hxxps://packer[.]wtf/dashboard/polls

Analysis

max time kernel
899s
max time network
899s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 15:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://packer.wtf/dashboard/polls
Sample260728-s31xtaygra

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2256	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134297268087229272"	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1875162379-3804078649-638427191-1000\{03469F89-FE38-4583-9C52-82F1DD8912DE}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1875162379-3804078649-638427191-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5080	msedge.exe
5080	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe
4900	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 4900 wrote to memory of 4116	4900	msedge.exe	89
PID 4900 wrote to memory of 1480	4900	msedge.exe	90
PID 4900 wrote to memory of 2256	4900	msedge.exe	91
PID 4900 wrote to memory of 1480	4900	msedge.exe	90
PID 4900 wrote to memory of 1480	4900	msedge.exe	90
PID 4900 wrote to memory of 1020	4900	msedge.exe	92
PID 4900 wrote to memory of 1020	4900	msedge.exe	92
PID 4900 wrote to memory of 5276	4900	msedge.exe	93
PID 4900 wrote to memory of 3020	4900	msedge.exe	94
PID 4900 wrote to memory of 5276	4900	msedge.exe	93
PID 4900 wrote to memory of 5276	4900	msedge.exe	93
PID 4900 wrote to memory of 3020	4900	msedge.exe	94
PID 4900 wrote to memory of 3020	4900	msedge.exe	94
PID 4900 wrote to memory of 248	4900	msedge.exe	96
PID 4900 wrote to memory of 124	4900	msedge.exe	97
PID 4900 wrote to memory of 248	4900	msedge.exe	96
PID 4900 wrote to memory of 248	4900	msedge.exe	96
PID 4900 wrote to memory of 124	4900	msedge.exe	97
PID 4900 wrote to memory of 124	4900	msedge.exe	97
PID 4900 wrote to memory of 4984	4900	msedge.exe	99
PID 4900 wrote to memory of 4984	4900	msedge.exe	99
PID 4900 wrote to memory of 1604	4900	msedge.exe	100
PID 4900 wrote to memory of 1604	4900	msedge.exe	100
PID 4900 wrote to memory of 5976	4900	msedge.exe	102
PID 4900 wrote to memory of 6024	4900	msedge.exe	106
PID 4900 wrote to memory of 4644	4900	msedge.exe	107
PID 4900 wrote to memory of 5720	4900	msedge.exe	108
PID 4900 wrote to memory of 2832	4900	msedge.exe	109
PID 4900 wrote to memory of 2832	4900	msedge.exe	109
PID 4900 wrote to memory of 5080	4900	msedge.exe	111
PID 4900 wrote to memory of 5660	4900	msedge.exe	112
PID 4900 wrote to memory of 5660	4900	msedge.exe	112
PID 4900 wrote to memory of 1440	4900	msedge.exe	113
PID 4900 wrote to memory of 1440	4900	msedge.exe	113
PID 4900 wrote to memory of 4080	4900	msedge.exe	114
PID 4900 wrote to memory of 4080	4900	msedge.exe	114
PID 4900 wrote to memory of 708	4900	msedge.exe	115
PID 4900 wrote to memory of 708	4900	msedge.exe	115
PID 4900 wrote to memory of 4132	4900	msedge.exe	116
PID 4900 wrote to memory of 4132	4900	msedge.exe	116
PID 4900 wrote to memory of 4064	4900	msedge.exe	124
PID 4900 wrote to memory of 4064	4900	msedge.exe	124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://packer.wtf/dashboard/polls
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2cc,0x7ffe1993c188,0x7ffe1993c194,0x7ffe1993c1a0
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,13543576757153216615,13217534280677932682,262144 --field-trial-handle=2256,i,12258607814126903382,11979116024316482131,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:2
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1904,i,16884593898858495454,18143927093515369803,524288 --field-trial-handle=2256,i,12258607814126903382,11979116024316482131,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2440,i,16459299694180687690,1768786544360244560,524288 --field-trial-handle=2256,i,12258607814126903382,11979116024316482131,262144 --variations-seed-version --mojo-platform-channel-handle=3048 /prefetch:13
  2⤵
  PID:1020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3548,i,13050013601656436188,11250876602100125747,2097152 --field-trial-handle=2256,i,12258607814126903382,11979116024316482131,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:5276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3556,i,1598478392795331326,4389784654447063479,2097152 --field-trial-handle=2256,i,12258607814126903382,11979116024316482131,262144 --variations-seed-version --mojo-platform-channel-handle=3596 /prefetch:1
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4264,i,945593847372135674,13958995632172822805,2097152 --field-trial-handle=2256,i,12258607814126903382,11979116024316482131,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:1
  2⤵
  PID:248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4312,i,11703620496123033626,14173066679627679474,2097152 --field-trial-handle=2256,i,12258607814126903382,11979116024316482131,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:9
  2⤵
  PID:124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3732,i,8653487673178183226,17175790528521332407,524288 --field-trial-handle=2256,i,12258607814126903382,11979116024316482131,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:14
  2⤵
  PID:4984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3744,i,6755678932446171155,6472067118963049562,524288 --field-trial-handle=2256,i,12258607814126903382,11979116024316482131,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:14
  2⤵
  PID:1604
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,8179323776108558511,14228821814430297063,524288 --field-trial-handle=2256,i,12258607814126903382,11979116024316482131,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:14
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,8179323776108558511,14228821814430297063,524288 --field-trial-handle=2256,i,12258607814126903382,11979116024316482131,262144 --variations-seed-version --mojo-platform-channel-handle=6348 /prefetch:14
  2⤵
  PID:5976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6428,i,1476980692144453663,17762886713956363035,524288 --field-trial-handle=2256,i,12258607814126903382,11979116024316482131,262144 --variations-seed-version --mojo-platform-channel-handle=4964 /prefetch:14
  2⤵
  PID:6024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6424,i,9004780326525596056,1842286642510953690,524288 --field-trial-handle=2256,i,12258607814126903382,11979116024316482131,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:14
  2⤵
  PID:4644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6364,i,13043113708829053021,13498680084399272132,524288 --field-trial-handle=2256,i,12258607814126903382,11979116024316482131,262144 --variations-seed-version --mojo-platform-channel-handle=6788 /prefetch:14
  2⤵
  PID:5720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5728,i,6399898154547184650,615908511386462279,524288 --field-trial-handle=2256,i,12258607814126903382,11979116024316482131,262144 --variations-seed-version --mojo-platform-channel-handle=5732 /prefetch:14
  2⤵
  PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6684,i,4813075751502694408,12231255547657373001,262144 --field-trial-handle=2256,i,12258607814126903382,11979116024316482131,262144 --variations-seed-version --mojo-platform-channel-handle=816 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6936,i,12291528014505068129,18168652547697131738,524288 --field-trial-handle=2256,i,12258607814126903382,11979116024316482131,262144 --variations-seed-version --mojo-platform-channel-handle=3372 /prefetch:14
  2⤵
  PID:5660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,17850020200032426256,3988092795765909973,524288 --field-trial-handle=2256,i,12258607814126903382,11979116024316482131,262144 --variations-seed-version --mojo-platform-channel-handle=4084 /prefetch:14
  2⤵
  PID:1440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,5801125809047734229,11588071829643201831,524288 --field-trial-handle=2256,i,12258607814126903382,11979116024316482131,262144 --variations-seed-version --mojo-platform-channel-handle=6988 /prefetch:14
  2⤵
  PID:4080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6080,i,4308383802575467508,18270665971160014791,524288 --field-trial-handle=2256,i,12258607814126903382,11979116024316482131,262144 --variations-seed-version --mojo-platform-channel-handle=3240 /prefetch:14
  2⤵
  PID:708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7156,i,9728587121762028564,18266355398728620927,524288 --field-trial-handle=2256,i,12258607814126903382,11979116024316482131,262144 --variations-seed-version --mojo-platform-channel-handle=7148 /prefetch:14
  2⤵
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5632,i,8220298944066477493,8522509968095845646,524288 --field-trial-handle=2256,i,12258607814126903382,11979116024316482131,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:14
  2⤵
  PID:4064

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3888

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1392

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1560

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:2384

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ecdd5c8034c45eff453cbaf31d8886e2bd9609a73853367a6d096a69cc81f1be
MD5 a774534a956a5c8affebe08e87c80683
SHA1 b3e4e20a91e4087d3b9247b5ef6815f51858a041
SHA512 27769aee2cac148a0154fe42b51da2a9a1088e9e990873915b4c7ab9bd5442a3facf82b2bd1cbaef75328bd5937813698b96ac06aa76d934d07ab5ebb194a824
TLSH
T103D09B6673449A1CC9C439712461565161115820E41443581C96715CCDE56C707571DE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 dfacefa73d018d54e3feba3eef28ec722a8422fee8768a2c3d8d6253f863b375
MD5 cb5000b6fab1115bfff50bedcc3eb9fd
SHA1 afbfe0ec03df59e7a1eba1da4227111508419c03
SHA512 aab9a1afd5de2f983466724b6ecf0dbc2e176c5a1eb2f059b9507511cc53643fcf9ed990bd565f22f8d53fb82db71cba238962a75c68db02d5f10b526661bd08
TLSH
T15AD09B667354991CC9C439712462565161015820941443581D96B16CCDE56C707561DA
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 177b194f1ffbd10bd5130eff4f1c0cd2d5fcdd2540e4d73177983051c50905a6
MD5 84750a0c177c1ca1679b4c4a54cdeb2b
SHA1 6f83e3b070c3f5ebbfdedee5b12c3fded716759e
SHA512 02fe22e0c41ea171bb62075ffc3f0e5d1a64c2303a12a308c257daa44ff070c80a08f97af67a5dfc7d72a9592b7ad8c7c10a854fb7d7451f0043e87668de0e8b
TLSH
T117E07DE514CEC32EA24064DB416C974C82C3BE0AD7C8AD9A3F08CD897A83540F7E7690
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 36dac46efcea1fb1e2992c8bdf774dc6ba6dea9eb7ad53b11bb9ad238ad226b5
MD5 9ff781e58d205e503d4a747053207d14
SHA1 339b8f7bc75eaf2b0fe832fba36670d1f2d4bfdd
SHA512 e819ee3788a920b329abe0554558ce0a3e7cd2042ac137868aa9cd0fdb44c805ecd357c69225e802a6e18b45bf4b50330366c04ae3c0736cde2704b57fa2c524
TLSH
T173E020C414C6C26F6118B887417D5B5C81923A4A92C46E453B0A8CC47101484FF93564
MD5 SHA1 SHA512 TLSH

Submit Download

f_00007d

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007d
Size 1.4MB
SHA256 f1c3cca3e7a2e933f4725977bd8f02bb658d18bd74782067e00ba328e2cdad1d
MD5 6d56052d2bcdc83caf226b33aeeb5425
SHA1 354ca0b1f4567dec6fe0896d3526a730dcf23a05
SHA512 55272a1c3d6021f1e021c2ab215cfe5de79fdafca4695754b9590b046c5667969a6de67bdbeae8698ffb95cecb753b0701139d0fe1353aaa3eae04fb82f15a84
SSDEEP 24576:n5idU/ZYIJis1vseGZKjMph5479aU6TiQ7V13Ku+VotJD6U8e0x3/y5mXOGwevmQ:4eZlisBseGYKqaU6TbV1pHt0xq5E3wed
TLSH
T10E6533132FD85E8CE16894FD92C92C6FDD94AAD338A63DFC82158737108594F89A9F34
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 4605ae99c96f2364fa30c828e8faa80d80ad5350ac28852f21e90e7629ab14cd
MD5 0ad0118f4aeae88b97fc98820dd3ada5
SHA1 20de8368677e42f55518785c48cbabef7d9f1642
SHA512 4132c385e0f3cf389d16dd687beadea0c917ff6ef0ddeb0493fda36acf69e7f921f8527ddbff0bde5c3525bf92b46f17d50b7e53dc25bfaee64b5e163c53b014
TLSH
T1C6716EA4036E5DEADF3081B3F5A107B4B1F09CB58903DE008D9A2E348922F0E72CAD13
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe595d0a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe595d0a.TMP
Size 3KB
SHA256 233d529784c70311405aa94c05bf9ac0850f24963af360b7ae55b79c6f72a163
MD5 bcede0d2fa5d16b21890508e28bb56e6
SHA1 9cb0d56015c7675be8e6b3610644f80f783f9a68
SHA512 517ec24f0cc66403e2abb02471e540c0b33fbd1a6be9f12dc338479c414e6f9025116c5fbc695d33f690029f6877d4a76b0692bdea0e892f9e448a53eece0ebf
TLSH
T160612C54032E4DEADF2585B3F5A047B4B6F08CB49D43EE40999A2E348812F1C72DAC67
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 0da088db86e971ef4f6fe8d784f214750c1da9db721dba8e3f154ed8e83ce8b2
MD5 81a38f22826489f0cf92f54b7385d8be
SHA1 56cd6234a0b43eaf7e0a4494753434e2994508af
SHA512 5bffe7e50a326ea0a2011e72becf8b465cc53c86078d63c49eab0b0d2c18ff4b9767d024e85a0cad4c36a4f61a91dc8d522c2a3602e20588b35f366a526efb9c
TLSH
T1F951E0F7C3E4866DC90252F0A6146E2BCE1C0915432C3D6AC9D4FF1BA3E2471E241A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 7f02f75fcecd5adaf9d4ac812caee28510954330230d72152119eacfcc3707c6
MD5 2c106ca876d060516a2661089cf0db70
SHA1 fa14ef6c7a91063f7690b13755147820ef0218a6
SHA512 e0caf9abbaa39ef962f57af452e0805ae25eac5856be2bfbc8fa46a1b6799f46b2199edf44e655384ae528f57d7b4c14869472ed3e46a06ed28e298e042c76f7
TLSH
T172519DF7C3E8866DC91256F4A7147E2BCE1D0915836C3D1AC9D4AF1BA3E24B1E20165F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 36f60e05eb14184f2f7aeff05b30f48fa6bfd529fb90ab8b56181224afbc2454
MD5 d05614452d3c6f68976efc53568d7e08
SHA1 f939e98fae8859b6b3f5649cf1de1c1cb12114a5
SHA512 ecc4123b195b8f4970f86cf3ccf00a518c4920eba67d1dcd050aab8a7c09e5ab8f6638b43beaf7b69ebe2c7a7624922c9433f2382ca1aef57e370fd4a9cece65
SSDEEP 192:sxR+5R4bPB/f1jsOvKCA94/A+zoA8ps2Rl/g6+WNbVCpT/YD9x6SxGZ5IgDbNJ:sxRo8Z/fBsOvZ8xX/5O/TSYX
TLSH
T18742C71AAA38997B8CCBD21DBA15BF53D6F95432A1D01E48B7FC960C04EA6DD620740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 d796e5342beb2bd2e2e4e3ed9aaf59faaccad0bc10919449ca6d7d04189284c0
MD5 e8fcc19cc7d79182bdfa9f603081a83b
SHA1 1a547ccf20128f54ffecc284522ab279838fc47f
SHA512 fdebcf9564fc4ec13afe44ebfcb638a5851bd6a1db224b73f4325b27e8b3709c90d4c45da0c713be65a37d23c2d0d2a658888e5ae3b0f806ab2179684997e7fd
SSDEEP 192:sxR55R4bPB/f1jsnvKCA94/A+zoA8ps2Rl/g6+WNbVCpT/YD9Y6SxGZ5IgIJ:sxR78Z/fBsnvZ8xX/5O/4SYs
TLSH
T1B032C816AA38997B8CCBD21DBB15BF53D6F95432A1D01E48B7FC960C04EA6DD630780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 26KB
SHA256 2162078352d144dc55bbfb3d6c772eadc520408d4c903ccf17dd145aa74ed4b5
MD5 84c99aaa4e2a1b8c68406b0c59733cd9
SHA1 3e127ed466f522f20e13fe54248185b1893afdad
SHA512 badd25a6dee59ebf50115ece38ca2ce329fa9ffdc09e7c2a122929372317f5e1f928cce8d4c770291dc696dc182e201413032eccc1195afc01366a2d7b04a47b
SSDEEP 384:sxRo8Z/fBsOJ66s8qMpRiYnazAW8pZS15posJWeT+jZ8xV/5O/8SYV:sE8Z/fNJ4Mnc7WeT+jZk/508S6
TLSH
T1C2C209099924C87B9EC3AD1D693D7E33DAEC506222C5DEDA26ECCA0C019D1FDAB47417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 566418aa557df35dae6363222649a313ce0ea0d6a5c4d42ff0cc69df55fb4433
MD5 7189d6efcee96b1dc259b8abf2180c75
SHA1 742b74783c31d60684a610dfa3003a332d915b40
SHA512 1982103794126625839cbeb57f810851a7535d3c74a7583ae3fa362011be18b7664e1405a3a9b53abc4f38b5be679597b962a01072999bfcce8748c723448982
SSDEEP 192:sxR+5R4bPB/f1jsOYKCA94/A+zoA8ps2Rl/g6+WNbVCpT/YD9c6SxGZ5IgDbjJ:sxRo8Z/fBsOYZ8xX/5O/8SYV
TLSH
T12842C91AAA38997B9CCBE21DBA15BF53D6F9543291901E44B7FC970C00EA6DD620740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 195b676d0cc389471d6b2ad07633b5b7ec8ea8021082e9fea5a2add63a2c2c9a
MD5 4551592020e154b3161ca308438c937c
SHA1 ae19d11c966112cad77ded7ff42dabaa83f1a0b3
SHA512 37643dd03e1d116cabf9e2e9ea2d50da9a9ce1c88616b7452ea4515de222916acf6e4f83621cde86009245072a30b2dc0d6be343233d86822e4121910a107532
SSDEEP 384:a8YfWRmfCtg/NFf7fKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVOe91bRcKropDR:azfWR0Wg/Xf7f8F1+UoAYDCx9Tuqh0V9
TLSH
T1EEB2EB2F200DCB7E5F800AADAD197FD76D9802C79B588D4047FE994C02C77EA921A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a9a7ce6e-5197-4ff1-8207-f896ff43d1d1\index-dir\the-real-index
Size 360B
SHA256 9d069ef46d745200874852604f73b0ccc30745a1774a9a1bd1a224879d04a150
MD5 e1cf856c366592b5ede0a35dcd99a5cc
SHA1 0c1076f78e7f5236ca425034b254f46f27eb2013
SHA512 bbec4f9ad5c8df7a6d85123608b38cf7367a216a44ca8f1c1fc49613b9fb796c4bbca84612e45d0c638a4cff9ee3127593668326d430289d0a79cea9f2ce1b27
TLSH
T1A0E02B8F8C639993CE36B87A0633A42A333F06FD1505FE6A10ED181D965663C8242609
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d93c7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\a9a7ce6e-5197-4ff1-8207-f896ff43d1d1\index-dir\the-real-index~RFe5d93c7.TMP
Size 360B
SHA256 5cf75742a4136436abab422882f09c1a69cc979b99490e7ebe22407f9f2fd888
MD5 ceed64af4222a4478420a77e0fb201cd
SHA1 ace7bdaa988102e74ada7b2cb93eccacd76bbb75
SHA512 41130ddaccf3b7640f2a07a63b1cf1e16435dc0c15f4b92a4b7335c43bae41c50ea41712263cfe088f4021e7b21d95ac9b2f1af4d6a11fb4d4ee507a698c7478
TLSH
T17DE02BDF40919D52C92659391543512A333F08352915EA1A20AE585E19627AC854560A
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 a73f5ac9603882dccea913a11d7b382357b2861916339526d5c4ae1f80c53829
MD5 c9c931fd1f41a2ea7413b64def8aac13
SHA1 0ef881ef79267ce5c7775b58a1dd73ba974b3c04
SHA512 660830a542ca503f895dcde8daba1acee01f0935ef98298240f95170bf5e510724e6ede2a9ba29a043a27ba294e84f6c04cf8427e3d754848cdafda9c7b31634
TLSH
T16CE068772AA71861ECBF93E1207048B00251B818C545FC1F006B92C780A2311281BC22
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59ed64.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59ed64.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 9d9d7206a220bc40b784459cd293cbef338a710ac71ba42214df20632e212dc2
MD5 f193ff0a406d9c99a5928bf18afa7ee7
SHA1 c8d172a7e9846f5d04825df9fc9d1e35e57cd204
SHA512 a8f812ebc6a8ee085a475ebded4a9de41c61e74e74c2572c0a6c523b70e811a40157e9ed3ae865661eaadc1f495cb9b5099162e793b30b49393cc51ee3a70396
SSDEEP 384:DZcIi38NWM+jVy5CWZlf8hyEGbXt9LFPy2rEoajo4cdR8eHhVODjYPNDUMIphObu:bi3LAbi0nttrEnjN3Gac1Fib9M6
TLSH
T112F2BF356DA48EB38CEBD75675833B03AEE08753C2D80BD4A6DDA70D05D7AAC5307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 40619d550ba9a78378801314e3c916351feaae95b590e4a508f62fe242117023
MD5 152583eadf365ba306af8de46ef082da
SHA1 f91f1ce721e4ac78086b16a002fc38e38b7d1eea
SHA512 07abbb9a52cf9c8e67777387f9264e435487293c8650f5d03c98eb7f8737ab83beb66b5b9d512a27f498294c667fadc156027ca87711fbf78495abc42cf2a90a
SSDEEP 768:frv+4UNbdl3H4bi0ntKrEnjN3Gac1FiBu:fbsb33+sQnjMa5Bu
TLSH
T19503BF3679B88EB38CEAD685B4477A037FF4464386C507A4DAC96B0C05CB5ED630B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 f4f008982cd547b5ab6e3da48f6f8002445e01dc3b63ce53df4be96d64615537
MD5 ad509fa1b70cdf671a1a9f3b59b2906e
SHA1 b994539c81d2d1a31db816b7c93d66a99f707b39
SHA512 21a710278a81378eaaf271d9b0abc4d143e9e492afc1f7ee4da11c42350c20a90a28ebf17d9620dd0a664d99c3c967a878693ea26d958e363da1d81ff562011e
SSDEEP 384:6ZcIi38NWd+jVy5CWZlf8hyEGbXt9LFPy2rEoajo4cdR8eHhVODjYPNDUMIphObu:4i3wAbi0nttrEnjN3Gac1Fib9M6
TLSH
T1DDF2BF356DA48EB38CEBD75675823B03AEE08713C2D80BD4A6DDA70D05D7AAC5307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 da8ef41bcded719bd6e65e8813d6b5325f57a2cb1eb5cf6e16be2cdd4714f1c5
MD5 778e92240f102cf9d124477c37d348a2
SHA1 c67a228543c669d59ec92f379072fd2a208ce167
SHA512 ad5348277e2ffc3f1c864fd824a95fa2f77e674c2439aeb572e81e24a6a863c0edec96e5339885f7df45e0312bf0c5d492dae0952b8f14dbd276fc1976720067
SSDEEP 768:CkF4I3FwgKAbi0ntArEnjN3Gac1Fib9M6:CRI3n6QnjMa5b+6
TLSH
T13603BF366DA4CEB7DCEBDB92B5463703AEF04363C6D84694A7CDAA0C01975EC5307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 50b0793968552425ad28e381f3624edf659b9dee26e835db7e54ef557736816e
MD5 71cab47e53182a5993e0f93575710448
SHA1 e7e9585887d94d1b1a7eff816c33e96b49744c38
SHA512 44adb453b6eaf3a62780a9466b4919b7790ee1584b7aece1b8f28fe26e3dbf2d09bfc4aafff78dc51de1f52018944f77ac0ba15a05583e3f6aded0f11896df21
SSDEEP 768:rrv+4UNbdS37mi0ntdrEnjN3Gac1ZJeVH1SCz:rbsbg3APQnjMaKEH1V
TLSH
T14203CF3669A88A738CE7E38575837A037EF4525386C40BE4C6DD6B0D069B5EC130B967
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5b38bd54-c42a-472f-ad59-9c084d35d2f6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\5b38bd54-c42a-472f-ad59-9c084d35d2f6.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download