hxxps://apply-apic[.]changiairport[.]com/?token=9C009374EFC00EE5C2CDB14F655EB031A4621E8D8E34B5BCAC846F3E424BD196

Analysis

user interaction
yes
max time kernel
898s
max time network
768s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
27/07/2026, 01:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://apply-apic.changiairport.com/?token=9C009374EFC00EE5C2CDB14F655EB031A4621E8D8E34B5BCAC846F3E424BD196
Sample260727-bfa97stemh

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3608	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134295878929685065"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{5FAD1208-FE8C-42F3-A489-7EB2D5716994}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3068	msedge.exe
3068	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe
408	msedge.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 408 wrote to memory of 4880	408	msedge.exe	87
PID 408 wrote to memory of 3608	408	msedge.exe	89
PID 408 wrote to memory of 1488	408	msedge.exe	90
PID 408 wrote to memory of 1488	408	msedge.exe	90
PID 408 wrote to memory of 1488	408	msedge.exe	90
PID 408 wrote to memory of 4440	408	msedge.exe	91
PID 408 wrote to memory of 4440	408	msedge.exe	91
PID 408 wrote to memory of 5004	408	msedge.exe	92
PID 408 wrote to memory of 5004	408	msedge.exe	92
PID 408 wrote to memory of 2244	408	msedge.exe	93
PID 408 wrote to memory of 5004	408	msedge.exe	92
PID 408 wrote to memory of 2244	408	msedge.exe	93
PID 408 wrote to memory of 2244	408	msedge.exe	93
PID 408 wrote to memory of 4168	408	msedge.exe	94
PID 408 wrote to memory of 4168	408	msedge.exe	94
PID 408 wrote to memory of 4168	408	msedge.exe	94
PID 408 wrote to memory of 216	408	msedge.exe	95
PID 408 wrote to memory of 216	408	msedge.exe	95
PID 408 wrote to memory of 216	408	msedge.exe	95
PID 408 wrote to memory of 332	408	msedge.exe	98
PID 408 wrote to memory of 4832	408	msedge.exe	99
PID 408 wrote to memory of 332	408	msedge.exe	98
PID 408 wrote to memory of 4832	408	msedge.exe	99
PID 408 wrote to memory of 752	408	msedge.exe	101
PID 408 wrote to memory of 548	408	msedge.exe	115
PID 408 wrote to memory of 3828	408	msedge.exe	116
PID 408 wrote to memory of 3988	408	msedge.exe	117
PID 408 wrote to memory of 2472	408	msedge.exe	119
PID 408 wrote to memory of 2472	408	msedge.exe	119
PID 408 wrote to memory of 1560	408	msedge.exe	120
PID 408 wrote to memory of 1560	408	msedge.exe	120
PID 408 wrote to memory of 3068	408	msedge.exe	121
PID 408 wrote to memory of 3272	408	msedge.exe	122
PID 408 wrote to memory of 3272	408	msedge.exe	122
PID 408 wrote to memory of 1396	408	msedge.exe	123
PID 408 wrote to memory of 1396	408	msedge.exe	123
PID 408 wrote to memory of 4200	408	msedge.exe	124
PID 408 wrote to memory of 4200	408	msedge.exe	124
PID 408 wrote to memory of 2224	408	msedge.exe	127
PID 408 wrote to memory of 2224	408	msedge.exe	127
PID 408 wrote to memory of 3076	408	msedge.exe	128
PID 408 wrote to memory of 3076	408	msedge.exe	128
PID 408 wrote to memory of 1700	408	msedge.exe	129
PID 408 wrote to memory of 1700	408	msedge.exe	129

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://apply-apic.changiairport.com/?token=9C009374EFC00EE5C2CDB14F655EB031A4621E8D8E34B5BCAC846F3E424BD196
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff81ad6c188,0x7ff81ad6c194,0x7ff81ad6c1a0
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1892,i,17701029189492018426,11069091378520681976,524288 --field-trial-handle=2300,i,17134494714146654572,7143475011894770879,262144 --variations-seed-version --mojo-platform-channel-handle=2328 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1696,i,1573185429772557490,9690735289985329974,262144 --field-trial-handle=2300,i,17134494714146654572,7143475011894770879,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:2
  2⤵
  PID:1488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2556,i,12136155045230944251,5968964324138449336,524288 --field-trial-handle=2300,i,17134494714146654572,7143475011894770879,262144 --variations-seed-version --mojo-platform-channel-handle=2560 /prefetch:8
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,10370433774564061350,346419570082301290,2097152 --field-trial-handle=2300,i,17134494714146654572,7143475011894770879,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,5297107796937490734,3967617433598230190,2097152 --field-trial-handle=2300,i,17134494714146654572,7143475011894770879,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:2244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4116,i,946750570962827490,12290066529167170296,2097152 --field-trial-handle=2300,i,17134494714146654572,7143475011894770879,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:1
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4120,i,14889890453210074811,4335867199293330061,2097152 --field-trial-handle=2300,i,17134494714146654572,7143475011894770879,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:2
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3608,i,18266826704839989422,17139318060891954248,524288 --field-trial-handle=2300,i,17134494714146654572,7143475011894770879,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  PID:332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3596,i,6232872188025347676,11969788044389590107,524288 --field-trial-handle=2300,i,17134494714146654572,7143475011894770879,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:8
  2⤵
  PID:4832
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,1712817719528445767,271768319848492176,524288 --field-trial-handle=2300,i,17134494714146654572,7143475011894770879,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,1712817719528445767,271768319848492176,524288 --field-trial-handle=2300,i,17134494714146654572,7143475011894770879,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4512,i,2135250619352266039,6808871558886041153,524288 --field-trial-handle=2300,i,17134494714146654572,7143475011894770879,262144 --variations-seed-version --mojo-platform-channel-handle=4524 /prefetch:8
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4516,i,2518566577243544313,11507332253227858696,524288 --field-trial-handle=2300,i,17134494714146654572,7143475011894770879,262144 --variations-seed-version --mojo-platform-channel-handle=4480 /prefetch:8
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4500,i,1057975876538560852,1710749552765537175,524288 --field-trial-handle=2300,i,17134494714146654572,7143475011894770879,262144 --variations-seed-version --mojo-platform-channel-handle=4444 /prefetch:8
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,2548945394346935733,16660462565616486330,524288 --field-trial-handle=2300,i,17134494714146654572,7143475011894770879,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:8
  2⤵
  PID:2472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5708,i,9833587446681614489,17537342687233012959,524288 --field-trial-handle=2300,i,17134494714146654572,7143475011894770879,262144 --variations-seed-version --mojo-platform-channel-handle=716 /prefetch:8
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5976,i,14420873821696487513,3243854666217013127,262144 --field-trial-handle=2300,i,17134494714146654572,7143475011894770879,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5484,i,9385302629238022510,9301231463963379976,524288 --field-trial-handle=2300,i,17134494714146654572,7143475011894770879,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:8
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3744,i,5433488032304740614,375802555039637764,524288 --field-trial-handle=2300,i,17134494714146654572,7143475011894770879,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:8
  2⤵
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3292,i,7596499586524278742,12402260310952951514,524288 --field-trial-handle=2300,i,17134494714146654572,7143475011894770879,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:8
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5500,i,11801531420072157725,1117378510373571416,524288 --field-trial-handle=2300,i,17134494714146654572,7143475011894770879,262144 --variations-seed-version --mojo-platform-channel-handle=5420 /prefetch:8
  2⤵
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5204,i,3065030735782712841,15573875182597591612,524288 --field-trial-handle=2300,i,17134494714146654572,7143475011894770879,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:8
  2⤵
  PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3348,i,17925994259320530878,17015094228115561135,524288 --field-trial-handle=2300,i,17134494714146654572,7143475011894770879,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:8
  2⤵
  PID:1700

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2796

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 92b83a0e542b7bb3ed324c35b5f2a40c47a6351981065b804e4d9d80ddd6d7ee
MD5 9ea20a12d0c030ae7f84014f382662b7
SHA1 7912569189cf07c1ce092a268e67e9f391b7c8c7
SHA512 39ca414f13163c8479fe7650ae0dd1607b267fe3f319c09aec7bd5f68448e9ac604351069bf6b166b3f897d3afb5d7f35e609b9fc72b9debbcb05bad8fad7d81
TLSH
T132D02B20FF04E002D1072172540047100E0848902093C140E030441CDCEC804D395307
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 6KB
SHA256 aa152236945151bb3098e8116d4d68a5b141cbf8d0a7716652d8d03c059685dd
MD5 0ed17a3e7102b1d79f31738f3c896a1d
SHA1 76f4ef359d447813044564cdbb530be5e8f0d8d6
SHA512 1691159f31bd59bd4b2e9b991cd91c31ee38a4d4e8132abb7d013c79301aa2e80335e38d0163731a289ad7c9036a6e893c04f28df520100891c2b575639b6833
SSDEEP 192:VjKk6bZCgpSNmyn7dKhoq5yQShKFkpvBLzlMuLO:VjKk6bZCgpSNmyn7dKhoq5yQShKFkpv4
TLSH
T1EEE1466382D4D69ACF19148A4DE0736C40713B0DEBDCE90813AD89ED318E5DBF9B6B90
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 6KB
SHA256 c3c76d4e8bc57da5a4719ed0e94a4ac2a3380bd1628ea92f93a11896930c6f10
MD5 e5a1d035bb68ae7f7c4bd7df0e22ad6e
SHA1 22d55bb9cfa63c63ad5a565206c9cdbb21bae5df
SHA512 fbacd279d1176395cc9dd1718a3ee71e24826450a8543c60cbcc9a13d874c250f10735d798048245822958f72e7adcd1fb4c2f9ff1ade5bd961fe4d591a0ca70
SSDEEP 192:+j8K6/MyyyyyyyyyyyyyyyyyyyyyyyyyyyyMKLO:+j8K6/MyyyyyyyyyyyyyyyyyyyyyyyyC
TLSH
T185E1469783D4D39A8B2550DA4EA0636C10703709EBDCE94C539C8EED314E49FEAF26A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 6KB
SHA256 1860a2e556704327d4bf171b48c9fe792c03561d2d70f4a24af27c53f4b64881
MD5 ec701067bef8eafc117f847420d2ed75
SHA1 746a24035d4ea7cdb2ce4a939007cf557fa2fd06
SHA512 6823e9b982ef534da7755b2171c0d441967c4da52e43c40871e1c50076fc5338ce1a2cd5ce0d4250e1c16e7716ef9af06a0c0533be3db437fc54aa5d7032dd9f
SSDEEP 192:4jCI6X77777777777777777777777777777MDLO:4jCI6X7777777777777777777777777N
TLSH
T1C3E1681786D4E79ACB0A148A4EA063AD11B0370DEBDCE50857DD9DFD304E4EBFAB1690
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 6KB
SHA256 673c052b4a5403b1aba058f4a5dd2ab77efef7e57cdb247afabb28f92f91258f
MD5 932c3cda0999282e7e9c9e8e0449f626
SHA1 64c75508a39acef2ebd3b7ca8139a8b39cb35c1d
SHA512 56f9f7250acbdbd9e6fe974ddc567eb1ab9b6444f4b96fc1e322d37c6a4327b5a22b81c6c572b380b651a4e24c3aa880dc87acf03a8c4cd6d13991a8dbb263b7
SSDEEP 192:NjkD6k44444444444444444444444444uuuMKLO:NjkD6k4444444444444444444444444O
TLSH
T112E1416783D4D79A9B0950CA4EA0A76D40703B0DEBDCE648139C8DDD314E49AFAF16B1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 a857ffff240518ece36208786e88792a6fc728c150a07cbece050c5f37dc4cb7
MD5 b829002c33aff99442e3764657ab1742
SHA1 3f89074d4b95210e56d2032c233b684fca156d62
SHA512 212ad8c92fb06baafb2d24a5e9a4cf8e6657b4539a29ef627073fa26a07efae133d378557cd47f4d814c2329f7e738c0218f99bed8fb4999975e38ededf13fef
SSDEEP 48:iX7CKVT/1CambnjYYJnSa3PwipF4lARsa32KpFkj4FoZaTPT8iXE+MoBnPNjtjms:iXx8JiipmaJasTPlMANpZL5n1a4OqseV
TLSH
T12A9164B4069E3AACDB525F31C0DD699133309AF6FE7B0B97DCE151BED60A7D00819028
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 4fc68885adf6875b11d86df7aa9ad0c4adad2ba58cddb98b891ca5cd40f502cf
MD5 af1e405043fc7061f7d22f00ac67640e
SHA1 2c1757979da8710d33506ae24060b8a99a467089
SHA512 aa25101e58fbc60a119490e5095eff2a4056fcda7bbd4e54a54007f894788b76ff0d9b4d5c9ab726f4fa49eb9a4e834b320cb70e1e444fe3e17dec8105e57065
TLSH
T12B4199F783E8866ECE1152F0AA246E17DE2D052543AC385AC5D8AF5BD3F2472E10155B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 c159bdbb9a18eb8db4d5fc708a480cf0502e81146ef81acb1658f6ad99813041
MD5 c0e087a4aba54ba54368699f20a0ed2c
SHA1 34688b2349bd8c11425151e7e2d26b35088ab1fa
SHA512 81bb3bbc73bdcaca96c68ec68534ac5c4937e01bcc48971946066b586b911483b75ff8727ee99353545abd914b471442314fd260fb48437a8362905def645acb
TLSH
T17741AEF783A9866ECE1152F0E9146E1BDF2D041543AC38AAC5D8BF5BD3F2072E041A5B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 764413803ec81fb749ba9f889256bfca29705fe5a8e92bef8bc84d16b105835c
MD5 037296e883ef32bb8c7c31f2969f194c
SHA1 522e7d7e08258191a5cfd5c0c32fd105f2925b67
SHA512 22487e451e39b41a347205189805bb63f0d8af38c94d3742a82060961e83fa72a29a7034fc1bd01dfef4b38e4e2623f89976f3810267595210d8a33ba694a0a8
SSDEEP 192:sxZ5RnyM/jK1Ml8Mkw/fssEjxV2IdpX3HW6+WN8OG/Yvrm2b+9IgrJ:sxZ5xMw/fssEjrHHb0/cb29
TLSH
T16452E816AA34597BCCDBD209FA41BF53D6F50562D2900E84AAFCDA0C04E6BED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 4cd740fbac21d38b67d5732afd67501b6c9b491f59d27e6a6747f60a97acddd6
MD5 c45d42abe143a1ae3a428770aa2784ce
SHA1 d8cf6fb0f7b3215eca7bb3c17602d9e90750d544
SHA512 8838fa1aac629e79773431c2275a18d04886b3a995145daaef0494fd75da65bdfbd4a2f5b7f2b8e4219073c95e18365153d7fbced602a7daec0f6997642ee15f
SSDEEP 192:sxZ5RnyM/jK1Ml8UQtkw/fssUTxV2IdpJ3HW6+WN8laZYvwJxb+9Ig55J:sxZ5xqGw/fssUTr9HbTZJb2p
TLSH
T1E952E816BA34997BCCDBD209B941BF53D6F50472D2901E84AAFCDA0C04E6BDD221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 ce1e2f7c27818c92aade3e399369de6d3808837ecd46ca27297e7e3b7473f4c1
MD5 8b339574dd53f9baca55c471415ceede
SHA1 859b2fba66687653c7ed5e2f1cd6ba091b95938b
SHA512 5a436244f9e36d4d5abebe23ac64e1ef5f203fbd9a6de08ca9ec22f3a71a1c1bc802188d72e168573bc0df4c8d7a9641297d9ef077f85779d2c90314f048cc4a
SSDEEP 768:/XseJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0ppyronKY:/XseJ3xWvhfynu1jaVcL88ppKY
TLSH
T149D2FB2B280CCB7E4F844E6DEC266F966EE801CB57984D5487EA884C03C77EB51275DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c41e8016-acfe-4596-96f4-a749f543712c\index-dir\the-real-index
Size 624B
SHA256 5def1a4e4d5dcce06641276ac549ae0fdb81cde96147439fb6fae00c0b6da23b
MD5 d2b56d2e3cad65db098bd6076dda670b
SHA1 842a8170685bae6d11c926b7a1b6849f888f570f
SHA512 5187ab5ce9a784b540067f568214723346b17f211846fb8071ce47d32a832c2c12ac0fa80d2f105c41d3af51f130ed70f989a94608cfda2bb108c8c45d78cf67
TLSH
T1AAF0D4554F800C16E528457725F7A0E063704DDCB321D977285C5C6E1D213CD74563EC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ce7c7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c41e8016-acfe-4596-96f4-a749f543712c\index-dir\the-real-index~RFe5ce7c7.TMP
Size 624B
SHA256 b43c8af8a5d1ecc58b198c329a8596550a9ca7a1304ee34ad2147261f3b17498
MD5 d819a347ea87ee68e4d142c36a5fe23a
SHA1 e217e701c956674c2ce497dcc5d50168e727230b
SHA512 a97be9d668c6f826daa753a86b292e5da95a8be5386a94ed5eceaab8a331d79f2d870a7b156055572255ca3f87fa5b2aa94a763462965999d82fe024b6cbfc34
TLSH
T1CAF0A3554B910D11D42009B72EE6D5A8F3358C907632FAE7385C6C6E6C717C959022DC
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 f3b664a0a179efb6c9f37679410fbfcc6912c3357db955c20d3bab14cbb43e09
MD5 3df8d306b0a736722c8da2c4df60c427
SHA1 7532f3a6f6e72241bb40a611eae2a9c7a1a8759f
SHA512 3acabd25aa71fc0a9d1fd3138a6b5eb214ddb37995baf331ea8856fce059a2dcbdda274cdfadb5a52f8734726ef823b4e59b7f91bae953852e416488432cf6bd
TLSH
T140E0C0B62DD72450BEAFC3D120308090060A749EE941FC0E541FF6C310B231530D7C35
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 cde8038acd7ab9708d42996bf823bfde37906a5f93afed63ddb9ea44d0c8631f
MD5 b7d494e42bd173f40b2660605333ed00
SHA1 42f97e32c1c46967566bf25788c72d64f075a059
SHA512 40f8e595fafe56409634317a42e2b95f4361ad79667e41f23d45cd7b9718adc54b8f754cf1b9e12fa13e33aa331c15e0a6d8ed2b2e681e429e5b3c9985dce5cf
SSDEEP 48:KYHIhKggkXyR8IHKZW0DypKIPKrCYfytJIZKSc0+z:KYH+KggmC8gKZWiKK0KrCq2JyKScJz
TLSH
T19DC13652353F42022C7E2858B2A39E368E4275A33418A4FFBBB900915E67E115EFDCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59282f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59282f.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 5a27df6bb398d778b559f41085b23747c6173d02679a169469d157fddbb93ef5
MD5 c793f69e5c27d1cee474b7d80d7bd331
SHA1 906f13ed3569f8cb9d71014de6a15627ad0228ac
SHA512 cce50e3c87967324ef2fb66f316870fe0d6c30b4737e49eba114673e3499b26fffddfa18ca9d6e60ba846ddac751caa3ac5714b5256b0880be7d35aa8979bd68
SSDEEP 192:uKm+xasuheOwQxMGsNFUeWQ9365SOeM7GjRQmiU1nNA4MTZS+FdLK7Fd3ErO8z12:MZcIhsNFUbe6cOz7svLvGdwdUrP8juK
TLSH
T127627D736C749D7BA9E3B186F48A36135EF4813BD7C45B90A6ECAF0D00D96A80307D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 e6c3d00eeb3a7281e29918d00f539c5f257a6e5cd9d1e21c5f09124c03492a95
MD5 16344eebbf5b8e97b7004166852394a6
SHA1 c6e4dc2199117f343ae84bb7980d364cfe2ae347
SHA512 e38c0a11150a626a1a0385c068b01998de5792c30fd52d9b4a99984fbdbdb9487fe340880a76e622cea2253a2879ddb8739dbdede759fb6c06f6b903d4d1e6cf
SSDEEP 384:2iFiZcIxzsN28TUNTUlIlie6cOz7svkvGdwdUrl8juK:dFQBTwg2cET+UUrl8juK
TLSH
T103B2F8F258E7893AE9AE9743F77D2D024EBCC067B5849650B3D89A0CCC961BFC306915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f74c39a5a7c25b1cb64ddea27da7c6664376b06485882d935655706c60df9ecb
MD5 52f43ff4a99afe1302103ec179ca0c66
SHA1 aeefe19ad8d09888f59cea8ce20e6b76b5bfe80a
SHA512 e1540916e0631a79bfe7089c51219dd1bbe1d7fdb6c5928569288a53298f2c635e8ceac91f1a381f50f103d101b648dd13e2e2622b4dd9d54abb620aaf71a385
SSDEEP 192:lONnZ6vMtPQmiUyLgThTZS+FdLF8478QSU/u:lONnZ6UtRvTFdJ8rU/u
TLSH
T155020735AC786C6BDAA3AD4AF48A37171FA4517BEAD05B50EAE86F1C00D765C1303C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 cfed92d8186cd6dae2d32ff2bb15f6fd8ef647c756ef3bed20786e447ee8820c
MD5 260a4e319bc3fb2a6ed810c86694729f
SHA1 9066764746a7b9d5c29b6125d73b3e881f22a8ed
SHA512 5b8c0249fcb32fcd4daef2f8a0a69cdc10b6b3ea3c08f4b9bb0e67537373965ca88633a5451a461f3b015ef8bf7a97346045689b4b1c7252225c0936e069889e
SSDEEP 192:uZm+xasuheOwQxMGsNFUDWQ9365SOeM7GjRQmiU1nNA4MTZS+FdLK7Fd3ErO8z12:DZcIhsNFUie6cOz7svLvGdwdUrP8juK
TLSH
T1C1626D726C745D7BA9E3B186F48A36135EF4813BD7C85B90A6ECAF0D00D96A81307D16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 380c78144a8ea69fdc63964783344360e75a2cc5577198d620794779fedfe4e5
MD5 68e8e018d8e7f7b0e3fa03058c998466
SHA1 908c0b7e66aafcca02ef32a7865cfb02e9f967f2
SHA512 fbb35386b2062d7a8a4e21feb2f1be8daec93320145c8e2503bc9b1d5a0a4d1607bfe539d2c6bf01a60decfab2a682232c6ed491b1abd1594f6af7147fbfe986
SSDEEP 192:oONf6vMNPQmiUyQgthTZS+FdLK7Fd3Ery80I8kqXVU/u:oONf6UNRutFdwdUr78jU/u
TLSH
T1D8121A72AC649C2BAEA3B585F48736135FB0826BDAC46B90E6DC6F1C01DA66C1307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6c4257b1-797b-4b8b-9a8f-269b8d5319cc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\6c4257b1-797b-4b8b-9a8f-269b8d5319cc.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 2af0fe75519b561affc50e3d71e330f6cc1c2fb2274be627ae4f650013b2888f
MD5 566beebc505feaad252763cae8b82fd3
SHA1 db95baf43269a33b53749a4154031cfa20f8eeb7
SHA512 bc1f8bc5146c31b68883bf340d8064c83c059f15d1e0ad670e04cc5214eadd4cafd90e304a940eab2c22dfd33c68329fd70694f6245272053dd5f8ef9c216ff7
TLSH
T19141D658B7E91148B3B76E4AABF6A4AD48BB79773E06D95D00110D4E0A66B00CCB1B37
MD5 SHA1 SHA512 TLSH

Submit Download