hxxps://approve[.]taxrefundonspot[.]com[.]au/authority/rosanna-3646774c615e4d46b98c22067500d895

Analysis

user interaction
yes
max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/07/2026, 02:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://approve.taxrefundonspot.com.au/authority/rosanna-3646774c615e4d46b98c22067500d895
Sample260729-c88a3sdf82

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4220	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134297667672588153"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{766D37B5-24F5-4D7F-8080-48C82E3BBC14}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4248	msedge.exe
4248	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe
2400	msedge.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 932	2400	msedge.exe	84
PID 2400 wrote to memory of 4220	2400	msedge.exe	85
PID 2400 wrote to memory of 4828	2400	msedge.exe	86
PID 2400 wrote to memory of 4828	2400	msedge.exe	86
PID 2400 wrote to memory of 4828	2400	msedge.exe	86
PID 2400 wrote to memory of 880	2400	msedge.exe	87
PID 2400 wrote to memory of 880	2400	msedge.exe	87
PID 2400 wrote to memory of 752	2400	msedge.exe	89
PID 2400 wrote to memory of 1092	2400	msedge.exe	90
PID 2400 wrote to memory of 752	2400	msedge.exe	89
PID 2400 wrote to memory of 752	2400	msedge.exe	89
PID 2400 wrote to memory of 1092	2400	msedge.exe	90
PID 2400 wrote to memory of 1092	2400	msedge.exe	90
PID 2400 wrote to memory of 1060	2400	msedge.exe	91
PID 2400 wrote to memory of 1060	2400	msedge.exe	91
PID 2400 wrote to memory of 1060	2400	msedge.exe	91
PID 2400 wrote to memory of 548	2400	msedge.exe	92
PID 2400 wrote to memory of 548	2400	msedge.exe	92
PID 2400 wrote to memory of 548	2400	msedge.exe	92
PID 2400 wrote to memory of 2220	2400	msedge.exe	96
PID 2400 wrote to memory of 3348	2400	msedge.exe	97
PID 2400 wrote to memory of 2220	2400	msedge.exe	96
PID 2400 wrote to memory of 3348	2400	msedge.exe	97
PID 2400 wrote to memory of 1764	2400	msedge.exe	99
PID 2400 wrote to memory of 4440	2400	msedge.exe	101
PID 2400 wrote to memory of 4440	2400	msedge.exe	101
PID 2400 wrote to memory of 4440	2400	msedge.exe	101
PID 2400 wrote to memory of 2900	2400	msedge.exe	102
PID 2400 wrote to memory of 2900	2400	msedge.exe	102
PID 2400 wrote to memory of 2900	2400	msedge.exe	102
PID 2400 wrote to memory of 1980	2400	msedge.exe	109
PID 2400 wrote to memory of 1980	2400	msedge.exe	109
PID 2400 wrote to memory of 1980	2400	msedge.exe	109
PID 2400 wrote to memory of 1176	2400	msedge.exe	113
PID 2400 wrote to memory of 1056	2400	msedge.exe	114
PID 2400 wrote to memory of 1656	2400	msedge.exe	115
PID 2400 wrote to memory of 2428	2400	msedge.exe	124
PID 2400 wrote to memory of 2428	2400	msedge.exe	124
PID 2400 wrote to memory of 3908	2400	msedge.exe	130
PID 2400 wrote to memory of 3908	2400	msedge.exe	130
PID 2400 wrote to memory of 2728	2400	msedge.exe	132
PID 2400 wrote to memory of 2728	2400	msedge.exe	132
PID 2400 wrote to memory of 4248	2400	msedge.exe	134

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://approve.taxrefundonspot.com.au/authority/rosanna-3646774c615e4d46b98c22067500d895
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ff9744ac188,0x7ff9744ac194,0x7ff9744ac1a0
  2⤵
  PID:932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,8846973885996698853,13364558346615288246,524288 --field-trial-handle=2340,i,8956359310582131977,7575463570273672876,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,14905716657574859805,13083271957699208310,262144 --field-trial-handle=2340,i,8956359310582131977,7575463570273672876,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:2
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2464,i,14978783241550116524,2094698832664476392,524288 --field-trial-handle=2340,i,8956359310582131977,7575463570273672876,262144 --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:8
  2⤵
  PID:880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,7429681469175315177,7315009319143536657,2097152 --field-trial-handle=2340,i,8956359310582131977,7575463570273672876,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3468,i,10507758908570532368,7742341801561914833,2097152 --field-trial-handle=2340,i,8956359310582131977,7575463570273672876,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,3258796877085734943,13705797449196635557,2097152 --field-trial-handle=2340,i,8956359310582131977,7575463570273672876,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:1
  2⤵
  PID:1060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4280,i,12912247991756496916,8349721684910258216,2097152 --field-trial-handle=2340,i,8956359310582131977,7575463570273672876,262144 --variations-seed-version --mojo-platform-channel-handle=1620 /prefetch:2
  2⤵
  PID:548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5164,i,1365708578716565,596144965510319284,524288 --field-trial-handle=2340,i,8956359310582131977,7575463570273672876,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,13559997897416632240,2017586190011328053,524288 --field-trial-handle=2340,i,8956359310582131977,7575463570273672876,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:3348
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,427665602542272455,12769377179805837142,524288 --field-trial-handle=2340,i,8956359310582131977,7575463570273672876,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,427665602542272455,12769377179805837142,524288 --field-trial-handle=2340,i,8956359310582131977,7575463570273672876,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6228,i,18147002549611331015,14539510586140483757,2097152 --field-trial-handle=2340,i,8956359310582131977,7575463570273672876,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:1
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6404,i,4358275105483118058,5319952409439445050,2097152 --field-trial-handle=2340,i,8956359310582131977,7575463570273672876,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:1
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4972,i,10568043989893785973,14251561902590763780,2097152 --field-trial-handle=2340,i,8956359310582131977,7575463570273672876,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:1
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=560,i,10881150088659064682,6905566872222304515,524288 --field-trial-handle=2340,i,8956359310582131977,7575463570273672876,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:8
  2⤵
  PID:1176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,2852448750899843461,12697385441874391354,524288 --field-trial-handle=2340,i,8956359310582131977,7575463570273672876,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:8
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6432,i,12179398441428811929,560504994970310999,524288 --field-trial-handle=2340,i,8956359310582131977,7575463570273672876,262144 --variations-seed-version --mojo-platform-channel-handle=6404 /prefetch:8
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5176,i,17389625977212582769,959583641404329312,524288 --field-trial-handle=2340,i,8956359310582131977,7575463570273672876,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:8
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,13835375961526048052,565217064605868852,524288 --field-trial-handle=2340,i,8956359310582131977,7575463570273672876,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:8
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5728,i,1477803973576492537,4012551525843098630,524288 --field-trial-handle=2340,i,8956359310582131977,7575463570273672876,262144 --variations-seed-version --mojo-platform-channel-handle=760 /prefetch:8
  2⤵
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6536,i,10179124683894519332,15737258389125576436,262144 --field-trial-handle=2340,i,8956359310582131977,7575463570273672876,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4248

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3956

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 8bd193269cbc0101b18807144d6cd741576381f849ecee6df4fd3079b1e2a2ea
MD5 7f4cc8bd47cae9e9cfcbdc3a9dea31d4
SHA1 6406135db9fdcf767dc9e78333ef0cb8dfd551a1
SHA512 894acd81265a2f42a77360eaacfcdb7e50c7d9b0a2718871318cc1ab538e27cb24b8d3dba4cdc1a6de030a8f0012aac3b2f7e8fbaaf939ef83c5f7ce1469a61f
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7S:fwUQC5VwBIiElEd2K57P7S
TLSH
T1A2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9aeab2c92c5f26a8ca39382cf1bb4652de05a24b8d0a9ed661920c6197bf4c98
MD5 722151c3c2c9d1bf9273dad578c24b92
SHA1 8c73ee2f65f9c7a61550c77f0ff7f3b2e262dbdd
SHA512 2d701005e69967e2b1d86e637b7e1011658167d340aa89a1d8a3826c1a0cd883f9a6d2e8ff8530362b27f034273eb9c1e432fc1a63348092e3fcfc9ecd12dada
TLSH
T19ED012323A18644AE656A1F0A413CB411637516624535B21B215949D9AA80D562C6192
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 46246483d08868ff03d5f9bb48e547ca61f651c3e59a4138f5a5da74c69b3ae0
MD5 c70fc44a424269679b1300a5be3376a5
SHA1 6162f1576d71e2726435c2e688415ae394c1369f
SHA512 c7fe73655fb22ef9d6d3620fa11cc8586300f67f906224e15b5de9802f495a10b66f3fdb475a44e7ed7af1a7d84be1c87f05f52d39641755f33237ede51a6e35
TLSH
T1F9D012323A58684AE656A1F0A412CB411637516624539B21B215949D8AA80D562C6192
MD5 SHA1 SHA512 TLSH

Submit Download

692bbdd2-86dd-43e3-b479-0bc3de6dfd6e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\692bbdd2-86dd-43e3-b479-0bc3de6dfd6e.tmp
Size 13KB
SHA256 9e61d4818b74887b6bac674e1a9a81ef83a0a16012a5353af21c121797cf6aaf
MD5 75fd7bee7a7e8e15897f7ae79b16d0c3
SHA1 48d920eee4d3c90901e2eba4f9d658ed7deb2595
SHA512 feb4072801d1b0844604f83e299da6afe7abdc173df595c727b8747d721be538445141f1348374b019113ba8e645e7ff66e5fe0ac040122724f492708832c9fa
SSDEEP 192:sxZHRayM/jK1Ml8Mks/fhsFQkdGIdp8AHW6+WNG19L/Y9I9gO+FLIgrJ:sxZHAMs/fhsFQktdHbs/uD9
TLSH
T10352E8166A3859B7CCDBD209F955BB53D6F41972D2940E44AAFCCE0C04E6BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 558B
SHA256 674037c12b307b8a7b55f468e4311f82fedb899fe1ba2f9d40b1cdf55df0c559
MD5 4931fccdc685502bf0b6f9f7353e2d98
SHA1 cf2644b39eedc1dd4f9ce50db7640bcbcc7e8f95
SHA512 0e4d7f4b5ff543be5100112e83a0e28343f324421894705773425938d1a05870598c762dccbc839509ea59756b4e1d2f0e397e5790ec8918998926ec1d5ff946
TLSH
T190F08BDD63E4C2ED4200509BC564422820507219EBCCCA4A630D6F8FE4C605763E09E8
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 249358b1eab901f0b034023569e7f01b1f94c9179591789d99d6f279761d6e1c
MD5 e3fe72c0f542fbb29d9eb8933eefb382
SHA1 fce9a5a6bf89b76d58b4c0f0c691531330ab3b3e
SHA512 f71315278d44c74df19833e56e16d62705ddd45cc9bbabd13be55f51927a3d7464736846a1c4bcda6770c5b8c0720e1defbfbddb5206de648079efb1a9250340
TLSH
T17EC080D9BD4D845FD385187E5716F00007906511942796171650FDC032419A01E29220
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000069

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000069
Size 24KB
SHA256 c5edfbd367df7afdf276ea862310d13c08a6deb1baf69fdb979b8c14515b8d28
MD5 ece1501f2083d76b8026fb785884faae
SHA1 459c24765874af7147539932738ec14c17f3f7b8
SHA512 d76a1a955cd99d6b99b192ee3822c8e053c9c8c9f4bb436203903472fbeb95f5ad45884205872709bb6a5d943c446c6127d0ea58b322effb8a3e92de5e6845f9
SSDEEP 384:IJqvihSZ91664p+aatfEunFqb+EJMQp6nZyk0kPqgo1OWnwPEstFo2YZ51NR+F7:7vt7D4ORcy8KYk0E2OWnrsXzaK7
TLSH
T1B0B2E19EF717DE93C6A3442159E9A0DB9B37D610DCD1C42AA7828038F2943C1AF96193
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 67aea1d32e8ba3f4ca2058610d8d3c13909e9c1c47bf4107d35372d3c3da5581
MD5 2c7e1494bba2e246f64dcde6143ac79e
SHA1 e4b3a0941834d8e2488ab6ba930bd3972e2f8038
SHA512 44644c819b94d8d364e86a303b7900f25f0895ddd36c248904fbd241c93df3a3b8323467cd1d1c83dbc4a6e3a59e870e4f17bcf733f1cf0a6c7e299b66286f4c
TLSH
T19281933409CD365DDBA43D32DCCBA408F87085D8F6332EEAA1AC647C368AB9845E4D50
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58feae.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58feae.TMP
Size 3KB
SHA256 6d1511bef11eed1524ea75af85b55acf33d91ebac08c0a14c2c142910b967222
MD5 a317d90f239db33d1b909f4bd2a4fb34
SHA1 9b0a03d0f931b87a38ea1b4eca4f1e6b2149085f
SHA512 38e08c1c2e5062227a98d297b26741d7549984f07493748c539aba10c11439010333d1ce227fa90a79503e0b551306e29add8fe37b5ea48638b18e3de361d772
TLSH
T197610B3912CE399DEB603D33ECC31100787195D8FA33AEF966AC587D7A01B5546E9E50
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 10KB
SHA256 28cf372cebf05a8d7a7100308d83ffdbefcbea869c2968f4222320b03213d032
MD5 6d5407c9d050817aacd71bd9e2c60c8d
SHA1 40e60a8d8b8fbe1cf89ed9f42a814bd580ced7ad
SHA512 08a032ebfab52f19152135a00c59ac9821b5fc9ff0c6b5545afadf4fb2207a2ff78d11d503ce7b3496bab3f3b5558ce189885d0dd79f946877858e8cddf92b86
SSDEEP 192:D5VVVrViVoVLVyVPVseVXV8VcVHVmVHV27VEpVeV6deVgVgVcVbVhVkV9eVvVtV2:D5bRMyJYRie52Wp4xA7WpcwsiSOhDCjt
TLSH
T17222BDE782E5C61D89011EF0EEF4FA56DE6C1B1486383A2989D4BE4B57F1831E35078E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 7cae9aeb72fb47f6b335403afd0267f0c542a0e0764ff9770a4b4a6223da64ef
MD5 224170a1a4987fe87d2f86ad969f8aa7
SHA1 b50d24421aabd3ad6a3fb724b1c41b6e3b3b6b4e
SHA512 3125ae2a96fededf47d1bd1c69b08fb2e598c0037b351e34df5467f5c25b82feaffa04f9f313b782b25cb17ec8c79268ab6fa6151286f5b1cc868608ebae943b
SSDEEP 192:sxZHRayM/jK1Ml8UQXks/fhsLwkdGIdpaAHW6+WNG19L/Y9I6DC+FLIg5RJ:sxZHwqUs/fhsLwktXHbs/+DJ
TLSH
T17552E7166A3859B7CCDBD209B955BB53E6F44872D2940E44AAFCCF0C04E6BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 dbb356d8f36a362a0089ccef810e4880889bada8f8c9d64ebe738c0209dfdf71
MD5 9359690e0cb03065e6742082bb78fcf3
SHA1 4eea81652631ad8b25f675efddc94a64da951601
SHA512 5c66dc237fdb06dd3d912fb65af21cbf2767e746db029c140f7aaa722175f64681c8e434180ec3b0ca1265c36dfbf802905152527b839f9933491346492ae16f
SSDEEP 192:sxZHRayM/jK1Ml8Mks/fhsLwkdGIdp8AHW6+WNG19L/Y9ImEO+FLIg5RJ:sxZHwMs/fhsLwktdHbs/bDJ
TLSH
T12552E8166A3859B7CCDBD209B545BB53E6F41972D2940E44AAFCCF0C04E6BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 7f5612e6ea37dfc9fdfa24fdf40ed5ba4d630ccd9d7f40cba4eaec0bc7624f25
MD5 289531502d14cc42d935fa0e6f415260
SHA1 5b3ae6bc0effa69c3372ab5599c2881cc9fb4585
SHA512 ea2610c1ddf399401ea046a670549579ffacfd854ff81cf0254a99f8997a6a42efba07e117b0e6e11ed7458e43508352e92be68deeed044d85d49b1d2015b4e4
SSDEEP 768:YVcv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWNLrobg66:YVcv21wWvu+Z+u1jaeFLeRN4bK
TLSH
T1E8D20A2B280CCB7E4F841E9CED2A6F8A6DD801CB57988D5447FA894C03C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 167eafbcb8ebba9f7a697f7042adf2ca6ba406483a9458358952f301703ee109
MD5 1d0687c66ad1aac3ab66279fc131495f
SHA1 52bb6f2d622b0df94d68014e3d77fd7d3be1e299
SHA512 47ddf520616d374edae5b92f024926f625d46f289cd8987c54b81fc31f9ec1314e6f3d3e9e1a7d56a22a987e4d84295f1989f717583bdf709529965e858459cb
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDyeAKTi2+IQZC2QSyhjWD8B+hKZIBQh1YAr:mTnDyBXi
TLSH
T103D15212313B02423CBE3908A362CA768E4231673818E87F7FB911A25E67E121DFC5DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe593464.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe593464.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 65e8c8c31b83f41d854b34f3c6493f048bb4f5452fb7bd377b61f101d34e123a
MD5 201b89d104dcfc04ba82b423e90c0878
SHA1 3b6a39c53ed4a2166cb0cd8b2509967806e690ee
SHA512 df23efb0efaa56fa063a69cd0f70c06788f5aac9da19bbc8cbafc3b7bb32eb7d5d383d17aaa5f6ab28993e01339ca3fe1915501bfbe8b6108ea62f4beb70bea5
SSDEEP 384:PZcIhsNTEZzzi1EDe+C9O3+roS+2K7v38Scjmw5:HhrP/iFO3CLlK7v381jt
TLSH
T16A929D72AD385C769AF6A545F8873A139FB85073D6C81B80D4ECAF0C05DB6AC130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 113d412511c8333a0dc46db59ed5d342dbe805c1ccb0707d5a2a624c1d224d32
MD5 f4389b24c11ef127e82b07dda8c31ac9
SHA1 f541a5b1892149e1b51b917c55c9da4c251ccbc8
SHA512 06e0e821444f0854fd76874efd59710d9cb1bffa8090aeed9165d097a459315fc9c0ff89eead146a8c71026d3576b31ee5828d4384d256cca8f2949f2d711888
SSDEEP 192:JONX6v+YLNQmiUy5gZh+CGEOcs+tVusvB0uU6:JONX6vz/jZh+C9O3+zvjU6
TLSH
T1F702F835BC281C7B9EE26E45F58B3B275FA8213BE9912F90D9E81F0C01D774C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 952dcebb9f4a88d54fd3dac603c8b10695bc5f60c266526883e69bb0ae363edd
MD5 452ba5276631d6facbcf86ffe22217a9
SHA1 9007f1b33ae34cb964d636c098c541493c524f6a
SHA512 0cfa40431c5aa729829676c4c7c6411b367e0d4160c317fa7811dcddece4947576eb26e277ca971dcdb785ffa56ff877428b0f2e437721f6598129ac6fc5da1c
SSDEEP 192:tONO6v+YLsQmiUy1gRh+CGEOcs+t1sFS+2K8CHvMq4W8U6:tONO6vzIlRh+C9O3+roS+2K1v38U6
TLSH
T176121B36BC284C779DE26994F48735135EA51137EA897FD0D1DC2F1C06DF69C234A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 ec3ce559113e089747c72195ddf10f29c51179893d7a7a26d5a8f636dc3eef87
MD5 9c97fcde898cff69438488954c7e39fe
SHA1 eccc011038751bc3666daf8406dc482dc139cf1a
SHA512 9d95975ea85a33331296cff0b968f03b6dd61127ecebc45f188867e9197a46fcde261a039f2c696d669eff20b23874f4a53603034733001600c6ff9206fb72e8
SSDEEP 384:OZcIhsNT1Zzzi1EDe+C9O3+roS+2K7v38Scjmw5:sh2P/iFO3CLlK7v381jt
TLSH
T104928D72AD785C769AF6A545F8473A138FB85073D6C41B80D4ECAF0C05DB6AC130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 10fe830002dd2a648e88d509dd1091dab38ce7baec1056631261197fc6ffa754
MD5 9283935818998d6993434a53db303609
SHA1 f9d99ed1c87654da0cf50cacfeadb21b1b91a195
SHA512 f4ce7f8c6f8f82ea670f2ac4f81e3379817ccb33c68e2c153b9d1a2c7c575b08a353694ad9e5f3ed49f8f823691a210a59ecdfb02f6d485b4e8075bd27a5fad2
SSDEEP 384:hPiFiZcIVzsNt8TUNTUlIlEZzzi15De+C9O3+roS+2K8v38Scjmw5:kFQt8wg6PeiFO3CLlK8v381jt
TLSH
T1BDD229F258D7887AD9AE5743AB7E2D128EBCC063F5845A80B3D85A0CCD961BFC306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 f9604ec57141383067883ec9341a589c3253f95e34698aff842bfb3ca3d9381e
MD5 2dac82eee98f5e9cba2bba5aea77ccc8
SHA1 6ce45afec389964da4adb38bc40d7945b8b52bda
SHA512 9eef153cf2a2717198df5ebcbd59ff9d6a445179d729c0135543aaa0a61637ab162736307532e4747b628fb0b9d0131dd4410c3a65d0731f7fd00100722c1ed8
TLSH
T11B41278DA6EA1108B3B7BE569BF6A47E447BBD772F47D46D10110D4F0A22B40C8A1B33
MD5 SHA1 SHA512 TLSH

Submit Download