hxxps://sixchampthat[.]top/en1cloud2/index[.]php?t1=-10&t2=-5&keychel=yes&clickid=d9l4ot1gar2s73875sug&os_name=Windows&lpkey=1785359538d41cc96bfcedf1a96f1c4cc5f3c51584

Analysis

user interaction
yes
max time kernel
148s
max time network
152s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
30/07/2026, 01:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://sixchampthat.top/en1cloud2/index.php?t1=-10&t2=-5&keychel=yes&clickid=d9l4ot1gar2s73875sug&os_name=Windows&lpkey=1785359538d41cc96bfcedf1a96f1c4cc5f3c51584
Sample260730-bwrbcsaa86

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
688	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134298486303032093"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1741132852-2793423776-1557670484-1000\{15B39247-E6E4-4CC6-BBC1-A32819D7A75F}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1056	msedge.exe
1056	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 12 IoCs

pid	Process
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe
4496	msedge.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 4496 wrote to memory of 2672	4496	msedge.exe	84
PID 4496 wrote to memory of 688	4496	msedge.exe	85
PID 4496 wrote to memory of 3996	4496	msedge.exe	86
PID 4496 wrote to memory of 3996	4496	msedge.exe	86
PID 4496 wrote to memory of 3996	4496	msedge.exe	86
PID 4496 wrote to memory of 4216	4496	msedge.exe	87
PID 4496 wrote to memory of 4216	4496	msedge.exe	87
PID 4496 wrote to memory of 5012	4496	msedge.exe	88
PID 4496 wrote to memory of 5012	4496	msedge.exe	88
PID 4496 wrote to memory of 5012	4496	msedge.exe	88
PID 4496 wrote to memory of 4508	4496	msedge.exe	89
PID 4496 wrote to memory of 4508	4496	msedge.exe	89
PID 4496 wrote to memory of 4508	4496	msedge.exe	89
PID 4496 wrote to memory of 2040	4496	msedge.exe	91
PID 4496 wrote to memory of 3904	4496	msedge.exe	92
PID 4496 wrote to memory of 2040	4496	msedge.exe	91
PID 4496 wrote to memory of 2040	4496	msedge.exe	91
PID 4496 wrote to memory of 3904	4496	msedge.exe	92
PID 4496 wrote to memory of 3904	4496	msedge.exe	92
PID 4496 wrote to memory of 4796	4496	msedge.exe	95
PID 4496 wrote to memory of 4796	4496	msedge.exe	95
PID 4496 wrote to memory of 4796	4496	msedge.exe	95
PID 4496 wrote to memory of 4240	4496	msedge.exe	97
PID 4496 wrote to memory of 4240	4496	msedge.exe	97
PID 4496 wrote to memory of 4240	4496	msedge.exe	97
PID 4496 wrote to memory of 4844	4496	msedge.exe	98
PID 4496 wrote to memory of 4844	4496	msedge.exe	98
PID 4496 wrote to memory of 2204	4496	msedge.exe	99
PID 4496 wrote to memory of 2204	4496	msedge.exe	99
PID 4496 wrote to memory of 1128	4496	msedge.exe	102
PID 4496 wrote to memory of 904	4496	msedge.exe	103
PID 4496 wrote to memory of 904	4496	msedge.exe	103
PID 4496 wrote to memory of 904	4496	msedge.exe	103
PID 4496 wrote to memory of 3568	4496	msedge.exe	109
PID 4496 wrote to memory of 3568	4496	msedge.exe	109
PID 4496 wrote to memory of 3568	4496	msedge.exe	109
PID 4496 wrote to memory of 4440	4496	msedge.exe	113
PID 4496 wrote to memory of 4000	4496	msedge.exe	114
PID 4496 wrote to memory of 1352	4496	msedge.exe	115
PID 4496 wrote to memory of 4128	4496	msedge.exe	116
PID 4496 wrote to memory of 4128	4496	msedge.exe	116
PID 4496 wrote to memory of 1840	4496	msedge.exe	117
PID 4496 wrote to memory of 1840	4496	msedge.exe	117
PID 4496 wrote to memory of 1840	4496	msedge.exe	117
PID 4496 wrote to memory of 2892	4496	msedge.exe	118
PID 4496 wrote to memory of 2892	4496	msedge.exe	118
PID 4496 wrote to memory of 2368	4496	msedge.exe	119
PID 4496 wrote to memory of 2368	4496	msedge.exe	119
PID 4496 wrote to memory of 2368	4496	msedge.exe	119
PID 4496 wrote to memory of 2052	4496	msedge.exe	120
PID 4496 wrote to memory of 2052	4496	msedge.exe	120
PID 4496 wrote to memory of 804	4496	msedge.exe	121
PID 4496 wrote to memory of 804	4496	msedge.exe	121
PID 4496 wrote to memory of 5056	4496	msedge.exe	122
PID 4496 wrote to memory of 5056	4496	msedge.exe	122
PID 4496 wrote to memory of 1868	4496	msedge.exe	123
PID 4496 wrote to memory of 1868	4496	msedge.exe	123
PID 4496 wrote to memory of 2112	4496	msedge.exe	124
PID 4496 wrote to memory of 2112	4496	msedge.exe	124
PID 4496 wrote to memory of 2112	4496	msedge.exe	124
PID 4496 wrote to memory of 1016	4496	msedge.exe	125
PID 4496 wrote to memory of 1016	4496	msedge.exe	125
PID 4496 wrote to memory of 1056	4496	msedge.exe	127

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://sixchampthat.top/en1cloud2/index.php?t1=-10&t2=-5&keychel=yes&clickid=d9l4ot1gar2s73875sug&os_name=Windows&lpkey=1785359538d41cc96bfcedf1a96f1c4cc5f3c51584
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7fffe06ac188,0x7fffe06ac194,0x7fffe06ac1a0
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,8931872922811633583,15291197484479208941,524288 --field-trial-handle=2372,i,8241413695474952586,13169135888393303760,262144 --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:3
  2⤵
  - System Time Discovery
  PID:688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1720,i,3570438438180117719,11298437107789524856,262144 --field-trial-handle=2372,i,8241413695474952586,13169135888393303760,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:2
  2⤵
  PID:3996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2528,i,1551428139800980742,4750436591067043493,524288 --field-trial-handle=2372,i,8241413695474952586,13169135888393303760,262144 --variations-seed-version --mojo-platform-channel-handle=2520 /prefetch:8
  2⤵
  PID:4216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,16285889843850113518,7219263887177821458,2097152 --field-trial-handle=2372,i,8241413695474952586,13169135888393303760,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,13107461975814990526,51860307404496407,2097152 --field-trial-handle=2372,i,8241413695474952586,13169135888393303760,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:4508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4240,i,1033265150366752503,14583319877888980892,2097152 --field-trial-handle=2372,i,8241413695474952586,13169135888393303760,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:1
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,12114102035025507642,12823051742080463875,2097152 --field-trial-handle=2372,i,8241413695474952586,13169135888393303760,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:2
  2⤵
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3608,i,9810414033499186487,13210505873347358504,2097152 --field-trial-handle=2372,i,8241413695474952586,13169135888393303760,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:1
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5328,i,2178620814360826527,8035809038224173657,2097152 --field-trial-handle=2372,i,8241413695474952586,13169135888393303760,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:1
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3584,i,7902424249325681677,12786534846564223718,524288 --field-trial-handle=2372,i,8241413695474952586,13169135888393303760,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:8
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5264,i,3688561927467216898,2920289995626404407,524288 --field-trial-handle=2372,i,8241413695474952586,13169135888393303760,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:8
  2⤵
  PID:2204
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,8399702919542773456,15847625908231766759,524288 --field-trial-handle=2372,i,8241413695474952586,13169135888393303760,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:8
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,8399702919542773456,15847625908231766759,524288 --field-trial-handle=2372,i,8241413695474952586,13169135888393303760,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:8
  2⤵
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=3736,i,7403169855684297911,1832116423500796879,2097152 --field-trial-handle=2372,i,8241413695474952586,13169135888393303760,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:1
  2⤵
  PID:904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5148,i,16103878028816671963,3248431071199515568,2097152 --field-trial-handle=2372,i,8241413695474952586,13169135888393303760,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:1
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4328,i,18136582763049998241,11427236379702763952,524288 --field-trial-handle=2372,i,8241413695474952586,13169135888393303760,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:8
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5244,i,2540796392871643742,13050512539567236461,524288 --field-trial-handle=2372,i,8241413695474952586,13169135888393303760,262144 --variations-seed-version --mojo-platform-channel-handle=3420 /prefetch:8
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5260,i,10210652436709020014,15679477735612779166,524288 --field-trial-handle=2372,i,8241413695474952586,13169135888393303760,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:8
  2⤵
  PID:1352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4296,i,607014592684815480,17892114408517281128,524288 --field-trial-handle=2372,i,8241413695474952586,13169135888393303760,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:8
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6592,i,14951021624568058987,2110195570659676461,2097152 --field-trial-handle=2372,i,8241413695474952586,13169135888393303760,262144 --variations-seed-version --mojo-platform-channel-handle=2948 /prefetch:1
  2⤵
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,1151476773491182732,18317316983135163752,524288 --field-trial-handle=2372,i,8241413695474952586,13169135888393303760,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:8
  2⤵
  PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=5376,i,4315540211682004676,5653325217469378801,2097152 --field-trial-handle=2372,i,8241413695474952586,13169135888393303760,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:1
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5268,i,13404549050212917157,10613974559218412235,524288 --field-trial-handle=2372,i,8241413695474952586,13169135888393303760,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:8
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4316,i,11079245644475083533,1592290486767089232,524288 --field-trial-handle=2372,i,8241413695474952586,13169135888393303760,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:8
  2⤵
  PID:804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6072,i,5566612227954295111,9825165739958647131,524288 --field-trial-handle=2372,i,8241413695474952586,13169135888393303760,262144 --variations-seed-version --mojo-platform-channel-handle=6824 /prefetch:8
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6848,i,5553048284432592270,4220193397348936404,524288 --field-trial-handle=2372,i,8241413695474952586,13169135888393303760,262144 --variations-seed-version --mojo-platform-channel-handle=6652 /prefetch:8
  2⤵
  PID:1868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=6836,i,7076032733863124647,13207727874655386460,2097152 --field-trial-handle=2372,i,8241413695474952586,13169135888393303760,262144 --variations-seed-version --mojo-platform-channel-handle=6928 /prefetch:1
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6424,i,204714089656140617,1450779171001035751,524288 --field-trial-handle=2372,i,8241413695474952586,13169135888393303760,262144 --variations-seed-version --mojo-platform-channel-handle=6592 /prefetch:8
  2⤵
  PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5488,i,11536452150769633957,964515051589725717,262144 --field-trial-handle=2372,i,8241413695474952586,13169135888393303760,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1056

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bba2e49c11cb10e1da3782e96a0839de38ec558ccceb0d68515b04792179f852
MD5 34d661b06bc0857903247c15b32b3124
SHA1 72b12aeb58848c0b8474acb525b5e3c41cf32367
SHA512 ff623932c1d85ab3c9cf10c993d26b94c5e1d9968c6a6f9a48925137edcf7379ba3bc8d216e7fc052000ec59dab883f4b498f2262f7941a46d3328c62092e788
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7U:fwUQC5VwBIiElEd2K57P7U
TLSH
T1E0B3A931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7073226b4cd1cfc4cf618f45a53939bc635bacfa557eafd1683ee91614cda0d8
MD5 5ff1793d8c9849e8aa6f4b07eaa08bef
SHA1 f5fe82f06b14c36eb220d075b1991d8ce3ddd649
SHA512 12cef1a00cae76ef3fc336350f290b288914eff9dcc7d486d3ac1f47bd4fde52db613b450bb58f380ab912b64ce3ec0b76fcdbb59da73ad728aa42c2e562ab9f
TLSH
T177D012A27A0DB440F6055331E25383012666256028535702B261D41CD6644DC13D71C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 9a3d10b16d8afe0c105f8b187f8f3616b1a6a5acead1299db43d8132ffbdd701
MD5 b1909b2a7b7440e7b9a3adf7750f7e70
SHA1 b05948679b364b6e193b3dfce38acfcbbce327a5
SHA512 6e1a661cdc2dcd861ab31eb46bd839bfe8a465393ade11a2c8d9ad612b4cc1265fdb4cf2a0d373288d8cd20cc1cb7f3e8bf565e575e5204858390018dabaae28
TLSH
T16FD012A27A0DB840F6055331E25283012666256028539702B261D41CC6644DC13D71C7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ff3badaa5e42fb1042df050a300d808323325a886ef723f1cdb36ea8ac014b83
MD5 04ef658bb9c1ff8cfa1ebc7f79cf9e02
SHA1 77c4a405cae510e84d676d42022151019915d1b6
SHA512 d4357d8b1ed36b120fc75fb8407e4bf7d8af06aa8fefbd690af8e836cccece918ede08c345e5238c0cc76a634f44dd69bdc36a701edce47c6da9970efc514913
TLSH
T18C71A359060B8C6DE38C853099EFC2853371849DB5D70E1B1ED45B75FA2EFB02065B07
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe586608.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe586608.TMP
Size 3KB
SHA256 f6051420f232d47812b6eaab909e1fe85622037ed7039c05281809000a0f86ea
MD5 a0eb8d47b6d7f9e5d83af64a41e8664c
SHA1 4de1372e1700e83720ee985e2ab392e13c77f27f
SHA512 2ee3568baf541a00a83826ee2a02835585decc2215cb3bc10f2a685fded43ea87167261c778793f663d010fb9d13a3e32f7233814a96d63fa981705786df3cf3
TLSH
T178718259060B8C6DE38C853199EFC28533B1849DB5D70E1B1DE45B79FA2EBB42065B07
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 33d6ce5d0af2fef2b312c8d6a271001e7f27aa5f4d516881f0f85f21d0562a37
MD5 2e83af8d0f42b897458e73363a6c1355
SHA1 ae34dc418ba71a0370656c1f362523cd88bc0cee
SHA512 fd2403cd6ef817f749c8b9809a7f3855fa29967e0f23ed1dc62a42d2bb7550e802686c3851ac6071706619af1c12368415a0bd872d0a5a00ea136035f5a40e0b
TLSH
T12531C0B3C3F4856F8A1156F0AA18AE2BDE1D0612431C3CA9C9D4AF1B93E2571E10165F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 21KB
SHA256 e3c47edca538e8203534e7662bff1ba7219aa987038654403d7c62a5f7e605ca
MD5 ce1a4000db313d15aec5272fd6a17053
SHA1 aefa9ae3f9ddab164f879125ab546c5a284d15ed
SHA512 f6c14adbe71a1683a3faeb3105c325041e0e08bd911edc9a7fe51f7ee6e85a07bee05de00a908dbe0525cd1885f2d5dc6151f35b74ed83dc4551f33d4ab3264b
SSDEEP 384:sxZhNqWP/fJZ9ZhZgZjZRUZyZeZOZj41xnOkuJzvkjwGfcwmsvm2qHbXZfH:sZ8WP/f3jfW9RC8wAefcw9mRHbpv
TLSH
T136A2E80A9524E973C8D6621EB6757F73E5F5452683902D6C69FCC70C40A6AFC3217C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 80f510d0c496e562e14a6e1a94f10146a011669e2f066b4517d3a3abc9cf7043
MD5 dd9163e11a5ac6314ab7e09075623d5c
SHA1 70a3c894b665201572f68b412fc8041636604f41
SHA512 98412d1af0d3dfd5bb93fd577fe1e96a074e698d8bf1a3ab2fd3e5f991eb76e0d59f6c3a56b33882e45dca8c613a64fd632c8e7a28ca5e713ef60c0aa64bacc4
SSDEEP 192:sxZhRbyM/jK1Ml8Mkd/fFsyDxIdpg7HW6+WNGYcqeIEBIgrJ:sxZhjMd/fFsyD6qHbGH9
TLSH
T1D742E8166B349977CCCBD209BA45BF53D6F91472A2900E48A9FCCA0C04E6AED2317C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 a8553e683cbc191bfd125a2f4ed8437342c2143a6770523641e8ca935e536960
MD5 22e81fd06796471c09b4bf264bdf0d45
SHA1 1e7d7fe2c5b453e05abc8375950ea894678e208d
SHA512 223d34186cbc2bb2c41af98834c23614a6a2efb6d2f53ec2007917d17a1bc231c0d863814def32ad8c8ab375426c5f65517c3cdd052326eca6b47e1693d5cc3b
SSDEEP 192:sxZhRbyM/jK1Ml8Mkd/fFsvmxIdpmP7HW6+WNFEr/Yc4eqEBIg5nJ:sxZhNMd/fFsvm6AHbm/rH
TLSH
T1DE52D816AB349977CCDBD209BA45BB53D6F55472D2900E48A9FCCA0C04E6AED2317C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 2e329881bab53fabeae1d86420a5b236bb0b58d1e140581523f187d20570087d
MD5 78795e66430b6a247050d29a17ba210b
SHA1 48018af3a63f3486b4e9a916a752b32d23367d2a
SHA512 b2c914675e153ce0d828cf3c1f9f172ba13f57542b2ad6bc9ee9436b93f0ef5c2b813eb0f954cfa68c42ae63db81a2eb90a4c6e7ee78bf3b4e5df20f7311c09e
SSDEEP 384:sxZhN1P/fJZ9ZhZgZjZRUZyZeZOZj41xnOkuJzvkjwGfYJssvm6XHbqfBH:sZLP/f3jfW9RC8wAefYJPmQHbEN
TLSH
T16B92D70AA524EA73CCD6A21EB6757F73D5F5452683902E2C69FCC70C40A6AFC6117C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 9664779a9a4dde1216f6dab3063db42483f5ffaebfec8783585cb19420dbd5c3
MD5 5a85d0ddd8b6a94e025138bc75d5d2c9
SHA1 01124adfb9c25513716ce79a1975eaa922f926d3
SHA512 add185b091b4557a5f81fd7abbab06e4b94a2288e4cec114e2dcfb30addd06d48adef3b4cf93bfb6d59175ce0c806a33593b0253ae3225bf2bfd880e58523e52
SSDEEP 768:pW03ifCWvqG1m8F1+UoAYDCx9Tuqh0VfUC9xbog/OVb9Ll1/CBjroiJE9:pW03ifCWvqG1mu1jaa9LfKBQk8
TLSH
T12CD20B2B280CCB7E4F844E5CEC666F962DD801CB5A988D5447FA884C02C77EF512B9DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 33KB
SHA256 272de85bb3033a18a2c56287ce2f6f7078bff236a0e0dc28d956ade971ad1dd8
MD5 0d8f8f1ac98733eb5be37dae9984c651
SHA1 f406dced1bbd5bb28c55cd37abd7017c410db464
SHA512 e7eaf05768616de53d1b00b6b60f6c4c500ed104236f756a07a4fe94df12b61ee2bfca1ff59abac79779c7141225edcb85ce49f577d2a84e20883ba9ac03a695
SSDEEP 768:plJy03ifCWvqG1m8F1+UoAYDCx9Tuqh0VfUC9xbog/OVNV9Ll1/CBjrohJSy:plJy03ifCWvqG1mu1jayV9LfKBQLV
TLSH
T13DE20B3B280CCB7E4F840E5CEC66AF9679D401CBA694895447F9894C02C77EF512B9DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 cd0ad36aa8ac10dad207e8199740775b2302def207db5408607ebfc72764064d
MD5 37b1d2348549f2476fde9aa6409e95b4
SHA1 a6e0c97a9d1697fb52f7c23442a9652a96412550
SHA512 773e4d00332a3c84a8fcd12625f8ee3f3ece0287c7e8de287024f389e1b4919a7658e2104e71620d70b1c7a83f8cb09da2c2eee412dfc24588ad863f2a541ebf
SSDEEP 48:KkEIXKxuEryVRIxKaE0DydlIZKOEc9H0h1XlJnz:KkEgKxu6+R+KaEamlSKOEcH0h1XlJnz
TLSH
T1FB9105117037C21329BE6D0C92A18A378D8272637418E56F7F7862768E66E114EFE4DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 c187f9518ccd97cb342d758ef039ed070b14f626a61352f010f2479f41eb0d11
MD5 673b63f4667ef5bf6aba68286c678b84
SHA1 f0cba77d2fc243a1c8e4ac04bffaf760c4cbe9c4
SHA512 0ea9b20f006568bc1147ace08d3de44076334e1399f271627fa97b11000f297f69972db1cc2412b93229102d685615f39031fe1e453e63cc3fdf0eef55f2bd65
SSDEEP 384:aZcIhsNukfet/qUCWikOBrjKjx5O9sOObjI9G6w7JM:YhCWpOBPKjxqs29MJM
TLSH
T108929E36AC389D7759A6A550F0CA36235FF89037DBD92F84E1EDAB0C01DB5AC130791A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6cae63a7f5d7e0634e5512e44130e7f4931e6b296ec80314cfec98dc56a74c23
MD5 a132373427a0722be0609471ea382ef4
SHA1 78d30e1fcb789cb9b89b6db982dda3da5a6aba5d
SHA512 96e8a6dd0e394569fa9d335888a6d0ec7b306f153a50765f369d7c1fcfbfe47eb5b3a6c6af234b0be9dcf47aac516b8eab1ddc1cc7fca03e3080d8ae7e4616eb
SSDEEP 192:aONn6v+aQmiUywD+miOBqkjKdDYqxzFgNJRi9qlU6:aONn6vlV+nOBrjKjx5OCsU6
TLSH
T18512093ABD6CAC775ED1A590F08732135EA95167EE867F84E1DC1E0C01EF99C230791A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f85669ad41cb8e304ca733ea6276759ada2d434a236a86ef677c6a6151e252bd
MD5 6433774ddd924b7205ff7eb6bd5e632b
SHA1 17270c99f69ba4e825bc0a95c25f6329012c6d93
SHA512 e2d97ec724b9497e9ab64918a60d77ef120b2396419cef28e04efd3a1ab9a09693ec55f2ee438f79166591cd802744003595bf44040739ad8e9c94b8227f3eae
SSDEEP 192:eONi6v+XaQmiUyGDCmiOBqkjKdDYglRCOjU6:eONi6vt7CnOBrjKZNU6
TLSH
T12502DA39BD2C6CB79EA1AE44F08737175FA91077EA923B44D5E85F0C00D769C2307926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 2efffbe1dc0ec37a142033929035d6c3e5188ced52ac040902281d6736ba0c26
MD5 90344bddabbfa9bca749d6e37a94d4c2
SHA1 74a007a4d2628162df3368523c6a7c98d05c63da
SHA512 98f12c999f6089a20429b8fcf8dd18a90eb8114a4a6313cbddcddf82337fb3a16765e3ec3817a5c91cc3ec65da33708f6a607b5dd4bc4ff10a6de5ea039a797c
SSDEEP 384:IZcITUzsNukaet/qUnWikOBrjKjx5OksOObjI9G6w7JM:2k+WpOBPKjxps29MJM
TLSH
T1DAC23AF668E78932C99E5313A3BD2D135EBCD027B6942A44B3D85B0CCC9657FD306416
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 669f61e84b3af9753cbd8c25e0ea5c22028b5d45de6957a7ad54e44d59082f4c
MD5 47e6e5194119a029746b1cd929e50c02
SHA1 02450e55b522f347c4508fb9aa2c11bd46c53ca9
SHA512 e780253a02052614ae8ae6f5473ccc4ca2678e262b180d95011e91f6efcf8fe8eebad7529d800d1f6a813c12dac935d6fa19bb6208455dcfffea45587a3e8ef9
SSDEEP 384:RZcIhsNukaet/qU9WikOBrjKjx5O9sOObjI9G6w7JM:5hcWpOBPKjxqs29MJM
TLSH
T123929E36AC389D7759A6A550F08A36239FF89037DBD92F84E1EDAB0C01DB59C130791A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 05c167206561ac3bc97c643b63d5cc5bd0416de7ba840ee9570fd75e138a1efc
MD5 c493463ed37f6d0d1a1344de7ae399f7
SHA1 68e690254c6c2fb78475aab099a4eccb98260211
SHA512 65b3d6b054120a1f43ae8974b4362f31495cd217e7da27bab45926f3afacf03661786cffadcc31ad0acd433ab2f93cdbbfe323310592450fca730c06bcde8b31
TLSH
T12C41F898B6ED1108B3B76F56ABF6A46E897FB9371F0AD45E10100E4F4622B40C872733
MD5 SHA1 SHA512 TLSH

Submit Download

4b386ebb-2106-4ff4-8168-ced956b481d9.tmp

Path C:\Users\Admin\AppData\Local\Temp\4b386ebb-2106-4ff4-8168-ced956b481d9.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

LICENSE.txt

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir4496_705537820\CRX_INSTALL\third_party\typescript\LICENSE.txt
Size 9KB
SHA256 43692cfafa6a5c09136cfa0138b9c78efeb56ee6b9174553dbf704b888771f6a
MD5 f632dfdde0adc0da86f701c6f2df38af
SHA1 5a7612b4d9977a7e79f60e88df556b09a90df828
SHA512 87722a2d675028d18ea276dcf18c24e891a0bad5f85f7387702310976d2fb8e1d0687321b0844b6c47947e6fbb489fe08bd1ffbe9772955ac7191ba4e274c8a5
SSDEEP 192:rwqW/NVo4UTo1YEHFNnFE6GhUGi2Re1CVThOCoHqxLJbzjwA:8ZhUk1Hf4Rg2HbLNB
TLSH
T19C12637F774903770AC30172B78BA4CBF32E903D3BA556644059D06823ABD6583BB69E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download