hxxp://nicewh[.]xyz

Analysis

user interaction
yes
max time kernel
898s
max time network
732s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/07/2026, 22:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://nicewh.xyz
Sample260727-2axt5ade96

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
800	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134296646082998957"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{B53C32DD-B907-47F1-912A-FACA8F69DC99}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4164	msedge.exe
4164	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe
4304	msedge.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 4304 wrote to memory of 4300	4304	msedge.exe	84
PID 4304 wrote to memory of 800	4304	msedge.exe	86
PID 4304 wrote to memory of 1716	4304	msedge.exe	87
PID 4304 wrote to memory of 5008	4304	msedge.exe	88
PID 4304 wrote to memory of 1716	4304	msedge.exe	87
PID 4304 wrote to memory of 5008	4304	msedge.exe	88
PID 4304 wrote to memory of 5008	4304	msedge.exe	88
PID 4304 wrote to memory of 4312	4304	msedge.exe	89
PID 4304 wrote to memory of 4312	4304	msedge.exe	89
PID 4304 wrote to memory of 4312	4304	msedge.exe	89
PID 4304 wrote to memory of 568	4304	msedge.exe	90
PID 4304 wrote to memory of 568	4304	msedge.exe	90
PID 4304 wrote to memory of 568	4304	msedge.exe	90
PID 4304 wrote to memory of 3716	4304	msedge.exe	91
PID 4304 wrote to memory of 3716	4304	msedge.exe	91
PID 4304 wrote to memory of 3716	4304	msedge.exe	91
PID 4304 wrote to memory of 4004	4304	msedge.exe	92
PID 4304 wrote to memory of 4004	4304	msedge.exe	92
PID 4304 wrote to memory of 4004	4304	msedge.exe	92
PID 4304 wrote to memory of 3316	4304	msedge.exe	97
PID 4304 wrote to memory of 3316	4304	msedge.exe	97
PID 4304 wrote to memory of 4364	4304	msedge.exe	98
PID 4304 wrote to memory of 4364	4304	msedge.exe	98
PID 4304 wrote to memory of 1648	4304	msedge.exe	101
PID 4304 wrote to memory of 388	4304	msedge.exe	102
PID 4304 wrote to memory of 388	4304	msedge.exe	102
PID 4304 wrote to memory of 388	4304	msedge.exe	102
PID 4304 wrote to memory of 220	4304	msedge.exe	103
PID 4304 wrote to memory of 220	4304	msedge.exe	103
PID 4304 wrote to memory of 220	4304	msedge.exe	103
PID 4304 wrote to memory of 4312	4304	msedge.exe	106
PID 4304 wrote to memory of 1652	4304	msedge.exe	107
PID 4304 wrote to memory of 828	4304	msedge.exe	108
PID 4304 wrote to memory of 1868	4304	msedge.exe	115
PID 4304 wrote to memory of 1868	4304	msedge.exe	115
PID 4304 wrote to memory of 4312	4304	msedge.exe	117
PID 4304 wrote to memory of 4312	4304	msedge.exe	117
PID 4304 wrote to memory of 4704	4304	msedge.exe	119
PID 4304 wrote to memory of 4704	4304	msedge.exe	119
PID 4304 wrote to memory of 4164	4304	msedge.exe	120
PID 4304 wrote to memory of 4404	4304	msedge.exe	121
PID 4304 wrote to memory of 4404	4304	msedge.exe	121
PID 4304 wrote to memory of 1288	4304	msedge.exe	122
PID 4304 wrote to memory of 1288	4304	msedge.exe	122
PID 4304 wrote to memory of 4468	4304	msedge.exe	123
PID 4304 wrote to memory of 4468	4304	msedge.exe	123
PID 4304 wrote to memory of 3356	4304	msedge.exe	124
PID 4304 wrote to memory of 3356	4304	msedge.exe	124
PID 4304 wrote to memory of 2572	4304	msedge.exe	127
PID 4304 wrote to memory of 2572	4304	msedge.exe	127

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://nicewh.xyz
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffa4b72c188,0x7ffa4b72c194,0x7ffa4b72c1a0
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1896,i,8449789245258814709,14426152518351689719,524288 --field-trial-handle=2472,i,14558821632084341420,4953554903523527907,262144 --variations-seed-version --mojo-platform-channel-handle=2556 /prefetch:3
  2⤵
  - System Time Discovery
  PID:800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2348,i,16568509040358639319,4734791651246876429,524288 --field-trial-handle=2472,i,14558821632084341420,4953554903523527907,262144 --variations-seed-version --mojo-platform-channel-handle=2564 /prefetch:8
  2⤵
  PID:1716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1744,i,6310002522279433268,8391350953478707137,262144 --field-trial-handle=2472,i,14558821632084341420,4953554903523527907,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:2
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3480,i,16731777719066575868,1429536319721817192,2097152 --field-trial-handle=2472,i,14558821632084341420,4953554903523527907,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,4126251788137351823,17996307023060145293,2097152 --field-trial-handle=2472,i,14558821632084341420,4953554903523527907,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4316,i,801617998204658317,2838810424603399617,2097152 --field-trial-handle=2472,i,14558821632084341420,4953554903523527907,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:1
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4404,i,9967153840697491207,17350851205719847379,2097152 --field-trial-handle=2472,i,14558821632084341420,4953554903523527907,262144 --variations-seed-version --mojo-platform-channel-handle=4492 /prefetch:2
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1748,i,10573002810046274225,17819609585386996787,524288 --field-trial-handle=2472,i,14558821632084341420,4953554903523527907,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:3316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,517967770596322406,4771361796223495886,524288 --field-trial-handle=2472,i,14558821632084341420,4953554903523527907,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:8
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,10310427253764607306,17800860959197114309,524288 --field-trial-handle=2472,i,14558821632084341420,4953554903523527907,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,10310427253764607306,17800860959197114309,524288 --field-trial-handle=2472,i,14558821632084341420,4953554903523527907,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:1648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6184,i,15096339662037492459,18006491400195778419,2097152 --field-trial-handle=2472,i,14558821632084341420,4953554903523527907,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:1
  2⤵
  PID:388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6396,i,13323744947672655953,10223182822016546885,2097152 --field-trial-handle=2472,i,14558821632084341420,4953554903523527907,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:1
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4600,i,5270925603608621447,6034391820765774143,524288 --field-trial-handle=2472,i,14558821632084341420,4953554903523527907,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:8
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4604,i,12899429320466028743,10188698982776940397,524288 --field-trial-handle=2472,i,14558821632084341420,4953554903523527907,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4588,i,4447982842789488444,9387393142797779774,524288 --field-trial-handle=2472,i,14558821632084341420,4953554903523527907,262144 --variations-seed-version --mojo-platform-channel-handle=4596 /prefetch:8
  2⤵
  PID:828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5360,i,2390095884061843216,10122543421356599665,524288 --field-trial-handle=2472,i,14558821632084341420,4953554903523527907,262144 --variations-seed-version --mojo-platform-channel-handle=3620 /prefetch:8
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,5764001664082168289,12155961210463555385,524288 --field-trial-handle=2472,i,14558821632084341420,4953554903523527907,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,6003129630804581703,11895537655639067249,524288 --field-trial-handle=2472,i,14558821632084341420,4953554903523527907,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:8
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4576,i,17723717837593492484,7094831749744834433,262144 --field-trial-handle=2472,i,14558821632084341420,4953554903523527907,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3996,i,435731749488548422,17313519781966189353,524288 --field-trial-handle=2472,i,14558821632084341420,4953554903523527907,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:8
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6604,i,12303527124874862117,7444361115580478627,524288 --field-trial-handle=2472,i,14558821632084341420,4953554903523527907,262144 --variations-seed-version --mojo-platform-channel-handle=3420 /prefetch:8
  2⤵
  PID:1288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6628,i,523951067427147457,12182347441900386578,524288 --field-trial-handle=2472,i,14558821632084341420,4953554903523527907,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:8
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2948,i,9011723136785537957,10299300688383473189,524288 --field-trial-handle=2472,i,14558821632084341420,4953554903523527907,262144 --variations-seed-version --mojo-platform-channel-handle=4956 /prefetch:8
  2⤵
  PID:3356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1348,i,16360437252338203651,1691044893973526832,524288 --field-trial-handle=2472,i,14558821632084341420,4953554903523527907,262144 --variations-seed-version --mojo-platform-channel-handle=6608 /prefetch:8
  2⤵
  PID:2572

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2060

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
MD5 8c7cdfea4284ba987d295d82a9c7ddd6
SHA1 7d1a3a66f2d64a383b230196ba89a263ce7ee957
SHA512 59c8229e834c944265aed4131c79f41f9f940a48651b9fb18800cef5bae36d17c7fd5880120c6fee8ce22a157b65bc63846b65765bc4dc86e15926dcce400d0d
SSDEEP 12:sf9iXhV0xoUZxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxoUZxWMk8xVTeYWI31BtXP
TLSH
T105724C85B34498FFC8835E7189BD27903774F6DF1F02866B6A6A760E2E271C84F44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 81240d13af4ca099e1358c75991e3fa5640dbb3aac72c2d98006f6159bf74aa0
MD5 96dd753cd2d8557b97ab2cd76f7fc6cf
SHA1 81697ccb13fb04a07bd47b552b3607597251f36d
SHA512 355c412a688a71b124e85c0527177b3f97efceb2a5553f8428e0913940daffd3bd176f5476b940c64eee52d543f0568112ac073984d9a64015adc15cbef552de
TLSH
T174D09224BA29A149E282007AA881EB565219DA95296B9622E620C44DBD2B925A3851C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4bf0783d55eb083b4adaa03ed8b76a2bd35b0819c8ad2530a78e1b8d6856010b
MD5 7a50c2e276f05b686e8cb6c95b86650f
SHA1 bc892af04a9d6b1bee8047f67518d676df864301
SHA512 f1d02fd9f067323214d78de08172e1a78028eba76f4754436f4d77b849e8422865dcea22be13f21c36ac2c5807b393c1dffdb0a3217c3353a517a0467461a474
TLSH
T19BD022203A28A008E282003AA880EB020208CA80282BC322E220C00CAC2B820A3800C2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 664aeb7a6bc3578708481d55524f2cff8a2b860471716799501f6b9e3063c0ec
MD5 321bce4266548572845228f2d506324f
SHA1 d3cd8fe2eb9c762063e31d169a7f8b129c9aa71b
SHA512 e6212ab72340e11cafb6498ddc5597b269148185f85ad62ff9044222da31cc05a8b4d136584d1fda7a6f74260b8502b8d55abce8042459d57ebdec2b793e04c1
TLSH
T1EAE078CB54C5C32FF140744B43D4534CC2863A0FD2C469A91F0888C5714145477F3D60
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 eb2dc1b8d004c02f68b562c045e2a2da4f299186f5300cd8c2e9398623f2a1ae
MD5 2d921358fcaf34d7cba0423f05267f85
SHA1 a05f885c58f33351ce9834ef57b9c3503eb1c7c2
SHA512 c680ce92ba1c376857448e37c2fcbeca152625559c8bf7547714d94c8bba3cee57b14f535565061a738f842150d6e5ddd1274feefcb8d3d268f8072a2861d5fc
TLSH
T158E020E704C7C39DB104E48B8274430C9182B60F92C4A9EB2718C85470C1C41E793D61
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 89211928210ca06078eb1a10119310e5b407aa9a63f0922771a2f4aac61bed72
MD5 a0578883707d5ddcf23550af0c61631f
SHA1 30e0c0bb8df324efeddf289f2d7f5e9230aba734
SHA512 26709e10a169d19dfeeece6e6a52505b08d3e152285bf3d5ca49bea667786b4d05c44434671842d6293af4f0f5d5e1a34f34f23ab2a982e587f15e665e1765df
TLSH
T1B8E0268734EED36FB710A547826C838CC2A2370EE3C8A99A671C88847181044E7E2EA0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 81b07e3c07cebfa37866fed3e3cb8619565603ec31ee095eb5a4157e1e547555
MD5 fe3cfc73ff311b3b69e96c12fdc43789
SHA1 5ef9f5abf1c690ceb5a7f13231daace5ea3885f7
SHA512 06ec0f22067aa292eecbba99ac1198736ee2b872f025a555d850ec10e72da35b81d095adeea7222407ef906e8163aecc0246d92e75e046b8011385a6786cb9d3
TLSH
T1F5E020C705C7C3FDF101A4874258470C81813A1EA3C4F95F170C845875C1440E7D7D60
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 dd796a0788a82168fb20860c77ae5b20f118a8a8b9e73fbf553b87ad4122e349
MD5 1a98bf2ac3a879654a440279a42ebaed
SHA1 80037177f34ebfece7571d4bd1e50e689559ee6f
SHA512 2ef3be752306fdf55aecd797a55118e00b9bc7f94f480e4923536d4630d7043710244130d5ea6afeab3e442f35a57c27bd1e47ade3daef1aa748dda399588187
TLSH
T177E026C615EEC7AFF2206657917D830C82E1360ED2CC699A5F0884C470C1140A3E3EE4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 2bbcc9e4d85f418994424f952638e39b5dce1c18946d115b7fa1b8015414aa61
MD5 d5862e70247c2ad84bf9a62d21b63cfc
SHA1 489595bc6813cc2e9cbceaa25dd25f377571cf90
SHA512 b480cb16ca4ebe11a71d25984af41a5608b365a98405585f793b78b099a7ae5f0c04793df88ef1434d75a99c801dc8b324700914e8527efc98650a420c747a64
TLSH
T19B71D6350921B891F3901F3A70E60553FC7AC9D8F7578E9790AEC9B86927B60413E2CC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5870f5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5870f5.TMP
Size 3KB
SHA256 0c9b12004e16e137fbe3c4325e780cc6fad3b4ed6f8abfc9d0ae5e1c87381b17
MD5 8e37c056851ea13c3c8818d4897e20fd
SHA1 71f701b26a8bfb743bef56c7e0eed941adc9988a
SHA512 9f7445174be59994920144daeefbbf3b22e7d250a2a362e4781409c2a434caf0d994d69eb7679f2a57a6818e9ce3c45d0ac3e224b9f3e5714515bf58acf5c388
TLSH
T1B571E7350921B891F3901F3A70E60557FC7AC9D8F7578E9790AEC9B86927B60413E2CC
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 3cdcf442bd78d01391156496daa613eb9054bdbfe8b66d6b7250950b9c51980e
MD5 0bbc905b190fd2477b7e05ebcea57637
SHA1 05919839f3a6e5b45d69acc6d961e903c69f671d
SHA512 cd7378a19378940c09702ce82549b0784ea106eaa3b9f5121bebd52de513ba7bb765dbded5ef581cf095382f51ef4772151f68986c7326279dc795c32d179341
TLSH
T1A931BBB3C7E9866DC85152F15A24AE2BDE2D0A44832C3C2AC9D5FF1B93E2475E10264F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 db3b5bda2a4972ac794ef586bf4ca72a5fbea7315395ff8de5f43ba48535d718
MD5 5af808385df32207633948c98433aedd
SHA1 8d9baac1392c933dadb2b5522099598cf1c7a80c
SHA512 9ea4739784c8066346bf3735cb24d9322dd6f98037f725c8eec7833aab1ea5a7aedeeadade8742d70049f985b6173ad59aee7e4e3d0952061a2ceef263d52f91
TLSH
T1563157B387E5866ED91556F09A54EE2BDE6C0904431C7C2989D1EE2793E2071E04275B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 01fe958f3ae63de58ac660b413eff6f05a4e98dc63a7c82088508e4580cf4d43
MD5 d32b638e49197377575ce28f094d2d2e
SHA1 ef935a26d47b0d7d87c7d0627b445d4c5da9e615
SHA512 cffb43d7963a5fbdefcc58150875da93b1e029a7ab1b3f85a844f2a579c08f14f85a95a2a150f74823712347a6a2ed2e46fa6037fec05d415762c7fcead991da
SSDEEP 192:sxZQRgkA/ffsT4eIdpEVH/i6+WNGYCk2rQOIgrJ:sxZQ5A/ffsT4PsHnGr99
TLSH
T15222A7166E2899778CC7E219BB15BF13E6F95032A1D41E58EAFC861C05E7ADD130780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 4faecdd82a80206c171eb0d72940a5a24f0d6738e0b89c318cc0079893813aaa
MD5 c219a54aeeb450e68f52dc34bbb71773
SHA1 80b322c84dbab0e8f19161c9db73b4231dad69ef
SHA512 e3828584554011d3f6bbe95ba53e1759544b5d5fafbcfb15207c7a41eeefa9ea8f80f58776589a9516d56c5a8877ec419cc24d7839ae3478ad0763904b4d598a
SSDEEP 192:sxZQRgkA/ffsm5/eIdpEVH/i6+WNGYCYIrQOIg5WJ:sxZQ5A/ffsK/PsHnGD9I
TLSH
T19B22A6166E2899778CC7E21DBB15BF13E6F95032A1941E58E6FCCA1C05E7ACD130780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 c81ad8e6d727d959e365696aef42d9d3da805640acf9db78e349104c175a11b9
MD5 f14c800da749df6ab0e185a4641e2338
SHA1 2c1629fbd737ab4a2f2330cc28ef5b52da92eda1
SHA512 cd31e886130a5ca454b4bb2240aba8cf2a094444ce41f2e51cfa754261f44e5a0eb98c7ace74ebf5056b6f1254d580d5eb481d9a71df486031e5ec2d462e7129
SSDEEP 192:sxZQRgkA/ffsm54eIdpEVH/i6+WNGYCk2rQOIg50J:sxZQ5A/ffsK4PsHnGr96
TLSH
T1C722B7166E2899778CCBE21DBB15BF53E6F95032A1941E58E6FC861C05E7ACD130780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 1cb7ee7ab6672785cdb15fee618d154efc4bee48dbc81d3413249b0e63ba93bf
MD5 339be6d8e65809620e4656badef106d2
SHA1 ada549774b492b1955da83e81cf6865e5b2b0b19
SHA512 cbff0faed05ef54a68f0bf66e3aa70e81356f3ff752def6304f09cd3ba43c1223cf65bd0c73f89731a0717744608291dc3750c874c9998228eaf84e435d523dd
SSDEEP 768:/ZqbUj+WvSCs68F1+UoAYDCx9Tuqh0VfUC9xbog/OVHZLlRTKrcroC:/ZqbUj+WvSCs6u1jaaZLbWrHC
TLSH
T131C2D83B340CCA7E4FC01E9DDD5A6F972E9802C7A7588D4447FA994C02C77EA912A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0edf8ae8-999f-4bc0-9193-95e9c661ffcf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\0edf8ae8-999f-4bc0-9193-95e9c661ffcf.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 0002b936c84e6111e3fe5c6f4da8bad2f9d180b9f97bf45b96f86113065a9821
MD5 a69c5eaabeea62e9d81b2c4983615e28
SHA1 ab64f397912c12a837f7506b83370fd8cd8fcc8c
SHA512 6c589c044fa99e69eba25dacf63e4dd458c1455d8092cf08a9dd0757700867b46bba681657e2b8059d74d9f27b67a29dc6a0ff24c27575f39119271ab2b27834
SSDEEP 192:uILsNIpQNbp9abiGTQmiU1gpn4Ea+jpOmN+HVPPwo5namcdqLU8:lsNIputVWq4Ea+lOy+HVYo5BJU8
TLSH
T170323A3668389C375DE2A694F5873213AFE8502BDA892F94C6DC5F0C00DF69C130E92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 568619bcb3050d55f99c29f1b7be3bf2807a328ae0d216a2ed558277ac28f2d5
MD5 513e24467e45de95e6675af792fa9732
SHA1 61003f71823be781119ba735291c41ba3fd23287
SHA512 22c2ee08d2a4d5d652a4765e35f44624126ec8fc501e0e25077b678697ef9484baa8962f1880e42e442809d560b96b43104cf6071d9efa2886125f078ced0d2e
SSDEEP 192:vONf6Db6QmiUyHdHBa+jpOmN+BRg4RrU6:vONf6uEHBa+lOy+IGrU6
TLSH
T10A02E73968385CBB9EE26E49F48727279FD4203BDA566B94DAD80F0C00D765C234B836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 9165e15549f56b9014261a03140e634eaf102a384666215a6676586032d19e57
MD5 9666e65fb39bb660dbae92ba1ba514dd
SHA1 fc9c4ff9955c5a763b0aa3fb143149fbbb8b5df4
SHA512 bd02efa17c642414a268eacf06bb31827bcb8e5a2d055ee8af049d9f5633c969bea91e27c095f7c61e643ad328db815532c734ee17d0ad441135678141b7402f
SSDEEP 384:QiFiZcI7zsN48TUNTUlIlhutVWq4Ea+lOy+HVYo5EJOObjI9G6w7+S:rFQvpwg2Zba8Oy+VGJ29MT
TLSH
T148A28E339C688D3BADB69B55F58A36179EF4507BCAC5AA94E2DC9F0C00EB5DC030AC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e09aa2f8b433f89aa73421d8e93eb7ff4d8f61c3debf425a435faf22af9a911f
MD5 32135b22adb31d8f40f8e29bcd44109c
SHA1 3ffcd3439e152e97bf9d1a17396406409a28d515
SHA512 14b7e8cee281808487581bc8714e9fb68f88af01c8809ed841cc29e16cc20174d39e894344cd3a1b6e1a472386b740491e5ff758667fbf43f8bc897f28e4841c
SSDEEP 192:YON56DbfQmiUyZdIBa+jpOmN+HVPPwo52NzcdqLU6:YON565wIBa+lOy+HVYo56JU6
TLSH
T10912393678385C7B5DE26984F88732139EE8512BDA8A7B91D5DC1F0C04EF69C134E82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 916e11b01c7b8263da727bfb0f7992b28c7c1b435262d929ebe3b20563faa41d
MD5 d60a0226449e8c122156599947855501
SHA1 0c815aef5d118e7cfd95c554daa69c514219f310
SHA512 237484d7ec17aa48dc5bf90795e42b93fd0c6460ed5a905f6eb00b6f415810c2e4f1f31003dcd77bf9037fd9d3e0dbb8cf9903f4ddd4c4f37917dcee523bc56d
SSDEEP 384:SZcIhsNIhutVWq4Ea+lOy+HVYo5BJOObjI9G6w7+S:gh8Zba8Oy+V7J29MT
TLSH
T1D3928E36AC384C369DA69555F58B36279EF8903BD7C95B84D1DCDF0C05EB9AC030A82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c13ef039-11dc-496d-bee9-5f210a8f6cc4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c13ef039-11dc-496d-bee9-5f210a8f6cc4.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 53ebeea00842bf85fd0bd0e4ea67dbbdbdfd680c072ddd13bf2e986dcfe3d141
MD5 ae9b03ad89763f8f2f5b47844de9d56e
SHA1 cbbaa9fb711f809488e8c81deb5caac93995f9b8
SHA512 d80399ea794fe4ad9e3761e6c57535876a350d337393a9e8a3a8f3571c63b58feb7456e1b8f675b6b04e086442246e4253d4fef4543b8a8591865419c1836e3b
TLSH
T1EB413958A6FA1148B3776E565FF6A4AE483ABD732F0AD55D10010E4E0A72B40C8B2B37
MD5 SHA1 SHA512 TLSH

Submit Download