hxxp://C[:]\Users\jpcnz\Desktop\Tribunal Evidence\Infected\Computer Force\27-7-26

Analysis

user interaction
yes
max time kernel
898s
max time network
731s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 23:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://C:\Users\jpcnz\Desktop\Tribunal Evidence\Infected\Computer Force\27-7-26
Sample260730-23lbssygld

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5440	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134299264109945459"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{61B53C81-0721-4269-968D-87879935A144}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1548	msedge.exe
1548	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe
5324	msedge.exe

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 5324 wrote to memory of 1480	5324	msedge.exe	86
PID 5324 wrote to memory of 5440	5324	msedge.exe	87
PID 5324 wrote to memory of 2356	5324	msedge.exe	88
PID 5324 wrote to memory of 2356	5324	msedge.exe	88
PID 5324 wrote to memory of 2356	5324	msedge.exe	88
PID 5324 wrote to memory of 2824	5324	msedge.exe	89
PID 5324 wrote to memory of 2824	5324	msedge.exe	89
PID 5324 wrote to memory of 4528	5324	msedge.exe	92
PID 5324 wrote to memory of 5084	5324	msedge.exe	91
PID 5324 wrote to memory of 4528	5324	msedge.exe	92
PID 5324 wrote to memory of 4528	5324	msedge.exe	92
PID 5324 wrote to memory of 5084	5324	msedge.exe	91
PID 5324 wrote to memory of 5084	5324	msedge.exe	91
PID 5324 wrote to memory of 5040	5324	msedge.exe	93
PID 5324 wrote to memory of 5040	5324	msedge.exe	93
PID 5324 wrote to memory of 4988	5324	msedge.exe	94
PID 5324 wrote to memory of 5040	5324	msedge.exe	93
PID 5324 wrote to memory of 4988	5324	msedge.exe	94
PID 5324 wrote to memory of 4988	5324	msedge.exe	94
PID 5324 wrote to memory of 4512	5324	msedge.exe	97
PID 5324 wrote to memory of 4512	5324	msedge.exe	97
PID 5324 wrote to memory of 4512	5324	msedge.exe	97
PID 5324 wrote to memory of 1808	5324	msedge.exe	98
PID 5324 wrote to memory of 1808	5324	msedge.exe	98
PID 5324 wrote to memory of 6044	5324	msedge.exe	99
PID 5324 wrote to memory of 6044	5324	msedge.exe	99
PID 5324 wrote to memory of 608	5324	msedge.exe	101
PID 5324 wrote to memory of 4416	5324	msedge.exe	102
PID 5324 wrote to memory of 4416	5324	msedge.exe	102
PID 5324 wrote to memory of 4416	5324	msedge.exe	102
PID 5324 wrote to memory of 5116	5324	msedge.exe	103
PID 5324 wrote to memory of 5116	5324	msedge.exe	103
PID 5324 wrote to memory of 5116	5324	msedge.exe	103
PID 5324 wrote to memory of 2528	5324	msedge.exe	112
PID 5324 wrote to memory of 756	5324	msedge.exe	113
PID 5324 wrote to memory of 2616	5324	msedge.exe	114
PID 5324 wrote to memory of 2996	5324	msedge.exe	116
PID 5324 wrote to memory of 2996	5324	msedge.exe	116
PID 5324 wrote to memory of 2996	5324	msedge.exe	116
PID 5324 wrote to memory of 1492	5324	msedge.exe	117
PID 5324 wrote to memory of 1492	5324	msedge.exe	117
PID 5324 wrote to memory of 2192	5324	msedge.exe	119
PID 5324 wrote to memory of 2192	5324	msedge.exe	119
PID 5324 wrote to memory of 2192	5324	msedge.exe	119
PID 5324 wrote to memory of 1548	5324	msedge.exe	120
PID 5324 wrote to memory of 4964	5324	msedge.exe	121
PID 5324 wrote to memory of 4964	5324	msedge.exe	121
PID 5324 wrote to memory of 940	5324	msedge.exe	122
PID 5324 wrote to memory of 940	5324	msedge.exe	122
PID 5324 wrote to memory of 1152	5324	msedge.exe	123
PID 5324 wrote to memory of 1152	5324	msedge.exe	123
PID 5324 wrote to memory of 1528	5324	msedge.exe	126
PID 5324 wrote to memory of 1528	5324	msedge.exe	126
PID 5324 wrote to memory of 3688	5324	msedge.exe	127
PID 5324 wrote to memory of 3688	5324	msedge.exe	127
PID 5324 wrote to memory of 3688	5324	msedge.exe	127
PID 5324 wrote to memory of 5288	5324	msedge.exe	128
PID 5324 wrote to memory of 5288	5324	msedge.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://C:\Users\jpcnz\Desktop\Tribunal Evidence\Infected\Computer Force\27-7-26
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffb32f3c188,0x7ffb32f3c194,0x7ffb32f3c1a0
  2⤵
  PID:1480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1952,i,4414320825136755740,1400932635175598699,524288 --field-trial-handle=2328,i,10655122118791180204,16367134034794056768,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1856,i,12603685858638658485,15699813636742373458,262144 --field-trial-handle=2328,i,10655122118791180204,16367134034794056768,262144 --variations-seed-version --mojo-platform-channel-handle=2324 /prefetch:2
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2472,i,10850640734654007950,10914416372391463013,524288 --field-trial-handle=2328,i,10655122118791180204,16367134034794056768,262144 --variations-seed-version --mojo-platform-channel-handle=2452 /prefetch:8
  2⤵
  PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,1564274607659064975,16149895686497340841,2097152 --field-trial-handle=2328,i,10655122118791180204,16367134034794056768,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,12698292455921768526,2940971891952402090,2097152 --field-trial-handle=2328,i,10655122118791180204,16367134034794056768,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4244,i,3888669088793756146,12994849413065408876,2097152 --field-trial-handle=2328,i,10655122118791180204,16367134034794056768,262144 --variations-seed-version --mojo-platform-channel-handle=4248 /prefetch:1
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4308,i,15793293090609498380,7413054698008908674,2097152 --field-trial-handle=2328,i,10655122118791180204,16367134034794056768,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:2
  2⤵
  PID:4988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5092,i,5264125740068991405,12724491629472750873,2097152 --field-trial-handle=2328,i,10655122118791180204,16367134034794056768,262144 --variations-seed-version --mojo-platform-channel-handle=5112 /prefetch:1
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5300,i,6127593584142090006,2746778859072552161,524288 --field-trial-handle=2328,i,10655122118791180204,16367134034794056768,262144 --variations-seed-version --mojo-platform-channel-handle=5316 /prefetch:8
  2⤵
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5304,i,16174166701877699194,14190270999896344940,524288 --field-trial-handle=2328,i,10655122118791180204,16367134034794056768,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:8
  2⤵
  PID:6044
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,8469400115477867303,13969637027485738262,524288 --field-trial-handle=2328,i,10655122118791180204,16367134034794056768,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:8
  2⤵
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5976,i,8469400115477867303,13969637027485738262,524288 --field-trial-handle=2328,i,10655122118791180204,16367134034794056768,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:8
  2⤵
  PID:608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3516,i,881631447530604228,12625869269373732666,2097152 --field-trial-handle=2328,i,10655122118791180204,16367134034794056768,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=5172,i,8598488534105217038,1772169281625183727,2097152 --field-trial-handle=2328,i,10655122118791180204,16367134034794056768,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:1
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4584,i,999676031870251572,1118271562250748224,524288 --field-trial-handle=2328,i,10655122118791180204,16367134034794056768,262144 --variations-seed-version --mojo-platform-channel-handle=4580 /prefetch:8
  2⤵
  PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4572,i,1594304411853803051,18041259246821747400,524288 --field-trial-handle=2328,i,10655122118791180204,16367134034794056768,262144 --variations-seed-version --mojo-platform-channel-handle=4560 /prefetch:8
  2⤵
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4556,i,7432740728500577922,3858726907554002363,524288 --field-trial-handle=2328,i,10655122118791180204,16367134034794056768,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:8
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=2128,i,8161039722418857727,7664296379406583302,2097152 --field-trial-handle=2328,i,10655122118791180204,16367134034794056768,262144 --variations-seed-version --mojo-platform-channel-handle=2924 /prefetch:1
  2⤵
  PID:2996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4524,i,2083938097135673767,1225011208603022137,524288 --field-trial-handle=2328,i,10655122118791180204,16367134034794056768,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:8
  2⤵
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6240,i,7719282365133558135,8716571088451998344,2097152 --field-trial-handle=2328,i,10655122118791180204,16367134034794056768,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:1
  2⤵
  PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5248,i,1445777438611280098,9006897727218604363,262144 --field-trial-handle=2328,i,10655122118791180204,16367134034794056768,262144 --variations-seed-version --mojo-platform-channel-handle=2916 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,13285984436484887929,17509871445772133489,524288 --field-trial-handle=2328,i,10655122118791180204,16367134034794056768,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:8
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5448,i,659329812811679252,13769852154583979876,524288 --field-trial-handle=2328,i,10655122118791180204,16367134034794056768,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:8
  2⤵
  PID:940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6680,i,420345945084161508,14168559862068494468,524288 --field-trial-handle=2328,i,10655122118791180204,16367134034794056768,262144 --variations-seed-version --mojo-platform-channel-handle=3340 /prefetch:8
  2⤵
  PID:1152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3968,i,10426252688584163237,13913433128457907818,524288 --field-trial-handle=2328,i,10655122118791180204,16367134034794056768,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:8
  2⤵
  PID:1528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=5384,i,9374823916845229757,4539257647595603556,2097152 --field-trial-handle=2328,i,10655122118791180204,16367134034794056768,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:1
  2⤵
  PID:3688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6592,i,11834669139738374951,8623761374139535297,524288 --field-trial-handle=2328,i,10655122118791180204,16367134034794056768,262144 --variations-seed-version --mojo-platform-channel-handle=3040 /prefetch:8
  2⤵
  PID:5288

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3340

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 deae8ba3a07225fe9f1490e4968fd83f8d308707a88a6d3d541d8ab416841ddf
MD5 1fcf11901014bf515178c91bdb7a6c5c
SHA1 4746b018067d9671617515224b7697b27fd2fc5f
SHA512 6059830103275d34e1aa4dd4e8d4177b6c2b684b2b3ad5417753387a227c838c0b258e662c78853cf649656ebd762f5d160c10349cd19ac1953380bd6572c660
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7p:fwUQC5VwBIiElEd2K57P7p
TLSH
T16EB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 d9422cfb3b63f2064177c15656cf89e8580043276c733fb43b1da3b75f976eda
MD5 3025b96dc1d47bd31c394cb2ed0e5387
SHA1 e275dc249ebd34af3ad1de15c72ba8b931aaf242
SHA512 326eb3d35b026fad506f42cf64f427b9b398ec6442c2a1b2d3bf6a66423da0b8abf8c04658a8fb2c6967259a3a8a293f33cd2181b2dca327d8ff22fe6b485977
TLSH
T1BEE0268406EDC22EE250A88B816C974CC2C0371AD6C8698E3B00849C3282040E7CFD99
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 45ea46988408bf263f2c62bb55069b4dfda0b5e4297feb44941c15a89262cd56
MD5 c2791e69f42957195fbc0465637e23c9
SHA1 2c862e21d9dd7a2bebdf28599bc7a7ee74103a87
SHA512 65550b8559a46af62097491607ff61532e8d6b602f0fb43b340dc7354e74b3b86a062e5be84e770f7ab5451318e47bc7587a8294d00ec24211309e5b46457802
TLSH
T1B8E0789845DCC21EE148A5C7C17553CD4155770FD2C47D1E770C84783501444E7DD954
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 6f0ea029c1d792ed8a0c0747ac5950ec6e663cc9f3acd5508bf5d06c3370d802
MD5 7085bdb521e679ed89a9c9e0d2e023e6
SHA1 cda1ad9541d704a2612b9744be442a49c94bb356
SHA512 4a49a0992b3fda1f2fc92dddaa05cb78a178c970ad50c706f9f08b58fe16e121a46908915e3cca555798cf868ca1984a78de66712da93030ff51e843fd5637be
TLSH
T18A616EF8414D0CC1EFA21230E8D19E0AF4F29EBA99770FC5E5589ABE2505B60D15B330
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5852fd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5852fd.TMP
Size 3KB
SHA256 3be3f59ba08e6687fcb743c0f691e639687acdb84117a3d1d15bc89a5a9b916f
MD5 397e9580a961fc1e1bb16160a991471f
SHA1 6c35d87b6f738755abc2bc6f73c2efb5dd956a13
SHA512 a37e68bde91cd243c6116dcd92c4473a3691edb912e2e70d7e3a20ac2e1b7dd75053cfda0e0cd969b52ef235071d6b497cbc5c129f442e4ea375e362aa23ad23
TLSH
T102616EF8414D0CC0EFA21230E8D19E0EF4F29EBA89770FC5E54856BE2505B60C14B330
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 748ec4b14ac9b1fa7e8ff424d91e0fb75524437541bf649dcf111ec6eb18a964
MD5 1aa8044a555cc62422398b74c5eef691
SHA1 23a246929625c2fa4e06432afbf0b8eff7d0a592
SHA512 a756fd2f509517ebba1327c78a7dab2387f961c89d6bc36f4f0a57b45acd9b81543ebe74e417c88bb6e3eb96a9b4ab45131029470d19fe1d06572c4b4b7ba788
TLSH
T10F11BDF7C3E585AEC91556F06A24AE2BCE2C0902422C7C1585D4FF6783E3475D00255F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 966B
SHA256 284152e07ce8d67bd172ac752e7554ec908dcdb3cf3ec69204225e9b0257f252
MD5 e1b84b8ce91db0d444231bccc9ecbff2
SHA1 9b8949875b96b23b33c4dc3c79a8af72829fb5e8
SHA512 e3e11c38c5b420f74effce86f2a3ee9c7b5c9fd6bb7d200208ce6c29f567695e87303444e61f988a57f23909b976974b2a6b3d6f2386d1790659ac3944c4dee2
TLSH
T147115BF3C7E5965EC91156F05A28EE2BDE2D0516421C7C2985D4EF27D3E3076E002A9B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 6428851f08a85e6eeb17178a4f14cf3b1fcea07a06c17db48c948775bee07806
MD5 9fde8ba4ea6a73f4c76bdcf4534eb5fc
SHA1 f123050674c5ed2660ee00281026ea170694be00
SHA512 89bef26e1021eadc0d8124e1163e07b67ab084558789a4af1433e8209259ffd142d5907c7ab11b46c9828918c221ad04333722b63aa7e27e527247eb06dc4938
SSDEEP 192:sxZ/RTyM/jK1Ml8Mkr/fgsV3LIdpJwHW6+WNGYHj1i0IgrJ:sxZ/7Mr/fgsV3UaHbGQ9
TLSH
T13C42D616AA346977CCDFD209B955BF53D6F91472E2900E48A9FCCA0C04E6AED231781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 a405858707aff2bf52129c6c9c2e4cf05cf78581d0acc56dab1143b6c3b5d354
MD5 559d403d3109b7555a902ddf9317d71d
SHA1 00a8995ffe76378bfb3c7c47293bab1931dd3b1c
SHA512 06da4d568e49d4a45586c6a6846e6637e9365d08fee75148e448cbfcc9460c4b19443ee53d98de2484aee8ba0022309d1b5b4735b4e3dd00111240d5adcf84d9
SSDEEP 192:sxZ/RTyM/jK1Ml8UQdkr/fgsojLIdpXwHW6+WNGYH+IV0Ig5VJ:sxZ/7q2r/fgsojUAHbG5B
TLSH
T11252D616AA345977CCDFD20AB945BF53D6F51472E2900E48A9FCCA0C04EAAED631781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 aad6f02c888bda9e377c7973cc1873e39fd94cd93cc99fa30b2eb193e50dcaa9
MD5 bb8614a1609f5f04c39c36a853573c9f
SHA1 9e18a0a467d3972ceae69c7038d51c60ec8e9d68
SHA512 4d4101eb0741580b1e9bf3b0849836c0bd53a6166b705f7c0d9ed7891a6409b9b86452a27f825bb9eae69501a8a034bfbd2e1251f8135aa21b8892b7619e2aa8
SSDEEP 768:1gUZYTMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4RCroVU0I:1gUZYTMWvg0Pou1ja7eLZmRZlI
TLSH
T131D20A2B680CCB7E4F844E5DEC2A6F963DD801CB5A984D5447EA894C02CB3EF512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 89ac86b258bde363683ccc736900d99cfce043eea86a9b8e485778873c4d80ac
MD5 876469de2624e460927481c342a77183
SHA1 9ff60569ab0748473dbaf42e49ff70cf35ea065c
SHA512 3c4f2791f43d3df7fd2a0acdb1b7247f4f65cb88f26d518a0993399e92c0d7783e1eb57eff87d1871400ce31ee9cc3d071932115287a38fd113c4ebe04220537
SSDEEP 96:KA1eK2AwZiKCsKHuz6OMEE+OUpl8u+KkL84+gmuRox+UKDKuaG8KLaj:E0VFFjn8
TLSH
T10FD1E62672B602113C3D6A0C86D597AB8EC272637018646B7BED00B5DE66D21DFFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 066968934b6a073a230289b0dbe32dca363ded3b33b6d525844e80f49a696fd9
MD5 dd6becf20a51556151778d0c9e4431c3
SHA1 558c36cc3d9f6f07a22e826ed85f975b69b67fcc
SHA512 60b005140fb1bf81fda0dae6267556075d994da6423134f03c0e8bed1a51d2ea2832d23a8ddefe75e959aa378779b33148f90f74e356ec803fbf320677eaebc9
SSDEEP 384:ToZcIhsNRTP3jX5N9zX5od+V8ykVVX9tJrOkWOObjI9G6w7GU2:TWhMNN1OD1/hOkW29Me
TLSH
T170929F329878AC765DE7E156F48635238FF89177E7D82F84E1FCAB0C019A5AC431AC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 e2c6b40a0c76b85d52571692ddf7cd41999ecb5fd1327f2bf1b28d1be14528f0
MD5 742c5aba4c37b4f0a32b2c82f06dbd49
SHA1 00fa91a349786f5d2acf7a7fad244413909a8ee4
SHA512 28816207f6898d44e668f44bca1862fde7f63e131408de4cc5179e2270fc7899e3b6deff60ae4a96fa58f99b562f2ef776a6d2a82dccfde3e25351613659d48c
SSDEEP 384:98FiZcI/zsNj8TUNTUlIl+P3jX5N9zX5od+V8ykVVX9tJrOYWOObjI9G6w7GU2:98FQ7ewgmNN1OD1/hOYW29Me
TLSH
T152A27E339864DD7A9EE7AA56F84A36138FF490B7D6D86B80F2EC9B0C019759C430BC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ffd9d3595e3e546312e0a79553eaea3c9c54d21eb91632487e831f395f03fcb1
MD5 94714892cacd143282ead69196d776a0
SHA1 024e2d0c2119c2b2cad5913da194fc694310b430
SHA512 535c3e9e91e1f6f25915c66c78b68a45b74cf0dfd3d80d9e836016c20fbf50518afccd0b9388980570269b3ca1faa9feb3a679dd16f3054122bc850d28f9adc8
SSDEEP 192:yONL61VWQmiUyu3gGX5Obd+j1jzorykaoX/ac315U6:yONL6WXgGX5od+V8ykVCW5U6
TLSH
T19902D835A8687CAB8EE2BE4AB48737135F95206BEA552F84D6FC1B1C009765C2307C37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3251f614aa7329c60be28eae3a66ed63d5f7e495f09df5ae34fd4defbd903091
MD5 4d50adb281e1f88232367ce03b87ad47
SHA1 c23e2e92f919cb0920d6b68314b8668b6683e17b
SHA512 ad04cb7384f33eabbd1357a719b862b248bf0f6027a5c2225aebaa8549aa3cc972791c25908d7a852a220197ba555214d66844b67a7689bda32b6982088494fb
SSDEEP 192:9ONU617WQmiUyk3NGX5Obd+j1jzorykaoVX9ySJrO1jJQqQU6:9ONU6gjNGX5od+V8ykVVX9tJrOHWU6
TLSH
T131121936A478BC6B5DE2B585B48B31139FA55167EB497F80D6FC2B1C00EB59C130AC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 81fcf4e2b65fb0eaeb6b5d6b43afb63f408bed503734d3d1f1c49552bcd14e07
MD5 322f74b73fd8e9821985bd8d98ce760f
SHA1 66a0ea31fc69f2950af005c8d3f39de5e29188c0
SHA512 293f0e028283d788883204d2103221beaa0dc6b59b69feffd57a8508bf058e4cbfe88db74f54ed05f24f1ffc826199509c55cbed2f2f7142bcd43865a9e46991
SSDEEP 384:1oZcIhsNR+P3jX5N9zX5od+V8ykVVX9tJrOkWOObjI9G6w7GU2:1WhpNN1OD1/hOkW29Me
TLSH
T11E928E329874AC765DE7E156F48635235FF89177E7982F84E1FCAB0C019A96C430AC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 ef16185db3f0d4e06105874e229db4a1f8d753c7f07474eba7f870ec2ccc2393
MD5 165ef8834ed2f8d639e266f494104263
SHA1 7124ba9eb12920fc99c9eb64c44cf223f9781f1c
SHA512 a502d04720ca4cc47e7e4212c4b8783e085dc898a4c2252a8e21d2b0308e0e313cb881d07a2bc0169e8e2361714f6d5b4044a6d7a28ba20b30f4a149f2073be5
TLSH
T1EE411659B6E92108B3B37E46ABF768AD487AB8372E06D45E10120D4F0623B00D8B1B37
MD5 SHA1 SHA512 TLSH

Submit Download