31a55cbb6eff63c24e5476285f26e9845fdf74ba75e1635692c1801016d6efe5

Analysis

user interaction
yes
max time kernel
899s
max time network
731s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 16:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
login.html
Size 67KB
Sample260723-t6nbka1thy
SHA256 31a55cbb6eff63c24e5476285f26e9845fdf74ba75e1635692c1801016d6efe5
MD5 3fec15e1f7454dd69c5f2e900f0937fc
SHA1 54722040e10a00a4a3edb3febfc9287df56aa289
SHA512 1325c07832be4e5115c8ceefa925677b9d4d5b9509057cc59d1beb1367d44c415181aaf577fbf71845e03535ad7451809fa9734e8ef81ec63c3e5fbc2eb7752e
SSDEEP 1536:cUF2R8kI/fMgUeBFv2gnmNSjSWpOhqkEACNfMk6KisMhxrjCuRYfYPUrhnCxag2Y:3F2SXUeBFv2gnmNSjSWpOhqkEACNfMkO
TLSH
T1456344A3BB24F876E84F9BF5E0519504C141AA678A09C9D4F0DCB3B82F587E6AF43543
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2884	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134292984356849386"	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4046655672-1449839301-2197395821-1000\{936C51B8-EFA2-4F13-957E-4F353FEDF09C}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-4046655672-1449839301-2197395821-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1908	msedge.exe
1908	msedge.exe

Suspicious behavior: LoadsDriver 5 IoCs

pid
4
4
4
4
4

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe
4576	msedge.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 4576 wrote to memory of 4120	4576	msedge.exe	89
PID 4576 wrote to memory of 2752	4576	msedge.exe	90
PID 4576 wrote to memory of 2884	4576	msedge.exe	91
PID 4576 wrote to memory of 2752	4576	msedge.exe	90
PID 4576 wrote to memory of 2752	4576	msedge.exe	90
PID 4576 wrote to memory of 1376	4576	msedge.exe	92
PID 4576 wrote to memory of 1376	4576	msedge.exe	92
PID 4576 wrote to memory of 5848	4576	msedge.exe	93
PID 4576 wrote to memory of 5848	4576	msedge.exe	93
PID 4576 wrote to memory of 5848	4576	msedge.exe	93
PID 4576 wrote to memory of 1480	4576	msedge.exe	94
PID 4576 wrote to memory of 1480	4576	msedge.exe	94
PID 4576 wrote to memory of 1480	4576	msedge.exe	94
PID 4576 wrote to memory of 3312	4576	msedge.exe	96
PID 4576 wrote to memory of 3312	4576	msedge.exe	96
PID 4576 wrote to memory of 3312	4576	msedge.exe	96
PID 4576 wrote to memory of 1996	4576	msedge.exe	95
PID 4576 wrote to memory of 1996	4576	msedge.exe	95
PID 4576 wrote to memory of 1996	4576	msedge.exe	95
PID 4576 wrote to memory of 2108	4576	msedge.exe	99
PID 4576 wrote to memory of 2108	4576	msedge.exe	99
PID 4576 wrote to memory of 3740	4576	msedge.exe	100
PID 4576 wrote to memory of 3740	4576	msedge.exe	100
PID 4576 wrote to memory of 4416	4576	msedge.exe	102
PID 4576 wrote to memory of 6008	4576	msedge.exe	105
PID 4576 wrote to memory of 6008	4576	msedge.exe	105
PID 4576 wrote to memory of 6008	4576	msedge.exe	105
PID 4576 wrote to memory of 3512	4576	msedge.exe	107
PID 4576 wrote to memory of 5976	4576	msedge.exe	108
PID 4576 wrote to memory of 6024	4576	msedge.exe	109
PID 4576 wrote to memory of 4496	4576	msedge.exe	110
PID 4576 wrote to memory of 4496	4576	msedge.exe	110
PID 4576 wrote to memory of 1908	4576	msedge.exe	112
PID 4576 wrote to memory of 4904	4576	msedge.exe	113
PID 4576 wrote to memory of 4904	4576	msedge.exe	113
PID 4576 wrote to memory of 3948	4576	msedge.exe	114
PID 4576 wrote to memory of 3948	4576	msedge.exe	114
PID 4576 wrote to memory of 2696	4576	msedge.exe	115
PID 4576 wrote to memory of 2696	4576	msedge.exe	115
PID 4576 wrote to memory of 1980	4576	msedge.exe	116
PID 4576 wrote to memory of 1980	4576	msedge.exe	116
PID 4576 wrote to memory of 4936	4576	msedge.exe	124
PID 4576 wrote to memory of 4936	4576	msedge.exe	124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\login.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2cc,0x7ffa60d6c188,0x7ffa60d6c194,0x7ffa60d6c1a0
  2⤵
  PID:4120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1532,i,249045695140719118,2264611000714668241,262144 --field-trial-handle=2532,i,10255922114902917804,8138332189694279478,262144 --variations-seed-version --mojo-platform-channel-handle=2528 /prefetch:2
  2⤵
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1732,i,2860523285908097604,10659895130268726953,524288 --field-trial-handle=2532,i,10255922114902917804,8138332189694279478,262144 --variations-seed-version --mojo-platform-channel-handle=2560 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2220,i,16851756392365865283,7763446436575986787,524288 --field-trial-handle=2532,i,10255922114902917804,8138332189694279478,262144 --variations-seed-version --mojo-platform-channel-handle=3200 /prefetch:13
  2⤵
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3556,i,12072928125791696294,818283106113286132,2097152 --field-trial-handle=2532,i,10255922114902917804,8138332189694279478,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:5848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3584,i,1168861988821391733,2836762907175299000,2097152 --field-trial-handle=2532,i,10255922114902917804,8138332189694279478,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4304,i,10816223200742490037,3238674745874668142,2097152 --field-trial-handle=2532,i,10255922114902917804,8138332189694279478,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:1
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4372,i,42700635685167109,4931837402110376206,2097152 --field-trial-handle=2532,i,10255922114902917804,8138332189694279478,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:9
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,15037867131583355810,16037550059250286247,524288 --field-trial-handle=2532,i,10255922114902917804,8138332189694279478,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:14
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3824,i,416039798963202110,17418407862771073164,524288 --field-trial-handle=2532,i,10255922114902917804,8138332189694279478,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:14
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6092,i,14954447527297058825,12818076735785287087,524288 --field-trial-handle=2532,i,10255922114902917804,8138332189694279478,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:14
  2⤵
  PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6092,i,14954447527297058825,12818076735785287087,524288 --field-trial-handle=2532,i,10255922114902917804,8138332189694279478,262144 --variations-seed-version --mojo-platform-channel-handle=6108 /prefetch:14
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6156,i,8128222403674479664,6989240765896160648,2097152 --field-trial-handle=2532,i,10255922114902917804,8138332189694279478,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:1
  2⤵
  PID:6008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6104,i,7943991062955470425,13652469886048869717,524288 --field-trial-handle=2532,i,10255922114902917804,8138332189694279478,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:14
  2⤵
  PID:3512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6408,i,16562056422759698215,7991449575604311146,524288 --field-trial-handle=2532,i,10255922114902917804,8138332189694279478,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:14
  2⤵
  PID:5976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6552,i,1273634325510612444,11489919350823419256,524288 --field-trial-handle=2532,i,10255922114902917804,8138332189694279478,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:14
  2⤵
  PID:6024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5484,i,6349687199713554066,10472314240511907843,524288 --field-trial-handle=2532,i,10255922114902917804,8138332189694279478,262144 --variations-seed-version --mojo-platform-channel-handle=5676 /prefetch:14
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=812,i,6235002885839333560,8892578076832742927,262144 --field-trial-handle=2532,i,10255922114902917804,8138332189694279478,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5204,i,12987361226286171210,7790507210012323113,524288 --field-trial-handle=2532,i,10255922114902917804,8138332189694279478,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:14
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6616,i,1439383704017164592,16965001965338924260,524288 --field-trial-handle=2532,i,10255922114902917804,8138332189694279478,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:14
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3212,i,15802200408502824053,10908123976751870247,524288 --field-trial-handle=2532,i,10255922114902917804,8138332189694279478,262144 --variations-seed-version --mojo-platform-channel-handle=6800 /prefetch:14
  2⤵
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6548,i,13389045124205811011,8423738963779075322,524288 --field-trial-handle=2532,i,10255922114902917804,8138332189694279478,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:14
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2340,i,12716686113476311268,13777670099308677308,524288 --field-trial-handle=2532,i,10255922114902917804,8138332189694279478,262144 --variations-seed-version --mojo-platform-channel-handle=2944 /prefetch:14
  2⤵
  PID:4936

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1408

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2132

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5568

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:1092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e35119268ad2455b6ec4314361db946ee09b095b28e62d25bbd7542d6be959b9
MD5 5c633da04aeb5bea485c08ea28f57d24
SHA1 1c5287022e764ef0bb6d895cd993be007ab68eba
SHA512 341697613439896bbdc5bae2e067bf2b52fd4ee959460166157f5fcf5f0647d000c9824a7394abad2ea244ee761164649972236a37dd919e413ac011474bb4b7
TLSH
T12DD09B947B50A50CCC41703229E5535579155461581D45450055F0799C646C246175BF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e75f270f1371188bd7f350113eee1f4d141652add7af8e5f7af0ab47dac6d1f2
MD5 e0e7da4c84e8882b494037c575bd294c
SHA1 04d43c383ac5d232ee362aad151519414dc6db2b
SHA512 70d9ca23de3befb782d3d04a586490c626e7c63ad00fac39b0fd9adeae2c1d8413a5d2474e847fabb4f48bbf1384f1fcd10e67765d21ed94ac67795b274b3c2e
TLSH
T122D09294BB60A90CCC81B0322AE66355BA1598A1182D868900A5F07A9CA8AC246179AF
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 07f83b976d1c82a82d411775ec2685a48c1d5912b020e448087acc71ca2358e5
MD5 c5f46562d47191d5f87bc29ffe2da01c
SHA1 1643f3ae761217357b01c4cb4fe10ef730fec596
SHA512 271e60beca602c8b9acfab7cb3411ece517fa9666f4ed77bc7753fd272c425625452af070ced9493e3c8cb0a96ebb8ce5dedcf79d4b25509cf433ac0c114dba2
TLSH
T123E0268507CDC36EE388744741AC530CD281368B92CA6E3E1B0C98997003680B3A6692
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 e55a2e5e471e5049e95f302bdb151aa97b2dcfbddd74b72dfceade236e95b677
MD5 f60dce12f58ca2c5e4e5e3507bb98444
SHA1 41f56f331cd61941a3128489988681fd766dca2f
SHA512 5b195dd7c1a7b722bdfbc26e7843819d6630cb61307d6ecc830a74b826da4eb1dbc65b3815fae1754b00eabad6305f1196c9f95de43c98142d5fe0c811c51ff5
TLSH
T15BE07DC506C8C22EE3887447416C534CC2C0370BE3CA6BBA371C848872030D4B7EA690
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 2c8c10cef1edad9b2642da1ba16436f6d14108b5492841f0467253f0462d050b
MD5 652cc93d05d3477b9df28d698080a5d8
SHA1 708cab630466ce0c4fd37f14106a640c947dd29d
SHA512 74ec31262a172fd0a02342478c7af7123fbd2ae4469b1438a819b1b86e33dfba72ef10cdca3704e8be091c1448c17d289890273d83edacaeca5f1ee52657848d
TLSH
T180E07D9446C8C22EB348744741FC730CC2803B0BE2C9FD9A170CA5A474031C4B7EE691
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 27de3123b4950295df2226cf4b68c4be1822cd8dfe63267a927436caeb53c9d4
MD5 7547da567e4e302b0bbf98937bbc3814
SHA1 5f726f76a9122c074cf3b6a8eb06b5f6af6a20c5
SHA512 02068a6d8ca5d5395f7a1fc2ad57d85758ffc4dbf77f5bc9b2f1f68c646f0bd49c33a0040913ff24bc1b3ba558a8c5c9acb7913248127f668ec6c9824ad5da3b
TLSH
T1475164A0072B26E1D7F584B271F9A6A9B3F4829901071E29E8027DB47A01FDCD1D162B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe597bbe.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe597bbe.TMP
Size 2KB
SHA256 7d154d8c1edbd3706e6392f112c59ec41064bb5d7de69450ae7d928cb0e92a6d
MD5 4b6c9146f2c1ea05acfac8af400a5cbd
SHA1 569bafd8ff2a12888a3d593830d30a99f256fd2c
SHA512 b475fbea9497726893ef51d06f5a6bf93c5b96f6f11fdf7009340f1d68b8a41c16a873947242c23b6b157bef1f25ba2369ee34cb7eba71bb144c22a23ffc473b
TLSH
T1AD5175A0072B26F1D7F184B271F5B6A9B7F4829901071E29E8027DF47A01FDCD1D162B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 0b2eb169aeef334447a2663d986d666eb46ce4208bc36b5de7645f7fd3dc42c1
MD5 9a272601af55abdcfc89886a760a2385
SHA1 0d4a0f75283e6c7a26f59e15968081f8f2308d8a
SHA512 9bc48f034763fe1edc3d75a5f269fe56dea0982bcb13ebea4c2fff4c1f86e1db25974cc70b838a0d2af465be9e488e2535dc44907ea3dc186e9ae784f67465f2
TLSH
T1C66190F783F4877E9A1196F0AB196E1BCE1D0416432C7C6689E07E2B63F24B1E14169F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 6e8c08b99dfba766196a4e541d053a7ac19547c279fa4b644d027640b950f9d5
MD5 c89ee1874a92acbbfae9c73c282fc7b2
SHA1 b7732941f9d6e5425724c8239e4ca03f14072640
SHA512 efa7f9771b518dba17305d59113c1b234c22882b302890c61f9c9dead775f053393c0450e5c886a8d82aa138140bfd51d9275d5db1b291acbd3e0d70d57de9d7
TLSH
T1DD71BEF783E4877E9A1152F0AB196E1BCE1D0516432C7C5689F0BE2B63F28B1E10169F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 e67a9ec3d906b3286d7781214b069b3cf10e8f20cc71cfc9792199cc26ef0fde
MD5 dc3c7efa086e3be094b59d13c39bdd5a
SHA1 c269ff6af410f1bd1c835523cb1314e7cb7a5211
SHA512 71da2d13c4f7a306203eec05edfcd27137eafd0d73d617ce3bce3a7641345280960cf234301bd82bbe2241d2e443a724f6ae1ccd15911c8f4c10fabc0ff8921f
SSDEEP 192:sxRoRhbe/fQswCKrjDmzoA8p4F/g6+WNIYEBiKTGuIgD1J:sxRoze/fQswCWM/5I4wz
TLSH
T1F332C71A6928A93B9CC7D21DBB65BF53E6F95032A1906F48B7FC860C04E76DD220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 44cb71003b033b76d63431d7506ff57a95e713719a09d8b322e873b1adf4884c
MD5 9fa46b907d3ffe3f6b358c367a250c1d
SHA1 478066e19add76be5b81e69bd073fe164cc229a3
SHA512 07304f4d595a569e3f08420b672e4085799580c3d0d7dd3a8650a79ca3c25a491655852154d24b24d1a930f3bb50932b84249fa6b2939078f989cb4bbb63c36f
SSDEEP 192:sxRHRhbe/fQseCKrjDmzoA8p4F/g6+WNIYEBiKTGuIgIJ:sxRHze/fQseCWM/5I4ws
TLSH
T15C32B6166928A93B9CC7D21DBB65BF53E6F95032A1946F48B7FC860C04E7ADD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 22c670b8a33134ce24852becaf46585371a17f08b4c797503cee39ba0be08159
MD5 844d3f4e051634a0359faf90087cfcd3
SHA1 627883ccf600345a6bd83b1631c50afffc2ffe09
SHA512 3086c39b89e12e74f3b330521d2d221db4d8b0fe888b142f5c3eb6f318784f1f068a9907d03ca350b1ae532df8c56e8f12e8147c93b4e7616dfbbc546ec2493f
SSDEEP 192:sxRoRhbe/fQsw6KKrjDmzoA8p40/g6+WNIYEIiKTGuIgD7J:sxRoze/fQswXWt/5IFwx
TLSH
T1CF42B61A6928993B9CC7D219BB65BF53E2F95032A1916F48B7FC870C04E7ADD220741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 0b00d65026c6adb56e5cfe100993cc53c56042f15b2aed98915f962e22facbdb
MD5 caa1649c27c82b13a4fbb350a1a30b90
SHA1 a7929b17e71437fe2bad7596fa1fd7f0e7621aeb
SHA512 781bf75cac1eb3a7ca4f4c47d4f97942c24a0aef230d63cc677a0286facf8974ebcc2054a3e7a557c36c62cccbe817ca6cb6ae19fc1407d3d39215182c7230d7
SSDEEP 384:0OhQi3gfCtgHZFfeQKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVwY9VHRA5roZCm:0UQi3aWgH7feQ8F1+UoAYDCx9Tuqh0VQ
TLSH
T1F0B2FB2B600DCB7E5F801AADEC196FD76D9802C79A588D8047FE994C03C77FA911A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2661b546-a729-4c56-88c3-40892783a9a3\index-dir\the-real-index
Size 408B
SHA256 b56d16e663b26424d280f3130af159d995be6f062b06db62963a9e79c6d9391a
MD5 880a1a384781de3dce7295d3b5295147
SHA1 e2c3bf73bfca00309e790dca598cf319df73c344
SHA512 ff770c63b17e3f32e48e2768a31abf60094078c3c0d79e4ef55a5a6f264ac9751ccca525cc9273ef82dfe98e3075b5031fae9fc507ff54c62de01e27198b7b12
TLSH
T161E07D999C75A597CA3119BB16362109333B17FE3505AD2F10BE201AA61227C4601749
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5dbcda.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\2661b546-a729-4c56-88c3-40892783a9a3\index-dir\the-real-index~RFe5dbcda.TMP
Size 408B
SHA256 90b21d0b152b2049847736ef02c6a9e368d82c97c3948e3563036c0ed6e3d35c
MD5 cd6a4f322fa67f0faeb6a69ab6ff3fcf
SHA1 3dc50f1d6609fe970f18ea74e15c3065f8b3d4af
SHA512 cc230daa8fa14becdf0ed63696d4c41c3b1dd1eddda94f84f9eb4c8240fba008382643de2c2f390283496cfa36487160c775c11ed948c60ef8577be32e61fdbe
TLSH
T1BFE0EBEF00B0BE12D92699793203702A333F08353115FA2FA0EE240F26213BC8642B06
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 d2ae3a90aaec95ecdde8556ce51b7a9b497bd451e1761afd12b0932e2a9cad4f
MD5 d2251fc6302d05da98948bdd98cd96ae
SHA1 7c82b6c1ae820f6ceb91fdf1106840796caccd7b
SHA512 b5e33d0dfaefca22b8f9d0051787e9e58970a79e1a4a218f16684773984c0bf73ded9bd25dba383b84b01004af9e15466e53d99fec10efebcb0be5eb47632066
TLSH
T18FE0C0BB3DF30440B8ABD3FA25B28851000578A4D645EC8E9159D6D762F23113806C32
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 3fb283096068d75d6bc0a055e38377b685bc30db394bc4a01b32f18a9709319c
MD5 eb23910d089a55dfcb71e67db1b46d60
SHA1 dd6c6d506608f826ce49866dcc74147d691fd4fc
SHA512 e6cf003d4e25116b7d8a9333c3add2b035b924ec37f0e1fcb08bfb91f10afc4ec83d32daaca0cc6fc0f46a7269de5c787395cb8cbe3285baab6caf6882e409a9
SSDEEP 768:Db3yqG3nwDlLtbK48dHeByERRFzjK3YEb9M/:Db3jG3oO48dHSyw/yb+/
TLSH
T12DF2BFB0A8645E734CE7D25A76437717AEF08267C2D8AB9495DDAB0E45834EC0707C2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 7c09a581f6c7bb9c078361bcb4045409a0bb2cc6b4b3bdc523e0246748929fa1
MD5 c22dc5a438a184e4c7599f4100abf466
SHA1 3aae27ee8c521c2c714375833ca0c8a9fda95ae5
SHA512 2ed91526afdacfabfb53c52527c8c898326841e7d0119b868f0a5373323c2a9718a84917e76ec577888b1ba0cfa8861660f9f42292885ae90c576229304ca882
SSDEEP 768:jrv+4UNbdr34qGnnwDlLtVK48dHeByERRFzjK3YEeVH1SCX:jbsb53JGnoc48dHSyw/yEH11
TLSH
T15713BE71A8A85E734CE7D2897143B657BFF0825382C45BA4C5DDAF4E868A4DD030BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 b5e52e842a877b6332279e3d52d453cabebb0eba3ec2c1d53aaaa98828793103
MD5 1a709cdd25ce6a0fa84c320c2c5cce43
SHA1 afdfd04d65f40bc88bc98a7722d15f7012fc196a
SHA512 5c9cfc1ca1c8d5ea50ffa3a632b580f8727e0cccb1cea8576ac8b58c9fc357273a63711ac73ec5935331a01acf81c65d25ff1eb80e0eab9820621d2aef06fc35
SSDEEP 768:Prv+4UNbdr3iqG3nwDlLtVK48dHeByERRFzjK3YED:Pbsb53zG3oc48dHSyw/yD
TLSH
T11403CEB1A9685E738CE7D289B2037613BFF0825382C55BA4C5DD6F4E808A4DD170BD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 47a4b0b95ef3766c24847ab1bb9393a66e79763ada984819fe177919474343b7
MD5 231ac6b1c72b6f66f152c7a303dfe5b8
SHA1 a46bc2faf52e8a50360df9d4fef1578ce969ae15
SHA512 f3c065f9ecdea7c43266340c83ea496581f2777409487a52e845c4e94ad93963407bc2a5e98caaa4d4b54b5e7e64af556fb0c8d39470d20cda0c7a9fb691eafb
SSDEEP 768:ls3yqG3nwDlLtVK48dHeByERRFzjK3YEb9M/:ls3jG3oc48dHSyw/yb+/
TLSH
T109F2BFB0A8645E734CA7D24A75437757AEF08267C2D86BA4D5DDAF0E45834EC070BC2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 8dcc31054cd9608652e4738ea64a31c5f382ebd09fd7030e5488384365210737
MD5 3f649613623c4a43c80c9686c85e8e21
SHA1 93a1891bbe54a2d28f1ae0fac0c8a5a0e2ffd1b7
SHA512 d1d12e8a2a2c439c24c54be2392e91ed99c0be8b2eae3502d2f545eed6dff91a10bb7b20f052142f251442c78d65590bb734486d51c984a8b7630cf734ff4313
SSDEEP 768:Qrv+4UNbdf34qGJVDlmK48dHeByERRFzjK3YneVH1SCj:QbsbJ3JGP148dHSyw/FEH1Z
TLSH
T1AD03BE71A8A85E734CE792897643B657BFF4411382C45BA4C4DD6F4E868B4DC130BE2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3278a647-86a8-4fca-a0e4-799a098380b8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3278a647-86a8-4fca-a0e4-799a098380b8.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download