hxxp://cleverreach[.]pro/admin/login[.]php

Analysis

user interaction
yes
max time kernel
598s
max time network
601s
platform
windows10-2004_x64
resource
win10v2004-20260513-de
resource tags

arch:x64arch:x86image:win10v2004-20260513-delocale:de-deos:windows10-2004-x64systemwindows
submitted
29/07/2026, 11:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://cleverreach.pro/admin/login.php
Sample260729-m8ec4seq2z

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2868	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134297968887104184"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{9803CF99-8F80-48DF-B451-ACBC60BA0030}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4132	msedge.exe
4132	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe
732	msedge.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 732 wrote to memory of 1144	732	msedge.exe	83
PID 732 wrote to memory of 1036	732	msedge.exe	84
PID 732 wrote to memory of 2868	732	msedge.exe	85
PID 732 wrote to memory of 1504	732	msedge.exe	86
PID 732 wrote to memory of 1036	732	msedge.exe	84
PID 732 wrote to memory of 1036	732	msedge.exe	84
PID 732 wrote to memory of 1504	732	msedge.exe	86
PID 732 wrote to memory of 856	732	msedge.exe	88
PID 732 wrote to memory of 2912	732	msedge.exe	89
PID 732 wrote to memory of 856	732	msedge.exe	88
PID 732 wrote to memory of 856	732	msedge.exe	88
PID 732 wrote to memory of 2912	732	msedge.exe	89
PID 732 wrote to memory of 2912	732	msedge.exe	89
PID 732 wrote to memory of 4908	732	msedge.exe	90
PID 732 wrote to memory of 2732	732	msedge.exe	91
PID 732 wrote to memory of 4908	732	msedge.exe	90
PID 732 wrote to memory of 4908	732	msedge.exe	90
PID 732 wrote to memory of 2732	732	msedge.exe	91
PID 732 wrote to memory of 2732	732	msedge.exe	91
PID 732 wrote to memory of 4368	732	msedge.exe	98
PID 732 wrote to memory of 4368	732	msedge.exe	98
PID 732 wrote to memory of 4368	732	msedge.exe	98
PID 732 wrote to memory of 3328	732	msedge.exe	99
PID 732 wrote to memory of 3328	732	msedge.exe	99
PID 732 wrote to memory of 4272	732	msedge.exe	100
PID 732 wrote to memory of 4272	732	msedge.exe	100
PID 732 wrote to memory of 4352	732	msedge.exe	102
PID 732 wrote to memory of 3652	732	msedge.exe	112
PID 732 wrote to memory of 1832	732	msedge.exe	113
PID 732 wrote to memory of 4004	732	msedge.exe	114
PID 732 wrote to memory of 2924	732	msedge.exe	115
PID 732 wrote to memory of 2924	732	msedge.exe	115
PID 732 wrote to memory of 4132	732	msedge.exe	119
PID 732 wrote to memory of 2340	732	msedge.exe	121
PID 732 wrote to memory of 2196	732	msedge.exe	120
PID 732 wrote to memory of 2340	732	msedge.exe	121
PID 732 wrote to memory of 2196	732	msedge.exe	120
PID 732 wrote to memory of 1784	732	msedge.exe	122
PID 732 wrote to memory of 1784	732	msedge.exe	122
PID 732 wrote to memory of 4476	732	msedge.exe	125
PID 732 wrote to memory of 4476	732	msedge.exe	125

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://cleverreach.pro/admin/login.php
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ffe5434c188,0x7ffe5434c194,0x7ffe5434c1a0
  2⤵
  PID:1144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1824,i,5346014599043892880,14286466480325972095,262144 --field-trial-handle=2320,i,10892142679722155936,2870252926295766154,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:2
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=de --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1924,i,10317793298771085587,503098589086054790,524288 --field-trial-handle=2320,i,10892142679722155936,2870252926295766154,262144 --variations-seed-version --mojo-platform-channel-handle=3104 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=de --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2436,i,13192981526069697938,8358734006736871169,524288 --field-trial-handle=2320,i,10892142679722155936,2870252926295766154,262144 --variations-seed-version --mojo-platform-channel-handle=3128 /prefetch:8
  2⤵
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,3765963596609158212,17128490205378783800,2097152 --field-trial-handle=2320,i,10892142679722155936,2870252926295766154,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,15457337865702648933,5874030355212324846,2097152 --field-trial-handle=2320,i,10892142679722155936,2870252926295766154,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:2912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4184,i,9275254562223778724,5915824432690838098,2097152 --field-trial-handle=2320,i,10892142679722155936,2870252926295766154,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:1
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4220,i,12051972444149869020,16970037166091205665,2097152 --field-trial-handle=2320,i,10892142679722155936,2870252926295766154,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:2
  2⤵
  PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=de --js-flags=--ms-user-locale=de_DE --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3620,i,6841336838571559444,12371389159431725016,2097152 --field-trial-handle=2320,i,10892142679722155936,2870252926295766154,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=de --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,5109765609465709720,1581885724321270867,524288 --field-trial-handle=2320,i,10892142679722155936,2870252926295766154,262144 --variations-seed-version --mojo-platform-channel-handle=5300 /prefetch:8
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=de --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,4010313276428805073,13055210845824886555,524288 --field-trial-handle=2320,i,10892142679722155936,2870252926295766154,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:8
  2⤵
  PID:4272
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,908214869673275611,13679879749162084613,524288 --field-trial-handle=2320,i,10892142679722155936,2870252926295766154,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=de --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,908214869673275611,13679879749162084613,524288 --field-trial-handle=2320,i,10892142679722155936,2870252926295766154,262144 --variations-seed-version --mojo-platform-channel-handle=5908 /prefetch:8
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4292,i,11418457283767217331,1940357493187550066,524288 --field-trial-handle=2320,i,10892142679722155936,2870252926295766154,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:8
  2⤵
  PID:3652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4284,i,18145681892845800057,17467222935576021243,524288 --field-trial-handle=2320,i,10892142679722155936,2870252926295766154,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:8
  2⤵
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=de --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4280,i,17637681269551563307,12603566807345893503,524288 --field-trial-handle=2320,i,10892142679722155936,2870252926295766154,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:8
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=de --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3696,i,10424883366145896881,17238358117598186453,524288 --field-trial-handle=2320,i,10892142679722155936,2870252926295766154,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:8
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6276,i,17689989682485187693,5426772444074338893,262144 --field-trial-handle=2320,i,10892142679722155936,2870252926295766154,262144 --variations-seed-version --mojo-platform-channel-handle=756 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=de --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5068,i,13168292772109100486,3161961597302515976,524288 --field-trial-handle=2320,i,10892142679722155936,2870252926295766154,262144 --variations-seed-version --mojo-platform-channel-handle=2572 /prefetch:8
  2⤵
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=de --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3544,i,12842428783233799666,18232726587662711436,524288 --field-trial-handle=2320,i,10892142679722155936,2870252926295766154,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:8
  2⤵
  PID:2340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=de --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5536,i,18352206930058342216,16390519812653171737,524288 --field-trial-handle=2320,i,10892142679722155936,2870252926295766154,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:8
  2⤵
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=de --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,8150124139821006150,1438904226479926021,524288 --field-trial-handle=2320,i,10892142679722155936,2870252926295766154,262144 --variations-seed-version --mojo-platform-channel-handle=3060 /prefetch:8
  2⤵
  PID:4476

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2360

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 d3a6066c6f84ac7d7734316a2b53f9c0a71b709515034a6368cf4ad6290e558f
MD5 24e891470f2ee2b5504e9483a9c6746b
SHA1 4153c9abacb26840d4b80f27f7c5adef35141616
SHA512 e60ef11b2e89990548ffe0c82538c6a9c35f9a67735c3bb1781e48cdf19876df98887ce1346ad94f6f6fd6ae9b6fc3b400b14229417261650b9dc80ef1033711
TLSH
T1F8E07DE855C8C26EA649B49B427C770C9294374BD3C87D4B1B488BD570C1841F3E3ED4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 4a144ddc4241ba075316b7ea8c1990c6e3f9f0da9a2a5fe176e6c1fc2bb57246
MD5 f75f658814347934e63eaaae74fbadaa
SHA1 0bcc9efa8660d8b5d57116b8e6bf97a4133ae7c4
SHA512 01e1ccc0b4dd3c3857e94a19cac9b9ce69b6e6bbef625734e8f6696fe9235e852df7264c7c1661eed88246230d03bffb349bd3872f77696179f5e2513fbc8546
TLSH
T1DFE020C94CCCC23D5185788745BC531CD380365E93D469555B04897DB00154077F1F50
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 452cebef17abe832b703b3513915692acc1881f670183439eca8d212740ebe88
MD5 859e7dd7f6e2464cd64a533bccdcf50d
SHA1 982f294926bcf15c6019a3404b10fad134c5f729
SHA512 22f5bcf6790301c109f7fffaa7fb72906189893a94e089bb5b5dd96cdbfc45d69f62674f43dfbfc2e64c6b225115831d59d4470d86aeeaacba6e44956530df85
TLSH
T1A1412E5F066DA4D1D33DD13183CEA3113635B29639EFAE253270DFB91A5FBA145A200C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 d65c9b9de1142e4801d4a91b2945f127f3bb33821a162db6ede05819ecaab6e0
MD5 145afe51c0a68803e5a2e8a04b4ec3d4
SHA1 5d32e813b0626080c6b35ccc744a4e0b45e84993
SHA512 fea6bf7ff3b82d36103c038e83ff71f90919615054b5b15509e1e8bb1c75c0ace9fdd3ed48265e1bd3fc5707d3330060f43a31ca1e7bc0ec97fbc8f87da6ec10
TLSH
T13A21DFF3C2E8CA6E8A1152F1AA143E2BCD2D081583A83D16D8D1EF9BE3D3471E20155E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 255a4d74a93ee0b47ffeb68c301bafa21532010fd469b9ba83d7339fdf04a023
MD5 d1773796ce33ced8fd9f956aaceca2c4
SHA1 77a8884f1d7ca24ae7d85596d3871c3be6325ad7
SHA512 bcd4d39206fd50cfd2fba253857293e5f991eeb7cf2d0c0be4f3ebc05e6c298fae9774bf118bb4ff265c8fb4d0a893efe3af3d29c7671c05390600cafa4a7e70
TLSH
T19C21A0F382F4CAAE861151F1A9147E1BCE2C181583AC3D66D9D1EF97E3D3071E101A5A
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 a10aa9b992d50bfa9f42a193d61d191e4c486e41967637ae0b806fa86bda56db
MD5 630b7cae2634fd627ad474f4214030f8
SHA1 f0619874597f1faa97cf301adb2fd2cc5a7578a9
SHA512 d0705287837106449aad228039f33aa321de093f2deed4da68facb21ffc278c442a7eae1eab00c711e01e83fead3ebb991bffba04ca547de6fd1db4b4eda334c
SSDEEP 192:sxZKALkV/fcsDii6LIupzgl2HW6+WNj5u/Y9IFhM+Ig/JJ:sxZKAgV/fcsDiiqXHbg/Hb
TLSH
T18122C7166E38A97B4CCBD209BA19BB53E2F9503196D51E58EAFD860C04E77DD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 8dc84aca094f1ede33dd571d65f405c873b504c7ef542518b7cbe26db2d719ba
MD5 37be47ea7f1f594e1f1306126ee64a21
SHA1 3445c2d288e3ecebc668cbe77c77b908d9cbd7b3
SHA512 c39846ebcfc5cb6af9a3e516ec455dc770d74ab29a042a2da77b831b716ab75f84e7470de7d742416bf6d0fd009f4a2117b12e533f843150a7ff5ff2ccfda1a7
SSDEEP 192:sxZKALkV/fcsdii6LIupzgl2HW6+WNj5u/Y9IFhM+Ig5KJJ:sxZKAgV/fcsdiiqXHbg/HK
TLSH
T1FF22C6166E3899BB4CCBD209BA15BB53E2F9503196D41E58EAFC960C04E77DD230780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 21cc08652bac0b325fbf60c12081316069696b372212c59ca4d8725f9ee68063
MD5 c4e0203582cd7bef72573bd7989729cd
SHA1 e4a629b5505c7931c526b98397dd338bc72833dc
SHA512 4a2c48829f1eda98618f8ec98494e8cbd1673ca9ea7891c0c02aa0b413451fbe92b485d3de2cb595ebf708b32d12dedffdadbf9daf32f5ef6eb1b7c33989f5ed
SSDEEP 192:sxZKALkV/fcsdiT6LIupzgl2HW6+WNj5u/Y9IgXM+Ig58JJ:sxZKAgV/fcsdiTqXHbg/II
TLSH
T11A32C7166E3899BB5CCBE209BA15BB53E2F9503196951E58EAFC860C04E77DD230740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 ed4eb475d72b46dcd808cb8746878d75a7edfd3d21625bbd80893cc941fe40f1
MD5 935b639a993009109961bc37dfb020a3
SHA1 192b64f54de136974c5e37d04c45c561d96fe1d3
SHA512 6d72eda59888df8924eace7226f555b085c0d57307598087860140f7855168c7fa52b08ed4ca2c383580d1abbfb39bf9e77c3e3b749e056843f08bceae933a54
SSDEEP 768:b3yvIZwWvu+Q+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVDFLlwmW70roDbq0:b3yvIZwWvu+Q+u1jamFLeR7fD9
TLSH
T1E6C2EA2B240CCB7E5F801E9D9D5A6F9B3EA802CB97588D4047FD994C02C77EA512A4DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ac48ff67-c173-4309-97be-fc1d3ce21138\index-dir\the-real-index
Size 360B
SHA256 5cd7736b56a24893af048f425b0e9e6cee984f5264aa6ce755bb8028a26129f3
MD5 c270514befdf3ef4b9a1b51cc09f0b7f
SHA1 4368fa45b36b354891335c536d78dea791fbd116
SHA512 8711c6e015969aae3288512833037fafe7e95152a0dc7412f2d76de0b3aa7f4e9f472a361ff88cb4579229ad712fa5cc4332cf3d7315158ed2130b7fe0090264
TLSH
T1F9E02B190F510C26E274037B3D3284E973E188EC69558103642E86293C9538C745B2CD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d2dc9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ac48ff67-c173-4309-97be-fc1d3ce21138\index-dir\the-real-index~RFe5d2dc9.TMP
Size 360B
SHA256 69df67826fcf5ce371e5379a0922ee86f9567453c298a28e9da31bad84b04833
MD5 f8d95ce3b09c2d3e01eb805f8646c720
SHA1 34154929b54ad45dbbf1a3184290f39cc403366a
SHA512 9743c54e8d7245e08bc4a913ccb0916d833f59a1f34175e423c631de7d91580a21ee20096578fc76823fbbe12b1f67416b2c5ea21905580a9f16885bdc574c7f
TLSH
T119E095C5C7824D21E554153B291748EDF2744850E614F703353C552D3C29ECC79570CC
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 29ae05d3bbc5c84bc87863bbc2341003f36a8cfe2dcbd946fcc1739940d601ec
MD5 e6847f3ca178456c6fcc86c83ffc141b
SHA1 1cda74da469a07236bc96f7dd73d043ea69daab7
SHA512 5fb1a379941704c8d0d2467f49cfc21b06f2d93c743298c23949241eb3e860d5f49c16eb3bcaa8e992dd37833ce623074467cadeb10bbea1277ece1f9aa9f04f
TLSH
T16AE068B62CA72C24FA2F87DA243509A900067858C600BC1F502EE7831066324284EC22
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 890a4fa69eba11bc7ea2559ac792eea7a4ee3acee1ee5bf95d53a6f4d04eb7a8
MD5 88346a56845665969622ae40132c7992
SHA1 10ab58fcf52a4520f310c8a85561a352e6cfa916
SHA512 6c45b42def1773ea26acb27f0ffe04d664190d3a7a0eeb417b4b13f734277ceb8de2f6deb59f688a358ea0e91103f02720620f6f065cd371a5f4787348753b43
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDqsAKVKWaSAKHq9:mTf7va
TLSH
T193912F02703B0646287E694CA395CA778E4531A37809F9AF7FB800665F27E161EFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 e482e0287f5d53c3ba44f707953029fd78a279155339825c80835c329a77ac98
MD5 c349164cd27e763456564bba6d4ced8d
SHA1 081af2cb261854522b6712ab8e0340eaeb01ea0b
SHA512 a24eeaabe2490e290180b02f40b4ca6138c60b7e8916b334f2ad0cb5fe1483bb97cfa581edb09860dbd044810cd390d855aa365138be3d96ad8dc1773ca37f7a
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/uj:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAe
TLSH
T1B3A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe597565.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe597565.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 b79a7f75f034b99831dd8267f1b0e9e117285e2f9b550eb1c54ea305d281ac77
MD5 61569e7d9638819cb8fd8a0607dc3ce7
SHA1 af2c2f9af7e521755b3290954ddfd9a8233c684a
SHA512 33d10f41e5e06c79ad01645b0ad1959fdf5b7f1e8a52bd20bcbbf563249bcdeffafcbc8abc37a53d41971e6d47342458acab5322812f802a3ad56e2e7893daab
SSDEEP 384:xZcIosNYYAM6ziN26ue+CZOX0uiUhJScjmw+p:ZoFxWBOX0uiUhJ1jqp
TLSH
T19C928E72AD385C66AAE6E045F88736038FBC9073DAC51F80D5EDAF0D02DB59C031782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 8c93327b0a48b902459bab6851d071b23f4c3f8fc81b81389054bfc2cd30df41
MD5 fce69430781d678709235cfc2cf3dfb4
SHA1 f885a3b3210e8eff8b63f86eb78cebf8391972e1
SHA512 c9fb61a14dbfa2fe5b73d156a12475e11c29c831cdf84b44bf081a605a71c38c80df1e1ec57cc6acd0e74ce1903f2d4f2f825c945ed0ba74da7ba9948c3e2c7b
SSDEEP 384:pNFiZcIu+sNI8TUNTUlIlBAM6ziNo6ue+CZOX0utUhJScjmw+p:XFQPhwgmLWBOX0utUhJ1jqp
TLSH
T1E3D22AF259D7887AE9AD9747A77E2D038EBCC063F5805A90F398590CCD961BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 8a940a87e0c0ac3b8c554a92a680f23ace4d176207b2e67c8792ef907a38b569
MD5 cfb65dd21f8e17ce902794900730783e
SHA1 e4053d91ae8942554fe65d63594f05aa14db556a
SHA512 3a558748d9212489442776ad446b0675d5d701c2489b027e9ea4dbcd40604f0947ff2847f981156fb8713942d0cf65cd6b2d10b8bb5852efbf650263aecdcef0
SSDEEP 384:uZcIosNYBAM6ziN26ue+CZOX0uiUhJScjmw+p:MoYxWBOX0uiUhJ1jqp
TLSH
T114928E72AD385C66AAE6E045F88736138FBC9073DAC51F80D5EDAF0D02DB59C131782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 349bf25b9e0ba70dcb2dfecd8757565fa036590220de8722b9a92341aae05988
MD5 0470df4e216366d6405742f69a19928d
SHA1 dd6b41a1186d4e0adb2b08d123ad8d23397af325
SHA512 fd525a326de77de7f5731a95aa3ccdf0af94b8e4e2b7046604dc6ad4f3807488575bd117a45d232c2edc48b9e77c72034325df6f0c4267d2498bf3bf9f1023b7
SSDEEP 192:xONx6v+YLoQmiUyqVth+CGEOYwFSuOCHUIq3JU6:xONx6vzMrth+CZOX0uPUhJU6
TLSH
T1E4121B35A87C5CAB5EE2A584F48735075FAC512BDA8A3FD1D5DC2E1C02DF69C230B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 254ec504157ab061858114991376a5b62c3f9cf4e1d126ff1157f083125d022e
MD5 c26944f476c785d6ee3e397cd358dc9b
SHA1 8060b6dd8de5790750150253edcf291b038f187a
SHA512 1fc6d58bf491c5a4bb929d6ace30580e90fa22c478d4fd4d31f09fccb739c5f594a63ff2b2377fae54495c764959be903215b6c0e740562cf04095a13a24e6d3
SSDEEP 192:JONZ6v+YLNQmiUygVZh+CGEOYwusUxOUU6:JONZ6vz/3Zh+CZO/UMUU6
TLSH
T17902E935BC2C6CAB9EB26E44F48737175FA8113BEA912F80DAD82A1D01D775C2307826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 1054296342764bc07ec5bcb91b7c034479313ded1781520c43ed13adafa8bc5c
MD5 8fefef9d127eaedcee60d8c2d3f023c1
SHA1 8b1915253fd491b22226ee8a3a25add547202c32
SHA512 bf23ba40a990075e96660f7f10c5da8e18c1b8363d1e2871cd5ac3e5fdb13717a6fe9ad718bb89ebd77585f9e1f9f15d92a888090458e37b7f35acaa9c22789e
TLSH
T106411D58B6FA1148B3B77E56AFFAA46D487EB9772A06D15D10000E4E0A26B40CC61737
MD5 SHA1 SHA512 TLSH

Submit Download