hxxps://packer[.]wtf/dashboard/polls

Analysis

max time kernel
898s
max time network
885s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
28/07/2026, 15:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://packer.wtf/dashboard/polls
Sample260728-s31xtaygra

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3064	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134297268030380848"	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2058276091-3280583803-376660292-1000\{AAF9391F-02B8-4185-99D6-05212CE9A893}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3140	msedge.exe
3140	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe
4580	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 4580 wrote to memory of 3492	4580	msedge.exe	83
PID 4580 wrote to memory of 3064	4580	msedge.exe	84
PID 4580 wrote to memory of 4152	4580	msedge.exe	85
PID 4580 wrote to memory of 4152	4580	msedge.exe	85
PID 4580 wrote to memory of 4152	4580	msedge.exe	85
PID 4580 wrote to memory of 4960	4580	msedge.exe	86
PID 4580 wrote to memory of 4960	4580	msedge.exe	86
PID 4580 wrote to memory of 2668	4580	msedge.exe	88
PID 4580 wrote to memory of 712	4580	msedge.exe	89
PID 4580 wrote to memory of 2668	4580	msedge.exe	88
PID 4580 wrote to memory of 2668	4580	msedge.exe	88
PID 4580 wrote to memory of 712	4580	msedge.exe	89
PID 4580 wrote to memory of 712	4580	msedge.exe	89
PID 4580 wrote to memory of 2864	4580	msedge.exe	90
PID 4580 wrote to memory of 2340	4580	msedge.exe	91
PID 4580 wrote to memory of 2864	4580	msedge.exe	90
PID 4580 wrote to memory of 2864	4580	msedge.exe	90
PID 4580 wrote to memory of 2340	4580	msedge.exe	91
PID 4580 wrote to memory of 2340	4580	msedge.exe	91
PID 4580 wrote to memory of 2548	4580	msedge.exe	95
PID 4580 wrote to memory of 2364	4580	msedge.exe	96
PID 4580 wrote to memory of 2548	4580	msedge.exe	95
PID 4580 wrote to memory of 2364	4580	msedge.exe	96
PID 4580 wrote to memory of 3324	4580	msedge.exe	99
PID 4580 wrote to memory of 3960	4580	msedge.exe	105
PID 4580 wrote to memory of 3612	4580	msedge.exe	106
PID 4580 wrote to memory of 4336	4580	msedge.exe	107
PID 4580 wrote to memory of 1780	4580	msedge.exe	111
PID 4580 wrote to memory of 1780	4580	msedge.exe	111
PID 4580 wrote to memory of 3140	4580	msedge.exe	113
PID 4580 wrote to memory of 4868	4580	msedge.exe	114
PID 4580 wrote to memory of 2092	4580	msedge.exe	115
PID 4580 wrote to memory of 4868	4580	msedge.exe	114
PID 4580 wrote to memory of 2092	4580	msedge.exe	115
PID 4580 wrote to memory of 668	4580	msedge.exe	116
PID 4580 wrote to memory of 668	4580	msedge.exe	116
PID 4580 wrote to memory of 4728	4580	msedge.exe	117
PID 4580 wrote to memory of 4728	4580	msedge.exe	117
PID 4580 wrote to memory of 1216	4580	msedge.exe	118
PID 4580 wrote to memory of 1216	4580	msedge.exe	118
PID 4580 wrote to memory of 2288	4580	msedge.exe	119
PID 4580 wrote to memory of 2288	4580	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://packer.wtf/dashboard/polls
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x308,0x7ffcac3dc188,0x7ffcac3dc194,0x7ffcac3dc1a0
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1920,i,10756863605050384710,420237702183818788,524288 --field-trial-handle=2308,i,2125486365148744774,4959669796128977321,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1672,i,6765610615356522813,10661059988772914252,262144 --field-trial-handle=2308,i,2125486365148744774,4959669796128977321,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:2
  2⤵
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2552,i,14980097763196249969,10133997913556145477,524288 --field-trial-handle=2308,i,2125486365148744774,4959669796128977321,262144 --variations-seed-version --mojo-platform-channel-handle=2676 /prefetch:8
  2⤵
  PID:4960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,14556878995508303708,1094098922123199992,2097152 --field-trial-handle=2308,i,2125486365148744774,4959669796128977321,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,3496614025637915516,1081833860557314917,2097152 --field-trial-handle=2308,i,2125486365148744774,4959669796128977321,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4252,i,12841662665549688703,4037007745922039895,2097152 --field-trial-handle=2308,i,2125486365148744774,4959669796128977321,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:1
  2⤵
  PID:2864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,5727769122533670443,1342620050902372094,2097152 --field-trial-handle=2308,i,2125486365148744774,4959669796128977321,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:2
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5468,i,7930580749150830599,5250225733525961376,524288 --field-trial-handle=2308,i,2125486365148744774,4959669796128977321,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:8
  2⤵
  PID:2548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5464,i,14461256473246538408,8726977907546530999,524288 --field-trial-handle=2308,i,2125486365148744774,4959669796128977321,262144 --variations-seed-version --mojo-platform-channel-handle=5408 /prefetch:8
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,9777281739795097248,15098437429733407845,524288 --field-trial-handle=2308,i,2125486365148744774,4959669796128977321,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5888,i,9777281739795097248,15098437429733407845,524288 --field-trial-handle=2308,i,2125486365148744774,4959669796128977321,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5044,i,11533280347286698353,17844719276448892122,524288 --field-trial-handle=2308,i,2125486365148744774,4959669796128977321,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3636,i,10582506363020483894,2926781832899810415,524288 --field-trial-handle=2308,i,2125486365148744774,4959669796128977321,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:8
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4412,i,9859809469811414633,2073193291859109418,524288 --field-trial-handle=2308,i,2125486365148744774,4959669796128977321,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:8
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6364,i,14872390788640829606,341326690146275160,524288 --field-trial-handle=2308,i,2125486365148744774,4959669796128977321,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:8
  2⤵
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5632,i,15456735562698128687,2550195833073477150,262144 --field-trial-handle=2308,i,2125486365148744774,4959669796128977321,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,10107274832793864239,13365241523293975266,524288 --field-trial-handle=2308,i,2125486365148744774,4959669796128977321,262144 --variations-seed-version --mojo-platform-channel-handle=5520 /prefetch:8
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,1739369050696982428,3032414776513314898,524288 --field-trial-handle=2308,i,2125486365148744774,4959669796128977321,262144 --variations-seed-version --mojo-platform-channel-handle=6084 /prefetch:8
  2⤵
  PID:2092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3228,i,15870639324185313938,5008851728570092559,524288 --field-trial-handle=2308,i,2125486365148744774,4959669796128977321,262144 --variations-seed-version --mojo-platform-channel-handle=3220 /prefetch:8
  2⤵
  PID:668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3376,i,14207775390505690406,13468680038328059346,524288 --field-trial-handle=2308,i,2125486365148744774,4959669796128977321,262144 --variations-seed-version --mojo-platform-channel-handle=772 /prefetch:8
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5496,i,9589523853783844934,4043333148820709957,524288 --field-trial-handle=2308,i,2125486365148744774,4959669796128977321,262144 --variations-seed-version --mojo-platform-channel-handle=6676 /prefetch:8
  2⤵
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,7126527606632339882,3666631531127818711,524288 --field-trial-handle=2308,i,2125486365148744774,4959669796128977321,262144 --variations-seed-version --mojo-platform-channel-handle=1076 /prefetch:8
  2⤵
  PID:2288

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1312

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 deae8ba3a07225fe9f1490e4968fd83f8d308707a88a6d3d541d8ab416841ddf
MD5 1fcf11901014bf515178c91bdb7a6c5c
SHA1 4746b018067d9671617515224b7697b27fd2fc5f
SHA512 6059830103275d34e1aa4dd4e8d4177b6c2b684b2b3ad5417753387a227c838c0b258e662c78853cf649656ebd762f5d160c10349cd19ac1953380bd6572c660
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7p:fwUQC5VwBIiElEd2K57P7p
TLSH
T16EB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9991c48ed8914879dae4effcec150d36bec17d010668f447d8f9cade2568ef52
MD5 2b78928af0525d555cba6be0800700cd
SHA1 c47480c0d63ca33a357bdeae4e0a2b4778e4464d
SHA512 6bc6c0cf883cc43a054d194fde4d18e99c2cbbeb4a8d8d02877029180da59e5d35cf8681da958469d6f20c0b488cb0657a9b8230375256327c3a614ac9ee7298
TLSH
T18AD01236BA1AA404E61A8231A42E87019A1A59A014964B06A254D42C96B409862AF593
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 25702f00b9ae3e59191c9934c14d23ed967e0529851788b808888646dea4d732
MD5 ffa356b657a3409019fc8a239c32c6a4
SHA1 0d51c84aa86ab7959c598cad1154ad13f00af759
SHA512 c83ea8fc753dc36b208df6ad992709ac8598c211965482ecabbc7cb3003aa09cf7cf7dd16ddb5bb30a93ef60e91ddc256b634830a8856ba86888c4fe6d173b24
TLSH
T126D080367B5EB404E71BC231A42EC701DB1A59F014968B07E254D42C97F40DC63EF593
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 0bdd9024f464bad84d2f61835aa30d9be21472ef01d1d8cbb687bc565286e9eb
MD5 165d501e75a10e86c1373304e2143d9f
SHA1 d57e84ba81dece489d5df84ef8bb3d70a80635ae
SHA512 807bcaf351e98dc51f6ff552525d44f01d2bc27a2c20788e8ea49aed656d7fb753ce4b283989d0db8d9824c32decb8e7b5b0b825e4755180f701e738dee46c42
TLSH
T132E0209418C5C22F9214E9C7826D570C41423E0AD2CC7D05670888943142444EFA3694
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 1KB
SHA256 e720a79a8044b7d86baebb81401386c64ffd94d328c937dcfab8e77d5340fb01
MD5 1fc3ad5da1ab62ccc08809232f7d5b98
SHA1 4df4dbfeca91dd2af6cac334c4167d3e18d302f1
SHA512 2fc681b046417355b767358bde1460f55056d71e566b5225abf8b81d34340d8f598ec89a88558d89ee26d139cf18346eb0586eb1ebd42128310b1ec6e87c6826
TLSH
T1E941BE4747C5C25F8B0A14C6496C626C00733F09EBDCDD943B8C9DD9364E89AF5BE590
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 be2e2ad3d2d4437b412cb16a303d64dd4b6ab3083900a9d243427ec596d8eeed
MD5 6fff17dea4e1c6b71e66ba8e014949ae
SHA1 5669febf3b564d1634cc4fed80d3849e9a798721
SHA512 d2b57ebe94d2ef2a4bd23c9b1adef5c6184412a8242e7444f0172ef34217d44e28b52f0ce6c21321bdf41936e2dd277bccd55e1e7570e44b515371fe0f8ab52f
TLSH
T10BC08098B98C845DC285187EA726F00007606561941796135560BCC03140DB01E2E120
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000081

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000081
Size 1.4MB
SHA256 f1c3cca3e7a2e933f4725977bd8f02bb658d18bd74782067e00ba328e2cdad1d
MD5 6d56052d2bcdc83caf226b33aeeb5425
SHA1 354ca0b1f4567dec6fe0896d3526a730dcf23a05
SHA512 55272a1c3d6021f1e021c2ab215cfe5de79fdafca4695754b9590b046c5667969a6de67bdbeae8698ffb95cecb753b0701139d0fe1353aaa3eae04fb82f15a84
SSDEEP 24576:n5idU/ZYIJis1vseGZKjMph5479aU6TiQ7V13Ku+VotJD6U8e0x3/y5mXOGwevmQ:4eZlisBseGYKqaU6TbV1pHt0xq5E3wed
TLSH
T10E6533132FD85E8CE16894FD92C92C6FDD94AAD338A63DFC82158737108594F89A9F34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 a39a41da2ea8c9fc3b239ce4a937f20213cd5366e928ec56661a3d5517e871b4
MD5 2511e4f629437d584a252a06e97f8567
SHA1 872f7cf8806a7f48dd601352f8f6a1542c384968
SHA512 ba3f084e429d936ce459d4a49b4a945da7c96ab0d859eb6509be3307bf9084bf4e83851e60078dea36da79c594b92f5a8dae01657d34b603652d3c1cef64bb76
TLSH
T14D818FA03542E465DFA9323EB5D11405B13B8F973DDF4E2B2C3088B4AC3E746253C244
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58af08.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58af08.TMP
Size 3KB
SHA256 146f999e7e1fd12fc8cabdfcaaff7034d533eb4d054b79eea4aada13b2c9b700
MD5 bb727e5a2d2b12147d77ddb7ec6eb898
SHA1 8179bc83f71c5dc24bfdfcb9250d8eb129998d61
SHA512 5eca4e38df5a11c1ec6ea1826069c6355887f68d6f6c88c149f4419d21167b5ba0ef35eea3302f66c77d6bde81fe1a727201d16a6ca02e6fe69a5bcce48aa715
TLSH
T101717C252602D855DFAE323DBAD11505B13B8F873DEF9E2B2C7498B9AC3CB0A653C054
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1325ea8c-a7b1-447d-82e4-358eca62b9fe.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\1325ea8c-a7b1-447d-82e4-358eca62b9fe.tmp
Size 1KB
SHA256 6f439c5c408336c47068990d11c070c5c6dbd6db730b862db66f2c3c4fb2aa31
MD5 fed816c35aa4ab6db8f3b69541461eea
SHA1 dee85325e229783d9f32fdf82a3902458f6c12c7
SHA512 998137ce0425289ccbbdee0e8f8664c4360c7836fc3ff8d09b580e31bd6c036a4f467ecdc51dd2907f18f9fcd62840c79e9d69be6f2ab4d7af25b797d40c110a
TLSH
T154318CE7C3E4866DC91216F0A614BE27CE2E091547683D2AC9D4FF5BA3E20B1E20165F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 5909b5bf92b4e5447b7581690f8121de346a323526f5a4596d847a5ea6ea1a5b
MD5 09b7f098b4f70fdbbc19de92da7d8085
SHA1 48d3b065b77f9416ea6da2863c4adcccb2e3410b
SHA512 8746f2142c65f3e8a5c8a4b56d47c7b973bf27b38fe0a5253cfeee110b6297c9dd4cbd3d7ca2b522ac1250da456138de2c129f52977bb1dfcee5fe4bc13bf5a8
TLSH
T13131DCB6C3E586ADC91216F0AA14AE2BCE5D0415436C3D2AC9D4FF1BA3E3071E201B5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 88568f8683596ed3766cfe4921f2febd01956438afcaf408591115d0a7507df0
MD5 6634f0cf4b527728703d2213642c1497
SHA1 e9288b29c941f2bf4938e8521be69c70b56d9727
SHA512 1286c238d54b8b64722c19ee0e0912eb34f11cd56c5905b52b6149c2d26ceb46dab2eb13ae93a60b8ef0179070a3c9703843dba007ff05e6123e7bb844b99f68
SSDEEP 192:sxZWRhyM/jK1Ml8UQYkt/fVs0cs/Idpv2IHW6+WNVV7J/YrCZ51Fa+Ig5YJ:sxZW/q7t/fVs0cjPHbJ/x5FJS
TLSH
T1E352D816AB385977CCDBD209B951BB53D6F94872D2900E44A9FC8A0C00E6BED621781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 12d1d1f6e1b0f81dce0e0e171e03fafac1b10ee47db89b09fa802f77f2a1d382
MD5 d5ad6bfce7afdf8ba536000342f6fe74
SHA1 2b7f893b1096279c0be58735741d2e7f11992167
SHA512 c3d26e0270148c49c1fea6c2040a40ef639b613dd846a67c12a7d0afc80fdeea0e0447cbe282ffb5c307b5d7a7fcb9919698db20450345a02c028e90c63985c8
SSDEEP 192:sxZWRhyM/jK1Ml8Mkt/fVsxqs/IdpV2IHW6+WNVV7J/YrGZe1Fa+IgrJ:sxZW/Mt/fVsxqjNHbJ/9aFJ9
TLSH
T19A52E916AB389977CCDBD209B9547B53D6F94972D2900E44A9FCCA0C04F6BEC621781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 82c6345dfeb144b6a5b0fe4fb090ccee85051388c395144d34adc13285a0071a
MD5 66a153a0b2c4e90871ed14acb3bf51fa
SHA1 72c30d12acf31684fd364e7368a7560b01659151
SHA512 c2cc4f36b9ca6c2801a65aeb85aa8e82b59ce257e1fdbc5173f3f1ebd774e9e4efd9102dfd483606fdc194ce839f7120895ff7a52c78687af3c6606e64f2d6e9
SSDEEP 768:sFgL6XeWviSnq8F1+UoAYDCx9Tuqh0VfUC9xbog/OVXJLlZzaR7roWZ4T+Gl:sFgL6XeWviSnqu1jaSJL7+RIWRGl
TLSH
T1F6E20A3B690CCB7E4F840E5CED26AF876DD801CB9B984D5447FA494C03C77EA512A49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\397b81f1-cb28-40a0-9bf0-a358344221c6\index-dir\the-real-index
Size 1KB
SHA256 5d2fa9b591d9039a4a447d1981d35acae4a50baa4b31a8abcc4d495918980273
MD5 0b20e1eaf5211ec4bf2166aeae80a3d2
SHA1 0b3d09e4cd20e7bc1ccb8554d17e3f911987e76e
SHA512 67842c16e7bd613d2f4222e71f309392907242a217ba3a0e899b4c3095b30850eeb99ff44d241df118327e29407d337ba5dac8c6036ce0cf20e51fa442198f83
TLSH
T1293123898ED1ED5FF85445B71572B4A8737089CC5710E7235C3C22322E1638E1A5B1DC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ced17.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\397b81f1-cb28-40a0-9bf0-a358344221c6\index-dir\the-real-index~RFe5ced17.TMP
Size 1KB
SHA256 8f5483c051b741bd07d6b09ad824d56f0249b0ea456e341e05faf88da07e28db
MD5 286d6ccce84b0ae6952a7885f875efd5
SHA1 83e57a2915caad7999f27f5305e97b1c33b56d58
SHA512 244c10163eb8355e2865b7031a34184663475ebc866efebc3d89da71b9927586c94952aa6b2239f10e6c5c99e0bc353b1c2d16abaa57bb63b12e8e20b8b89724
TLSH
T14A31358A4A918D0BF8D450771E63B8B8733588404711B793987C62399D35B8D2E5F0DD
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 6638d072855c9de114da01c4d8fb7741849d612de1af3a9fdc952b047e951b85
MD5 bb673b1d602e9941f346dcc84b1fd40d
SHA1 8b841c26bc83a3fb74e5bbf19c1b8fe164c49f1d
SHA512 9dfa899832a2ab0848e7532a4fdaf9c0dcc6e552d082c14587a5c5e30bca4581fe887384d106af4b51c6968c149abfbaf0ba04486789efeb95ec2420d2d8f8ca
TLSH
T151E0D8F728E71A14A8BBD3E214724DA541817995C948AD4E1015A29352B5319245DC71
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 ca6af3317af573a419a27db2dc9c6bb953c65593d5e99871aedd14451bc5efdb
MD5 e555652f9113599721401d708720dc70
SHA1 d143918ffd1ba259120e1d7c12f55319451ef2cf
SHA512 ba8e597d9f10d558cbd7ebba40f28bfb589d04ae8c1eb2f1731b7b8261bfbe576108049e089b6e32542b36ec8d117e1c1716596fa3baaaee42cb06887db878bb
SSDEEP 48:KsWT8Ae0k1VIRIIqo1K3E/u1r2lQ5M1IdKW7QIjKd6cTyFHIRK8oM+:KwX+KUsy1uKW7QgKd6iGHaK8oV
TLSH
T1B9B14755713B420338BD2918A696863A5D8231A77628A56F7B7E54E10E37E320FFCCCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 95af6d07b5f1b084446cd333227331ca5e4e154a143cd1acad43fb012184ada0
MD5 5dbefd685cc9830f4ee41e517ecb814c
SHA1 e60a5f784d95fdbefe87dc6212e9e2737d401062
SHA512 1ed82419648588b6cdfffa8ffdfaecc1385114e6e9d4c035661a9cd0aee3e2bc89e6651d19588e7896cf2bc53181c6d24eda40c0ed25cab53a268255e6d5eff2
SSDEEP 384:FZcIUvzsNCkoyBH4g8fbYC19uO8R+2YyXYovTOObjI9G6w7KUY:9ULyzCjnePY63T29M8
TLSH
T170C217F698E74832D9AE6713B77E2D120EBCD027B6842A44B7D85B0CCD9A57FC305405
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 96453232278a4413c49a44c3026105cb90de7a1129e6d557718adfa5d9ed320f
MD5 d7da41fcc4535f986f9b27daa870d8c8
SHA1 e8d72cde2981dec6fe3988ef51b54d3c55c09690
SHA512 8b08f8b14c1b53a912da7f96d1a1ccc81001321333776f59a1616738591aebc1f04ba11d19529e63d047b459a69bfbc9259e0974efbc87df62515ca5da898322
SSDEEP 384:rZcIhsNCkfyBH4g8fbYc19uO8R+2YyXYoWTOObjI9G6w7KUY:zhLzcjnePY6OT29M8
TLSH
T120928D339C389C779EA7A551F4863A274FF89427E7D82B84E5EC6F0C06EE59C4305816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 897e9adfad32378f777a51861559e63be84aca764422c1e575f6c63071b6e046
MD5 c08c28486127ad6c8970c3d1b2a6e12c
SHA1 e706af56a60f655309b220a82631f5a5afed878a
SHA512 158299fac658400a32359dc3dab62893f2ba2998cbb42682214f1a8345e13f9cbac9d23d302a9c8cb97d8c378b012bc9e46ebd142871dedbf109b4180e5e7d26
SSDEEP 192:YON26LCWtDQmiUyhNILSuOCzZu2+TsEdTU6:YON26mg1uImuO8R+9NU6
TLSH
T1DB02DA36A96C5C779EF37E45B4873B276FA4113BE9902F54DAE81F0C01EB64C2306926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 d8049fd6b9af79e3c50a23105cceaeb2e026f9f8d135f6f4cddbb87e6ff4a4ec
MD5 06def0583d268db9ce74f1c3c99e8b29
SHA1 c99c405748fb90792b10cc2615f6df239f67b711
SHA512 ee8060a743d48eb9c1f68ae3655fc90500da91a75ef7aff74a1d431612e9c3d24f59bdf6a2488ce78c8b1264bde7705bff4bcafed0d89fe422da3760726be5d4
SSDEEP 384:CZcIhsNCkoyBH4g8fbYc19uO8R+2YyXYoWTOObjI9G6w7KUY:whyzcjnePY6OT29M8
TLSH
T19A928D33AC389C779EA7A551F48636274FF89427E7D82B84E5EC6F0C06EE59C4305816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 60ef1ffd09f7c038d581ec852c253828207b477c18df7dddf3b13f6e399c5f49
MD5 534494a2a9ab3891d74a4d276f83445f
SHA1 b6d89e5a65ad121f12acbbbc29dd60734df321d4
SHA512 e27b7aa5d552dbb8237e44f4b5f9898279e4aa8e7d69e4e6d861778f57badaac152139f226ed0d09d3b5fdd984e5516c4ef1196aee9bd041dc6528746e94c5c7
SSDEEP 192:nONb6LCWt8QmiUygWNHLSuOCzZu2+2YyM8PwoDI/FqmU6:nONb6mgMfkHmuO8R+2YyXYoKTU6
TLSH
T190122B37A8289C775EE27991B48736275FB85127EA843F54E9DC2F0C05EF68C230AD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a7a8ee8d-4ac2-4114-a39b-3976a7f3c2bc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a7a8ee8d-4ac2-4114-a39b-3976a7f3c2bc.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 4f0ee068c8645bd8300ec1e1aa821270d2bc28e4be2e7fb54ac640fd53c8e6a2
MD5 16ebe20ddf7f747c93a2507c48e11f3d
SHA1 ad33d54aaaab830585d68f8580e4ff73b0d49fda
SHA512 51810101c28b3f108d4e2685f6f9d1a142ba2126784b4ab751be9865bacf6aa9e11b2cbb4f320ad2d6c87ad69be01aefab503fcbcef3799cb39d9956ed46a812
TLSH
T106412A58B6E91158B3B76F6AABF7A52E447FB8372F06D16D10010E4F0A22B40C971737
MD5 SHA1 SHA512 TLSH

Submit Download