hxxps://mailer[.]worldlitigationforum[.]org/l/2obJFNmoQ562xbtJxBdvUg/gwlvuXWaOFlMHQ08MMlVAA/ExZhUrHE3nPA8927NpksDfUA

Analysis

user interaction
yes
max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
29/07/2026, 12:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://mailer.worldlitigationforum.org/l/2obJFNmoQ562xbtJxBdvUg/gwlvuXWaOFlMHQ08MMlVAA/ExZhUrHE3nPA8927NpksDfUA
Sample260729-pcbcpavyfv

Score

6^/10

discovery

Malware Config

Signatures

Looks up external IP address via web service 1 TTPs 3 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
163	ipinfo.io
160	ipinfo.io
161	ipinfo.io

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
8	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134298006475831416"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{ADA70AF8-1364-4E10-A839-50294D0D7049}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1044	msedge.exe
1044	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe
2948	msedge.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 2948 wrote to memory of 4336	2948	msedge.exe	87
PID 2948 wrote to memory of 8	2948	msedge.exe	89
PID 2948 wrote to memory of 1232	2948	msedge.exe	90
PID 2948 wrote to memory of 1232	2948	msedge.exe	90
PID 2948 wrote to memory of 1232	2948	msedge.exe	90
PID 2948 wrote to memory of 3340	2948	msedge.exe	91
PID 2948 wrote to memory of 3340	2948	msedge.exe	91
PID 2948 wrote to memory of 1364	2948	msedge.exe	93
PID 2948 wrote to memory of 1364	2948	msedge.exe	93
PID 2948 wrote to memory of 1364	2948	msedge.exe	93
PID 2948 wrote to memory of 3996	2948	msedge.exe	94
PID 2948 wrote to memory of 3996	2948	msedge.exe	94
PID 2948 wrote to memory of 3996	2948	msedge.exe	94
PID 2948 wrote to memory of 216	2948	msedge.exe	95
PID 2948 wrote to memory of 216	2948	msedge.exe	95
PID 2948 wrote to memory of 216	2948	msedge.exe	95
PID 2948 wrote to memory of 2144	2948	msedge.exe	96
PID 2948 wrote to memory of 2144	2948	msedge.exe	96
PID 2948 wrote to memory of 2144	2948	msedge.exe	96
PID 2948 wrote to memory of 3500	2948	msedge.exe	99
PID 2948 wrote to memory of 3500	2948	msedge.exe	99
PID 2948 wrote to memory of 3500	2948	msedge.exe	99
PID 2948 wrote to memory of 4944	2948	msedge.exe	100
PID 2948 wrote to memory of 4944	2948	msedge.exe	100
PID 2948 wrote to memory of 4944	2948	msedge.exe	100
PID 2948 wrote to memory of 4352	2948	msedge.exe	101
PID 2948 wrote to memory of 4352	2948	msedge.exe	101
PID 2948 wrote to memory of 2836	2948	msedge.exe	102
PID 2948 wrote to memory of 2836	2948	msedge.exe	102
PID 2948 wrote to memory of 5060	2948	msedge.exe	104
PID 2948 wrote to memory of 3408	2948	msedge.exe	105
PID 2948 wrote to memory of 3408	2948	msedge.exe	105
PID 2948 wrote to memory of 1748	2948	msedge.exe	115
PID 2948 wrote to memory of 3188	2948	msedge.exe	116
PID 2948 wrote to memory of 2872	2948	msedge.exe	117
PID 2948 wrote to memory of 2928	2948	msedge.exe	118
PID 2948 wrote to memory of 2928	2948	msedge.exe	118
PID 2948 wrote to memory of 2928	2948	msedge.exe	118
PID 2948 wrote to memory of 3872	2948	msedge.exe	120
PID 2948 wrote to memory of 3872	2948	msedge.exe	120
PID 2948 wrote to memory of 1044	2948	msedge.exe	122

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://mailer.worldlitigationforum.org/l/2obJFNmoQ562xbtJxBdvUg/gwlvuXWaOFlMHQ08MMlVAA/ExZhUrHE3nPA8927NpksDfUA
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7ffe7821c188,0x7ffe7821c194,0x7ffe7821c1a0
  2⤵
  PID:4336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1928,i,9365173019073055832,18242846527201715207,524288 --field-trial-handle=2100,i,16665500978571661853,2463407478223908323,262144 --variations-seed-version --mojo-platform-channel-handle=2136 /prefetch:3
  2⤵
  - System Time Discovery
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,16356802805935612695,11222012334828683236,262144 --field-trial-handle=2100,i,16665500978571661853,2463407478223908323,262144 --variations-seed-version --mojo-platform-channel-handle=2096 /prefetch:2
  2⤵
  PID:1232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2620,i,3474466595154796485,3685181911710550221,524288 --field-trial-handle=2100,i,16665500978571661853,2463407478223908323,262144 --variations-seed-version --mojo-platform-channel-handle=2764 /prefetch:8
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,17016569757288424193,6567848012544680955,2097152 --field-trial-handle=2100,i,16665500978571661853,2463407478223908323,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,5610480550187911293,3563170399848533424,2097152 --field-trial-handle=2100,i,16665500978571661853,2463407478223908323,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4228,i,2375634289214265211,9268043117124413387,2097152 --field-trial-handle=2100,i,16665500978571661853,2463407478223908323,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,5794573703005625777,17823697916251837287,2097152 --field-trial-handle=2100,i,16665500978571661853,2463407478223908323,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:2
  2⤵
  PID:2144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4564,i,1039450345359981505,13147666035986268580,2097152 --field-trial-handle=2100,i,16665500978571661853,2463407478223908323,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:3500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5280,i,7565375111330182058,11459684700239944379,2097152 --field-trial-handle=2100,i,16665500978571661853,2463407478223908323,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:1
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,7099794770681136778,2430915926533091529,524288 --field-trial-handle=2100,i,16665500978571661853,2463407478223908323,262144 --variations-seed-version --mojo-platform-channel-handle=4556 /prefetch:8
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5292,i,12910667751988361586,13378324150528793809,524288 --field-trial-handle=2100,i,16665500978571661853,2463407478223908323,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:8
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,1230172988480638550,6741338838769286828,524288 --field-trial-handle=2100,i,16665500978571661853,2463407478223908323,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:8
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6204,i,1230172988480638550,6741338838769286828,524288 --field-trial-handle=2100,i,16665500978571661853,2463407478223908323,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:8
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,4546026490025118847,16173216060181796140,524288 --field-trial-handle=2100,i,16665500978571661853,2463407478223908323,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:8
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6244,i,8631220290508423773,11402188780860409346,524288 --field-trial-handle=2100,i,16665500978571661853,2463407478223908323,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:8
  2⤵
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,7484238519624541812,6560487142041780304,524288 --field-trial-handle=2100,i,16665500978571661853,2463407478223908323,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:8
  2⤵
  PID:3188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6212,i,17858016533537765802,11476546597419882598,524288 --field-trial-handle=2100,i,16665500978571661853,2463407478223908323,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:8
  2⤵
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=2876,i,722844313553609704,1733401958957254725,2097152 --field-trial-handle=2100,i,16665500978571661853,2463407478223908323,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:1
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5664,i,15069925856873635346,6710904968582249845,524288 --field-trial-handle=2100,i,16665500978571661853,2463407478223908323,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:8
  2⤵
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3744,i,10917420538532051880,13084787212539260504,262144 --field-trial-handle=2100,i,16665500978571661853,2463407478223908323,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1044

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
MD5 8c7cdfea4284ba987d295d82a9c7ddd6
SHA1 7d1a3a66f2d64a383b230196ba89a263ce7ee957
SHA512 59c8229e834c944265aed4131c79f41f9f940a48651b9fb18800cef5bae36d17c7fd5880120c6fee8ce22a157b65bc63846b65765bc4dc86e15926dcce400d0d
SSDEEP 12:sf9iXhV0xoUZxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxoUZxWMk8xVTeYWI31BtXP
TLSH
T105724C85B34498FFC8835E7189BD27903774F6DF1F02866B6A6A760E2E271C84F44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 81240d13af4ca099e1358c75991e3fa5640dbb3aac72c2d98006f6159bf74aa0
MD5 96dd753cd2d8557b97ab2cd76f7fc6cf
SHA1 81697ccb13fb04a07bd47b552b3607597251f36d
SHA512 355c412a688a71b124e85c0527177b3f97efceb2a5553f8428e0913940daffd3bd176f5476b940c64eee52d543f0568112ac073984d9a64015adc15cbef552de
TLSH
T174D09224BA29A149E282007AA881EB565219DA95296B9622E620C44DBD2B925A3851C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4bf0783d55eb083b4adaa03ed8b76a2bd35b0819c8ad2530a78e1b8d6856010b
MD5 7a50c2e276f05b686e8cb6c95b86650f
SHA1 bc892af04a9d6b1bee8047f67518d676df864301
SHA512 f1d02fd9f067323214d78de08172e1a78028eba76f4754436f4d77b849e8422865dcea22be13f21c36ac2c5807b393c1dffdb0a3217c3353a517a0467461a474
TLSH
T19BD022203A28A008E282003AA880EB020208CA80282BC322E220C00CAC2B820A3800C2
MD5 SHA1 SHA512 TLSH

Submit Download

f_0000dd

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000dd
Size 232KB
SHA256 5ef7b2b7f3ecf075cc414cddd4523c3e6e44e9adc3c015605e07fb58743e3376
MD5 c2142d59fa55623254c83ddbdaba1c05
SHA1 91ab33a97a7b1f164547f63e75802c07be5e7400
SHA512 93cb28029b284c42ece7a414078beac07e4a45d6bff1966d98291b1ea5d56f64be747b70a05fc0b29f6c0bda813740ed4f4e1546624a959d721a07d7520ab2a4
SSDEEP 6144:+a+5x+VtP85SnC5a65TvOYw/dixNyCsLlQh:+a+kdbYOwyO
TLSH
T1D4342320B5C1C48FCF8AD64416FF3E3A91F813916E569C1036B1A75BBCAE0618462FED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 544b6fb951feeda15e37476f7ea559c8a991971e9de4bb5a693d1f42c89b5268
MD5 fe0435886ca56d2d78c73fd917f1cacc
SHA1 b0755cb1de60b6938b8266333e667b3855b229e5
SHA512 f6a9418c757ce92ede33bbc59fa21737519dc555707e57c3e1bb431e6bd5b4dc16669def65a60187d578a72ced97a67c339a0822275263c6b24b8890591f0d19
SSDEEP 96:DDd9b3urPSX0PjznqSdu/SLR0hY/AFjo22H:D7urPbLznn1LmhY/AOf
TLSH
T17EC1EDB40D8A4721EF73937AF8E15AC035B9A0D4F8934F5B01D01B792C8EFE9C62A119
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe593195.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe593195.TMP
Size 3KB
SHA256 c3449e3a0ae13714c17785cdf831a8ce595351f0eb0194237897cb09a8124e52
MD5 c186939eba52757ab402480dbdb7c96e
SHA1 90f104fc3c7fce97adc10727075d6a2923a05810
SHA512 4072c865f17abeb6996cdb59c40bc35b6e3d6941361043582e5cb74efdad40526ca60a46368ff93b63b64cb90be409fe8458cd8d348fd6119a4c8209e04e183c
TLSH
T14B7181F40A0B8B61EF73833AE5D1128471BEC5D8F9835F5E51E01B3D2088FA0CA79526
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

07a3e9b8-3f23-4d80-9ba0-fe309c7898a7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\07a3e9b8-3f23-4d80-9ba0-fe309c7898a7.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 be24712b4438cb6da7a69a8d59b40b5e6521a1eaac85b054313ebca9d7af95d4
MD5 f808e2a7220edb2893b3e958abbd7209
SHA1 c1280ab0e2b4a85c6a7848f8774a4c8ecdd22112
SHA512 cd27415e00ef482e31fd5dccfc9b672060428eb8bce8f4c0f47a39dfea8ecba0fda579b80f819bb65d1f28570edfc78722cce60d1b38cda1b6980d50217df9fd
SSDEEP 192:D9yP0T869Snzvf59PKeLCOc1G30R6PfVTfD4YfEXUUPkN2Be9vlgWer3+FAm3DuO:D9yP0T869Snzvf59PKeLCOc1G30R6PfN
TLSH
T1C932BEB3A3ECC96EC8D116F0DA26AD13CD6E075443583C8ACBE4AF0BA3D3525D25165E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 54ab83463555fc22ba53cced6f96bfd9b41b9fe98dfe35919e91a713e5d32825
MD5 003bd41df50c2a1270b294b973ebe199
SHA1 e64fd9056d745e70bed17de2079455bcbd6e7e44
SHA512 617d833c1f961648eb92b057ccb5ffd8758d916ed3c124c0fb5fc1865ea18572d2d0a6ca03c52acfbebe81275c9bb6569f7a3ac528cc8f47aa08512bd958da0b
SSDEEP 192:sxZYRxyM/jK1Ml8Mke/fBsAFv5IdpxneHW6+WNxs3s/YCPbrm+KIgrJ:sxZY1Me/fBsABSxeHbxH/bmD9
TLSH
T16942D7166B345977CCCBD209BA55BF53D6F90473E2941E44AAFC8A1C00E6AED230782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 0810b94383f2c79b6545774e22dcd74a0b81cc7825d1aceb73c9efbf8271e676
MD5 85ccc78652120ac7f300ce7a828a9de6
SHA1 566442bdada035f43a601bae1b88aa16f47554b3
SHA512 ee325e623f94ccc9773bd09e8ed790eabaf6c8ce6a6192d2865bed1f1b2d339e95e9425f8839caea40a2f9a636610a11b6f8ddf4b34c00641b7053fb3ecddd89
SSDEEP 192:sxZYRxyM/jK1Ml8UQ5h8ke/fBsIhvsIdp/neHW6+WNxs4PdYC3grm+KIg5JJ:sxZYnqve/fBsIV1/eHbxbdWmDx
TLSH
T11F52C616AA349977CCDBD209F951BF53D6F51473D2940E44AAFC9A0C00E7AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 c9e87f1618c73d54aceeda78a8b6fbfe74708177411f6fa1ca2648005bcdce15
MD5 ac07f039e9976c73512edceabd7665a2
SHA1 ae17b742b2c0d7795cd3390e9ff200dac8059bd0
SHA512 d035fe0b5f72bd90734c49cb05f5497dd629614e9b1deb987006f40ff1949ba16c720f94d3be24aa7c2ebdeecbcac96519c7075b74574ffa1b27756d0ec8c441
SSDEEP 192:sxZYRxyM/jK1Ml8Mke/fBsIhvsIdpxneHW6+WNxs079YC93rm+KIg5JJ:sxZYnMe/fBsIV1xeHbx79lmDx
TLSH
T1A352C616AB349977CCDBD209BA55BF53D6F5047392941E44AAFCCA0C04E6AED230782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 ac0bacfb2bbd332df2a2baa862e40c7d717190b3e250f3d189fb6f81e252ad5b
MD5 59e4d6cc399e4292d7b7c6adde23f117
SHA1 615a3df1ecdc4a3c4485cedf2f8b8eec5c2a6e64
SHA512 52b31fd4d12148e91a218b60520dde6ec856e31b98a9cd3793d436bd8feb0d3097fe8525ac260dde9eb07e40d42187aa7be9d4a7c8c003bff507cc63fdb6180e
SSDEEP 768:3s8bqn+WvSCt68F1+UoAYDCx9Tuqh0VfUC9xbog/OVnZLlRTKVEroi:3s8bqn+WvSCt6u1jaCZLbWVPi
TLSH
T143D20B3B280CCB7E4F845E5DEC266F962ED801CB6B988D4447FA894C03C76EA511B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\IndexedDB\indexeddb.leveldb\000003.log
Size 53KB
SHA256 7ac1ec0dc39d56e3649745eabb457735be0448ba456f85b67acf75ec7d1a64f2
MD5 f7d99d34378fa0897525768708964018
SHA1 d978555e872b2a94a30a801d1eeaf106b8a1e6b5
SHA512 f8b067a53c60e970dfd4fac29b6e1ebe4f73c74a2442d62c0bb4df3fe32b5c25c4c217b24bba4e1ba9ece89a516d786c843fe63561b17fc490f0331a40907b6c
SSDEEP 1536:fl4/6vJcakX+FsP59fIQoXK0q6cGHd2Zd/QO0ODV+awPSidFYdn:fl4/6vJcakOFsP59AlcGHd2Zd/QO0UVl
TLSH
T14443767D9CA45433D8B78279A9B127C5BBB27B42BC898D0FD1E3B3484D33B162985D18
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\IndexedDB\indexeddb.leveldb\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\2\IndexedDB\indexeddb.leveldb\LOG
Size 492B
SHA256 bf9ea255d4004bdf09027f01bd9e6b4eff40f3a86f34c8309db4564d127f9d35
MD5 acbf271a696e3d5206bc02dd84a2e230
SHA1 d9e209644759d6485e14d36f3644281baa3b1e35
SHA512 448b667dee48736a74dfdd9e2f1578a451eea280c8920e197cc241c4f4ac2945bc7ac1bb0e92f630e5dbcb0a455942db1e0c5c514dc46b87cbfd8c23c4a6799d
TLSH
T139F0C08B8485802E0590E4B2853C3698E96420468AC82F088F08DA9A67C600AE3AE0E5
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\4\CacheStorage\index.txt
Size 161B
SHA256 368c85f01870c52162c258fef50f5040f11ff9146254697fc0758f8693c8aa60
MD5 7e1b621d86b537965635057148088615
SHA1 0170622512b298e8d64b641c406fc0e46d0d0982
SHA512 c9a1f53a40a8f48f83329469ddc49d42b850f43373ba7cf084b0c0ae996d1c48229a6f8ea1c0410f7652131b4375064d7c418fbe35e8578ddee3f5635bf081fe
TLSH
T183C08CE31810A98A0B70DFCC20317D2EE31F4088CCC0DCF5E50890052138A234002734
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe592f34.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\4\CacheStorage\index.txt~RFe592f34.TMP
Size 168B
SHA256 22b770fbbb7bb289f4a4f65bee46bdd600aa2554fcc49731f36ec7c89cbdd695
MD5 4dc49856834cc3ab0f46fd7f308ea050
SHA1 e88b7fdd22ac057a3c5891066ff70033539c664d
SHA512 7dd45702d44b0349834ef5188b130aa3326f17aa4dbf82dfb232847e70d43c747db56a3cbdcccef458b76c84d15f946bd976e80b47d2e4c6d3f2befafa1b0ce6
TLSH
T1CCC08CE3182069860B319ECC60317D1EE32F4C98CCC0DCF5E50AB1493138A238001734
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\WebStorage\4\IndexedDB\indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

a98b5874-2073-465b-8dea-468942310fb2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\a98b5874-2073-465b-8dea-468942310fb2.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 13860e1fc50297f6245679d282cd7321887c669367f1eeeff7ebed045205caf5
MD5 793128fa4219317548f6bb20992241d2
SHA1 b67a9146c5d81bfaf9196ccc84dd0658f11b1907
SHA512 2df3e7e4e53ce09c00821c2fb84315a427eded445e1763eb2e40ff0945219a0c69fa2ee30d7b252818181ea02e6e1b406d9076915abcc0fdcdd970bf3e5a5cb1
SSDEEP 192:uozLsNQUYQSrkWbiLLQmiU1CH44Ea+jpOmZv6pamfq2XbTk:1sNQUYx4LRyHEa+9O5z1/k
TLSH
T151424A3B69785C775DE26584F44B3213AEB88067DA897FA0D9DC9F0C01DB69C230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 7dac433904778fcadfb5eb8a843399835b05888a79b9d8e2dcb71fe6199332de
MD5 283636452308be09ecdb4e0e469b5f02
SHA1 f2a47b767b48d5a1738e4844a8eb96c99499e398
SHA512 439f7017e443ef82fed9ca5e051aecdc22b5eb06a41a86024f43120815cd0ceae91eb58fb3296c29447e2842ae559b35b5c4bf94fc20a995e4956fe9f0b08e4b
SSDEEP 384:EiFiZcIyzsNx8TUNTUlIlux4LR6HEa+9O5S1Scjmwt:fFQaIwgsHkaMO5S11jZ
TLSH
T159D219F359D78876E9AD5747A77D2E128EBCC063F5849650B7D89A0CCC861BFC30A821
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c22ebde02c08a8f77d441c020fb90578b83542d155f5f8904ba6ced01ae48615
MD5 b1e7c20fd2af3c3e96d0eafecfea7f91
SHA1 c147647700f8b4a4812504195a1621a7890e9d61
SHA512 65663f1cfa5b5ddf8131dbf11066ae2dc9e6f38fb14ed37b1bd6b13590ed3edce6b08bb25c0cfc74eebcc58af9189ac0b064e344a982282fd030137e9eecda54
SSDEEP 96:EqONkCQsjpf1bxX5ih/cIPURHl8h4otop5nAnDIBfPgvE5BzatIRdy+plOmZ8Cor:vONa6Db6QmiUys8HBa+jpOmZvxRg5FU6
TLSH
T1A002F83A69786CB79EE26E49F88B27275FE4103BD9966B40DAD81F0C00D764C2347837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 76253edbe4d2b5495b6938c1ce13212a305744be4b6c3733d6e11f3032feccab
MD5 a537a4c3ba446f510a2e61e49737af13
SHA1 0742c40990a7839d80cb31b21160f05ecff3812e
SHA512 6893658b197ca6f99e91994ede7d4805ddf43361dcd4af5a5202be5def5f7111d61fce3b2f5c8eb59766cc852a1ddadacc0d6b8f6d2e976d8ef3b636519fb77d
SSDEEP 192:XJONa6Db6QmiUy981Ba+jpOmZv62Nzfq2U6:ZONa6Ox1Ba+9O561U6
TLSH
T1CC12F9377978AC776DD16994F88732179EE44127DA8A7B90D5DC2F0C00DB65C234B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 72f1b108cfd1d3566934912b2aaf1d31bd94a0cf922fd93c2d04fb1efed99fe1
MD5 057fe26f3018bd02f8228f4f9cfa92ef
SHA1 0c66e917e1b92d1762c09a448be823ddde1afb03
SHA512 0230a7f23acc2ffe5eadda7104559ef44d37dde3b8eaf902c2d575496695d036d8651ac560be4f013ac99d6e3d7d5130b00475fbfc9326bc885d8bae187452b7
SSDEEP 192:uHzm+xasuheOwQxMGsNQUuQSrkWbiLLQmiU1CH44Ea+jpOmZv6pamfq2ScjmqYoT:1ZcIhsNQUux4LRyHEa+9O5z1Scjmwt
TLSH
T1CB929E336A785C76A9E6A445F8463613CFF88073D6C86B90D9EDAF0C01D69AC130BD36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 aa43e1b574bd73f0bce86d939035d2368903c2ecb20a06a192001f58edde4180
MD5 0f73e0846853f2019a49fea07782584c
SHA1 5a9ebee0c15af04caf1234e68554cddeda945d89
SHA512 82469b024ae37990e11225dd1d2d8aa4f6dc24266f7d0cecffd7f8944a5798e0e9d539082b68c03340f94e05831e4d15e15973b36d976daf1381a1d36bd26c0c
SSDEEP 192:uozLsNQUQQSrkWbiLLQmiU1CH44Ea+jpOmZv6pamfq2XbTk:1sNQUQx4LRyHEa+9O5z1/k
TLSH
T1F1424A3B69785C776DE26544F44B3213AEB88067DA897FA0D9DD9F0C01CB69C230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c7873fac-6727-4e16-8ef9-5a8c8889f9a9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c7873fac-6727-4e16-8ef9-5a8c8889f9a9.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 321170d5b2d85a424082893c616debd48bce290d9b0a64412dd38f69e7646c69
MD5 8d1c34d5a398622aae599eedcee487d5
SHA1 9bb074f0e536090c6b18980e3a219294d2703b2a
SHA512 6ff90594429592c40df5c3a048af5c9d901e1e67342943667cf78e8649db033b37b631283468f4357bd5cd11b01aa2028cb205cdbc7104ea22d042ec71ecd8a0
TLSH
T139411859B6F91148B3B36E56AFF6A86E487F7D272E0AD09D00010E4F4A26B40CD61B33
MD5 SHA1 SHA512 TLSH

Submit Download