90108B3B36F56ABFA786E887B79772F06D45D10010E4F0622A40C9B1B37
MD5 SHA1 SHA512 TLSH

Submit Download