ca7f1d86e8580362d9e4e48314aa52e36e5ba0cb392dd29c0e6383ed09095e4f

Analysis

user interaction
yes
max time kernel
223s
max time network
192s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/07/2026, 08:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Payment Remittance 2026-07-28 (invoice2026-991359).pdf.html
Size 106KB
Sample260729-krt15azdph
SHA256 ca7f1d86e8580362d9e4e48314aa52e36e5ba0cb392dd29c0e6383ed09095e4f
MD5 8896c7d5c0af552bd0f99782a926667c
SHA1 d6936cfc146da0a18b68270164ca192d87d68925
SHA512 daef828eac0f7847e349dc7c345c8fb6a7feafbfd47706f01440cc0e817bcb145088e8073551c97b044e80bd04785f94ab9d97c874eedacae1689b6bb3fe2615
SSDEEP 1536:uHQvBbWpZ/hrB5ufpMdUv5QA+jjjjH6p+/Y28e78kqEJiJv:uHQvFW/5B0Bt5QNjjjjK+Ye7fJiJv
TLSH
T17BB3D07255D3B978BE5329E420152901BFA1DD73A928C40833EA3B1BDFD34669B13DE8
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4488	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134297886424613905"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{521E34DF-C14C-4339-852F-BE6A1BE97B29}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3000	msedge.exe
3000	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe
4908	msedge.exe

Suspicious use of WriteProcessMemory 55 IoCs

description	pid	Process	procid_target
PID 4908 wrote to memory of 4980	4908	msedge.exe	86
PID 4908 wrote to memory of 4488	4908	msedge.exe	88
PID 4908 wrote to memory of 1092	4908	msedge.exe	89
PID 4908 wrote to memory of 1092	4908	msedge.exe	89
PID 4908 wrote to memory of 4008	4908	msedge.exe	90
PID 4908 wrote to memory of 4008	4908	msedge.exe	90
PID 4908 wrote to memory of 4008	4908	msedge.exe	90
PID 4908 wrote to memory of 3468	4908	msedge.exe	91
PID 4908 wrote to memory of 4468	4908	msedge.exe	92
PID 4908 wrote to memory of 3468	4908	msedge.exe	91
PID 4908 wrote to memory of 3468	4908	msedge.exe	91
PID 4908 wrote to memory of 4468	4908	msedge.exe	92
PID 4908 wrote to memory of 4468	4908	msedge.exe	92
PID 4908 wrote to memory of 4808	4908	msedge.exe	93
PID 4908 wrote to memory of 4808	4908	msedge.exe	93
PID 4908 wrote to memory of 4808	4908	msedge.exe	93
PID 4908 wrote to memory of 2676	4908	msedge.exe	94
PID 4908 wrote to memory of 2676	4908	msedge.exe	94
PID 4908 wrote to memory of 2676	4908	msedge.exe	94
PID 4908 wrote to memory of 3100	4908	msedge.exe	98
PID 4908 wrote to memory of 3100	4908	msedge.exe	98
PID 4908 wrote to memory of 3180	4908	msedge.exe	99
PID 4908 wrote to memory of 3180	4908	msedge.exe	99
PID 4908 wrote to memory of 5072	4908	msedge.exe	101
PID 4908 wrote to memory of 1612	4908	msedge.exe	102
PID 4908 wrote to memory of 1612	4908	msedge.exe	102
PID 4908 wrote to memory of 1612	4908	msedge.exe	102
PID 4908 wrote to memory of 4316	4908	msedge.exe	103
PID 4908 wrote to memory of 4316	4908	msedge.exe	103
PID 4908 wrote to memory of 4316	4908	msedge.exe	103
PID 4908 wrote to memory of 4672	4908	msedge.exe	107
PID 4908 wrote to memory of 4672	4908	msedge.exe	107
PID 4908 wrote to memory of 4672	4908	msedge.exe	107
PID 4908 wrote to memory of 3284	4908	msedge.exe	111
PID 4908 wrote to memory of 3284	4908	msedge.exe	111
PID 4908 wrote to memory of 3284	4908	msedge.exe	111
PID 4908 wrote to memory of 1124	4908	msedge.exe	112
PID 4908 wrote to memory of 1124	4908	msedge.exe	112
PID 4908 wrote to memory of 1124	4908	msedge.exe	112
PID 4908 wrote to memory of 3748	4908	msedge.exe	116
PID 4908 wrote to memory of 4604	4908	msedge.exe	117
PID 4908 wrote to memory of 2692	4908	msedge.exe	118
PID 4908 wrote to memory of 1920	4908	msedge.exe	119
PID 4908 wrote to memory of 1920	4908	msedge.exe	119
PID 4908 wrote to memory of 4776	4908	msedge.exe	120
PID 4908 wrote to memory of 4776	4908	msedge.exe	120
PID 4908 wrote to memory of 1564	4908	msedge.exe	121
PID 4908 wrote to memory of 1564	4908	msedge.exe	121
PID 4908 wrote to memory of 3000	4908	msedge.exe	123
PID 4908 wrote to memory of 1324	4908	msedge.exe	124
PID 4908 wrote to memory of 2804	4908	msedge.exe	125
PID 4908 wrote to memory of 1324	4908	msedge.exe	124
PID 4908 wrote to memory of 2804	4908	msedge.exe	125
PID 4908 wrote to memory of 1868	4908	msedge.exe	126
PID 4908 wrote to memory of 1868	4908	msedge.exe	126

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Payment Remittance 2026-07-28 (invoice2026-991359).pdf.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffdc902c188,0x7ffdc902c194,0x7ffdc902c1a0
  2⤵
  PID:4980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1928,i,1641989469686092317,6333403572899859354,524288 --field-trial-handle=2420,i,13159017368790268025,10885105214003840451,262144 --variations-seed-version --mojo-platform-channel-handle=2448 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2256,i,6539173043835919025,16770215215863694161,524288 --field-trial-handle=2420,i,13159017368790268025,10885105214003840451,262144 --variations-seed-version --mojo-platform-channel-handle=2456 /prefetch:8
  2⤵
  PID:1092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1640,i,12135276601770674814,4344571457270466526,262144 --field-trial-handle=2420,i,13159017368790268025,10885105214003840451,262144 --variations-seed-version --mojo-platform-channel-handle=2416 /prefetch:2
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,8507140887344555996,10768234261311932704,2097152 --field-trial-handle=2420,i,13159017368790268025,10885105214003840451,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:3468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,7249059117095299610,11108368124575611174,2097152 --field-trial-handle=2420,i,13159017368790268025,10885105214003840451,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4188,i,4301838848425032606,16488859118305909437,2097152 --field-trial-handle=2420,i,13159017368790268025,10885105214003840451,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:1
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,14924553987894105653,11220356819992051533,2097152 --field-trial-handle=2420,i,13159017368790268025,10885105214003840451,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:2
  2⤵
  PID:2676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3636,i,5280065161502012083,14543856189624903495,524288 --field-trial-handle=2420,i,13159017368790268025,10885105214003840451,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3624,i,15756128129155674774,17487337256580964353,524288 --field-trial-handle=2420,i,13159017368790268025,10885105214003840451,262144 --variations-seed-version --mojo-platform-channel-handle=5236 /prefetch:8
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,17741915718270517562,11280522981698988400,524288 --field-trial-handle=2420,i,13159017368790268025,10885105214003840451,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  PID:3884
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,17741915718270517562,11280522981698988400,524288 --field-trial-handle=2420,i,13159017368790268025,10885105214003840451,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6244,i,11795316361045525278,14779492165469346754,2097152 --field-trial-handle=2420,i,13159017368790268025,10885105214003840451,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:1
  2⤵
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4644,i,13453274433799857563,18151425655907736754,2097152 --field-trial-handle=2420,i,13159017368790268025,10885105214003840451,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:1
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3696,i,16612110368344824399,15206566853360966287,2097152 --field-trial-handle=2420,i,13159017368790268025,10885105214003840451,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:1
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4544,i,8432805254742732677,2377304357766747456,2097152 --field-trial-handle=2420,i,13159017368790268025,10885105214003840451,262144 --variations-seed-version --mojo-platform-channel-handle=4404 /prefetch:1
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=3568,i,1066107068271640050,4210763620409232091,2097152 --field-trial-handle=2420,i,13159017368790268025,10885105214003840451,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:1124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3728,i,10293273836872785797,14556918607599706212,524288 --field-trial-handle=2420,i,13159017368790268025,10885105214003840451,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:8
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3588,i,1603106109271679542,16929720347780660251,524288 --field-trial-handle=2420,i,13159017368790268025,10885105214003840451,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:8
  2⤵
  PID:4604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3724,i,4294838595743185208,17348015657746823051,524288 --field-trial-handle=2420,i,13159017368790268025,10885105214003840451,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:8
  2⤵
  PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2816,i,9922012490891738446,1543315649573386545,524288 --field-trial-handle=2420,i,13159017368790268025,10885105214003840451,262144 --variations-seed-version --mojo-platform-channel-handle=4056 /prefetch:8
  2⤵
  PID:1920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3760,i,2521936651936277417,6427091871896317058,524288 --field-trial-handle=2420,i,13159017368790268025,10885105214003840451,262144 --variations-seed-version --mojo-platform-channel-handle=4188 /prefetch:8
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6660,i,8839140586720372672,13112361395154095524,524288 --field-trial-handle=2420,i,13159017368790268025,10885105214003840451,262144 --variations-seed-version --mojo-platform-channel-handle=5768 /prefetch:8
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6048,i,18365240979185027953,5226787787830138993,262144 --field-trial-handle=2420,i,13159017368790268025,10885105214003840451,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6160,i,18033342176807678438,6499228622975519607,524288 --field-trial-handle=2420,i,13159017368790268025,10885105214003840451,262144 --variations-seed-version --mojo-platform-channel-handle=2560 /prefetch:8
  2⤵
  PID:1324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6656,i,3093166718575716067,17766889162119573935,524288 --field-trial-handle=2420,i,13159017368790268025,10885105214003840451,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:8
  2⤵
  PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,7078426099033820738,2423041185197838137,524288 --field-trial-handle=2420,i,13159017368790268025,10885105214003840451,262144 --variations-seed-version --mojo-platform-channel-handle=3420 /prefetch:8
  2⤵
  PID:1868

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2672

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 965e5ede1dd95e7182bc6ed8b645e4796c53616af10fe7a02b411984e0f5fca1
MD5 252c38f22d645a5fc39fa9f1fdd92b34
SHA1 70c6079cc3ffdcb0efb6f56834b64311e1e951bc
SHA512 e23e1b164567d933593229d39744ddacb3330f715193f293c7aee9a5a95fc433809933ab830a7a1c5cdf37824965c32650c227083092c2a6488a2ab768744ad1
TLSH
T110D09B7077CDAC11D9450471D45547535D96CA4C24D7DB076011801D58567D9B35E067
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 083d78ea5ea69126b24164f2e05fc467ce21fdcdf2ec67f8e94c4366a1284886
MD5 da79f81681859af2b76762aa37a5f73e
SHA1 53d69c959eb46848bc7ed7b5c480df864295389e
SHA512 f647681c342e36fa2f41fb9d54d089303f98b802703a42609226ef5755aafc91ef00af41a82f980c0f2819709322c59ef6cd1c18725ef5133691894902fc44c1
TLSH
T1FCD09B7077CDAC11D5450471D45547535D96CA4C24D7DB076011801D68557D9B35E067
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 f91986e28e1d0002b2110fcf7207274408ce06a5673122e127edfdc3b175499a
MD5 a2e5d8fa48b6c484c29fae3cc32f8fad
SHA1 9b5fb9012b67fcbb2fa25cc21c338c16d1c087fd
SHA512 ba56c34db37c3e16c393e39f2a3af8d996ac1128718a8f565437e49157f5a71f1d6e4da70f60a4869f289bec74346449636d2b669de2f25d85da66fba7897744
TLSH
T129E0208A05C6C27D5300A547816C634C9280FB1B97CC6D0F6B0CC559700268863D95A0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 80ecc7cc531f614ad3a25cb889402ef25d35cb60884981f4cbdcd8e627ed7ff3
MD5 1fe83de9338f753839e684c3ad780086
SHA1 8a9a531a6a4f6d6f122c009fc70fbcf8fac7d6fa
SHA512 20c3cbda134b1f6d8e14d81b6f9eec11eec4ee7bf76442e9d70b764a10f09b4da3385d85aa2552def121ef13c001d50b017be2b74c17e45a8486b5c12e8ae994
TLSH
T11BE078C98DCCC23D5144F4C78574E70D9380770EE2CC690537048549704375777F5550
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 26f962745bc2e8e733b59b6f9aadc73f04e91545fbc49f9ecfe9ccbe5d0e02ac
MD5 c574abfa458356ab424f6a6ba5a2138d
SHA1 17f23cb552022f92ce6eb46066fc39f70f257203
SHA512 9f2ccd3765ceedfc58a073c6f060a800644389053def5ec868728b2bb5061dbb6db72af95696357114ade7c68cd5f61039bc1f09257e6c72ea070b591811fb6d
TLSH
T18551826D03456443E330B631C4E91301B432ABFE08174E5983E09E3FD62F7E5894789C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58bf53.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58bf53.TMP
Size 2KB
SHA256 86984417d32dfb0d66da9900ffe51d6d6fd012875e5ae11cc198ae43e33671fd
MD5 91bd4203769ebc916b9bcc62ba7b7e62
SHA1 73fadb9c24b7ada7af60b7f2ef9de4ecc18d0e69
SHA512 9c1d60379786bf8c4624c3856421d5928260f11ecf0d576618ea969007106e3f8423d17b546054999e0c523d35d878fc4cfcaf14e308f7d2e826906310e5f7d4
TLSH
T15D51816E03456883E331B630D4E91311B432ABFE08174E5983E09E3FE62F7E5894789C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 60fa30c2e164599d1ceb02012939e0c0790c24caa3155d5bc8963b44680892a5
MD5 e21d6fc29c7b066e0b9e4bd7ef7079f4
SHA1 9188684102da4954f3ad8272d48b75ccdc911cca
SHA512 7a75194f43512954e87f3c2ab37b373af63449791f2ca78200717f8241bcc0abae23f95cd456b24943669ef4149137ae642581e88aad9cc31d562c627b5da983
TLSH
T11E117AB7C7D585AE890117F06A28EE2BCE2D0606832C7C5989D4EF6B93E3075E10295B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 fdb47a7f4d9e3faac691e329deb0d8108da14a8d387bb2568f3d7f3ca5e4e435
MD5 8442ea77b96f9cff3c89dcf4aacbd7fe
SHA1 d188e01ad2d1861750848ec1add35de5adb8be4a
SHA512 ba38f6aca3ecba1aa22f9a4e24dab65ce1cc922d27daa054c1c613c15e4c4ad88307f2729320f47208e63a8a9e8afb546433312fb41a96816bad105afdebd85a
SSDEEP 192:sxZsQUnzRzkK/fFsB30YCodpdERHW6+WNGYwKB82IgrJ:sxZSnziK/fFsB300qHbGS9
TLSH
T1CE32B6526E38A97B8CC7E219FA157B03D6FA5031A1D41E48EAFC860C05E6BDD130790F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 e708ae3bde3f66c650ada0c60f2aefd2fdc3a8c83644c964e1f4f54996fe8c5a
MD5 6a53668f688ba67defe6f91625ed8c60
SHA1 234c13282c7730ad674ff386b52d01e44ecc0ca9
SHA512 4f2e2447b353e57f8d0b95d31c4b647189c2a198abe933dbe26aa3e816061c0060900d7c3f30f049b078c43dfcecd7f32adc1ab8d35ba80d196fdf1fac736621
SSDEEP 192:sxZsQUnzRzkK/fFs830FCodpd70HW6+WNGYwKB82Ig57J:sxZSnziK/fFs8309aHbGSf
TLSH
T1A232B5566A38A9BB8CC7D219FA157F03D6FA503191D41E48EAFC960C05E67DD130790F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 10d55cc0a71aebe8d5deb56f598d7b480377d1feb44e7df5f86b20fb8120defe
MD5 bb4d189f5c23a47f8939133cc9f18761
SHA1 69291ba9d3735fba0c29ad2ae62530756f6a725f
SHA512 3ffd521833aa750a3784cdcdacf8cce7dc767eba95a34e5ebb4c8e7fcac4f11b340237bf25cc736d24b00e1a4fedce4707c9ab13e6e7f416aa0a01b02acf3474
SSDEEP 192:sxZsQUnzRzkK/fFs83sEFCodpd70HW6+WNGYw9B82Ig5ZJ:sxZSnziK/fFs8399aHbG3h
TLSH
T1C432B6566A3899BB9CC7E219BA167F13D6FA503291D41E48EAFC860C05E6BCD130790B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 554aa6c83b6e65a3e41c12d334484c9c15aeeb96cdba68fdbcb2510512f0d53d
MD5 e20144f444d52f42799e48dc1b5bf5b3
SHA1 c92c3ff79c455a13a12aec3dafaacadf86cf838c
SHA512 0fc1d7b9cf7dff1e6ca328963a9933a5a59124af27eb198c19c9376f6afe1d973be2588d14c21645c292576b6ae2f91d1968d246ab98dcda21067da7274a6bde
SSDEEP 768:53mjYDmWvmKyE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVBPLlrZ+DOrofxsae:53mjYDmWvmKyEu1jakPLZQDFZ2
TLSH
T10CC2FA3B344CCF7E4F801A9DDD5A6F973EA802C76A588D4047FA994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 bb8f865cf8cf204fa45232ac46d47cf641c0229b5cf8c5a5191fb25d478c2db5
MD5 44b49cb1f442a405eb7b59cc2447b9bc
SHA1 3687426173a2e198cd43afec70f5a8f682d280f4
SHA512 da591887cb0827058098a22baa9d67dfa0f82a03cafcab5a2ad17102d87e8932a68cd3a57332cdc8d781282ab16e784b93cba49507b04bb539636141151926f8
SSDEEP 96:KEG0KXqSqQ4KhqFvS5VnF5ziJUCA9zKYqALz8/XMR5QOz:Cfnmv+
TLSH
T15891F95630BB47012D3D3B089674CA668A81B5633054E92B7FED42B50F27E528EFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 a380ddc9bb6abf58caae9170511095cfe9bbf5771a35b69fcc8bd5c683bd9628
MD5 510f41e74e96eac8c19ba5a24a62b7a8
SHA1 ccc2072aa52e6aea5103fbbc806ea4d8797ab4e0
SHA512 022d0c3aa06e0bddd5332187655b76f2287953c461492a185ffbe0df996d7e3de968ec460b2dca624f060feb5eb6827121d6d5fb96036fca1fbb01ae89d0a539
SSDEEP 384:hlZcIWzsNbauvyRbRHf+9OMYDIFgScjmwZ:hdmx/oO72g1jF
TLSH
T109928C72AC789C769AF2A505F4473A138EF49173DAC46F84D6ED6F0D00DA6AC130BD25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 384a4655b1b5a465ea8c752f51aca963a29dbaedaff83eb5378588f25187fc4e
MD5 752e676a35fce97595b087165c725269
SHA1 a365bc55964bcc37537f556eb2c1104a3548b600
SHA512 1b41251e84730233073933fcd6a395d3b861df9d538ac1e072f05faa62e3802aba34389f5982afe45e458fe28077214a8f3c297013928c2b627ccd7245260977
SSDEEP 192:uRm+xasuheOwQxMGsNbaQ3ZkbW309tEdZEB7QmiU1ug44H/+jVfO1SYoQIef5cFm:1ZcIhsNbauvyRbRHf+9OMYDOFgScjmwZ
TLSH
T170928C726C789C769AF6A515F4473A138EF48173DAC46F84D6ED6F0D00DA6AC030BD25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 c79c43a53ae1ef72272e9904df37d9d18c8569d14138e3039add44787b4c2461
MD5 20821ddf35833da92f6360915028ed67
SHA1 c4d3d3141db3f0c2004d6cf7266283b49d2abb9f
SHA512 0c6e47dfadf2174ce2cf48c3f13eaa72bc5a6119bd4539a8452cd0342ed84a3cadbfa34cc36cc6bbafd23f1c7555162f9bc6569f6619f2761fcbfa03fd70da60
SSDEEP 192:uRLsNbLQ3ZkbW309tEdZEB7QmiU1ug44H/+jVfO1SYoQIef5cFTMq6ScjmqYoJXw:MsNbLuvyRbRHf+9OMYDOFgScjmwg
TLSH
T1F0725B32AC789C778EA2A515F4473A139FA44167DAC42FC4DAED6F1D01CA6AC130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9bcc7b798c1b8d3f900145f11e5bd7c5a63cfc2bc4a9f6a80003ca571b07c41a
MD5 92be59c0b1fdf26f168c4501f7aae007
SHA1 ef19ee4e9f597df8f63680d7fbcc6b62c0588627
SHA512 a8206ff4fd3a31bba4ec6d583a821ed430f255b7b72052183c4549e00a12f894411b43c150471bfcb98ccb584f6a977ad1969a82da10925ae53d66c8b0cceb32
SSDEEP 192:WONW6hZ4QmiUy5B1c/+jVfO1SYoQIeZ5cOqMq6U6:WONW6EO1u+9OMYDo9gU6
TLSH
T167120A3668689C774DE2A955F48736135FE5422BEAC57FC4E6DC2B1C00DF6AC230B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4aa47dda2e6ca596e453310acf99fc68c75eb33e60e7c9ad4608a9851b46d7a9
MD5 21fa1951e0438fcd2a7d13155be79df6
SHA1 3eecb091fffa8c8428ffcfe4a45dcb81b57c1714
SHA512 45a2b7e4904ea1597834f1379d041bd5616ec2b7207c7a712daa87fd41654742cf6e75ebcd0c03bf6694e7e1711c94d44deae61897f3816365912e35928e561e
SSDEEP 192:EOND6hZ0QmiUyBBpc/+jVfO1SYo25wOZIJL0U6:EOND6o8pu+9OMY4260U6
TLSH
T1B802D83568686CB78EE2AE45F48B37235FE5112BA9956F84DAE81B1D00C779C2307836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 22039501391fb00659ce8bbe1c4e02ba78659f6a5915598f8c7fb964e3711bcd
MD5 0c231496eb6b3fbd5525848a09ea528f
SHA1 32ae55c83f4019a6b0654552503e14f0591a0c2b
SHA512 3053aa40399c9bc926e7d423d35fa11cd72341b0173519965433b948d105eb83a689dce293bdf5b018f512ff5b3e23a7acbc49b67db94994bc16fcc5a4151edf
SSDEEP 192:uNm+xasuheOwQxMGsNbaQ3ZkbW309tEdZEB7QmiU1ug44H/+jVfO1SYoQIef5cFm:1ZcIhsNbauvyRbRHf+9OMYDOFgScjmwZ
TLSH
T1A8928C726C789C769AF6A515F4473A138EF48173DAC46F84D6EDAF0D00DA6AC030BD25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 249dd6ed71e0e648ebe0b7d33af39720809d42c06f8da0c90c3fd98a3f174d9f
MD5 0960badef51745ac952f00dbb478cc61
SHA1 cb6ec88d5c37d01193870a6226bc3a955a6ae256
SHA512 413488b54274665e1d4d4a7d3eda155137f30d64f7c0953a00ff880cf8398cd11eb39b4804b3c0739ed046a68d98e6b2b0ed1b730aa9e9a744fd9daeefd728d1
TLSH
T12C410758B6E91148B3B77F5AABF7A86E447AB9772E4AD05D00110D4F0963A40C871B37
MD5 SHA1 SHA512 TLSH

Submit Download