hxxps://dnsdumpster[.]com/

Analysis

user interaction
yes
max time kernel
899s
max time network
729s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 07:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://dnsdumpster.com/
Sample260730-jfs41seq81

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4188	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134298706333466988"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{3B880DF9-18F5-4AA0-83B1-DE80C93F8E9C}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1544	msedge.exe
1544	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe
1672	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 3824	1672	msedge.exe	83
PID 1672 wrote to memory of 4188	1672	msedge.exe	85
PID 1672 wrote to memory of 4780	1672	msedge.exe	86
PID 1672 wrote to memory of 4780	1672	msedge.exe	86
PID 1672 wrote to memory of 4780	1672	msedge.exe	86
PID 1672 wrote to memory of 3392	1672	msedge.exe	87
PID 1672 wrote to memory of 3392	1672	msedge.exe	87
PID 1672 wrote to memory of 3508	1672	msedge.exe	88
PID 1672 wrote to memory of 3508	1672	msedge.exe	88
PID 1672 wrote to memory of 3508	1672	msedge.exe	88
PID 1672 wrote to memory of 4056	1672	msedge.exe	89
PID 1672 wrote to memory of 4056	1672	msedge.exe	89
PID 1672 wrote to memory of 4056	1672	msedge.exe	89
PID 1672 wrote to memory of 2672	1672	msedge.exe	90
PID 1672 wrote to memory of 2672	1672	msedge.exe	90
PID 1672 wrote to memory of 2672	1672	msedge.exe	90
PID 1672 wrote to memory of 1352	1672	msedge.exe	91
PID 1672 wrote to memory of 1352	1672	msedge.exe	91
PID 1672 wrote to memory of 1352	1672	msedge.exe	91
PID 1672 wrote to memory of 1732	1672	msedge.exe	96
PID 1672 wrote to memory of 1732	1672	msedge.exe	96
PID 1672 wrote to memory of 1768	1672	msedge.exe	97
PID 1672 wrote to memory of 1768	1672	msedge.exe	97
PID 1672 wrote to memory of 4512	1672	msedge.exe	99
PID 1672 wrote to memory of 2944	1672	msedge.exe	113
PID 1672 wrote to memory of 2240	1672	msedge.exe	114
PID 1672 wrote to memory of 4564	1672	msedge.exe	115
PID 1672 wrote to memory of 624	1672	msedge.exe	117
PID 1672 wrote to memory of 624	1672	msedge.exe	117
PID 1672 wrote to memory of 1544	1672	msedge.exe	124
PID 1672 wrote to memory of 2664	1672	msedge.exe	127
PID 1672 wrote to memory of 2384	1672	msedge.exe	128
PID 1672 wrote to memory of 2664	1672	msedge.exe	127
PID 1672 wrote to memory of 2384	1672	msedge.exe	128
PID 1672 wrote to memory of 2564	1672	msedge.exe	129
PID 1672 wrote to memory of 2564	1672	msedge.exe	129
PID 1672 wrote to memory of 4752	1672	msedge.exe	130
PID 1672 wrote to memory of 4752	1672	msedge.exe	130
PID 1672 wrote to memory of 3384	1672	msedge.exe	131
PID 1672 wrote to memory of 3384	1672	msedge.exe	131
PID 1672 wrote to memory of 4540	1672	msedge.exe	134
PID 1672 wrote to memory of 4540	1672	msedge.exe	134

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://dnsdumpster.com/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ffb70f2c188,0x7ffb70f2c194,0x7ffb70f2c1a0
  2⤵
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1920,i,5318275142971706769,13916532917080246379,524288 --field-trial-handle=2404,i,12915990113214085015,16906765656880200284,262144 --variations-seed-version --mojo-platform-channel-handle=2468 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1732,i,5604420131779756202,5470685565091987418,262144 --field-trial-handle=2404,i,12915990113214085015,16906765656880200284,262144 --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:2
  2⤵
  PID:4780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2432,i,4921679776238799638,14312508152969832628,524288 --field-trial-handle=2404,i,12915990113214085015,16906765656880200284,262144 --variations-seed-version --mojo-platform-channel-handle=3132 /prefetch:8
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,18440667308905495588,7155915398191306892,2097152 --field-trial-handle=2404,i,12915990113214085015,16906765656880200284,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,15357773910574599114,925671544459154874,2097152 --field-trial-handle=2404,i,12915990113214085015,16906765656880200284,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4088,i,10208029228026084952,5812388910083216553,2097152 --field-trial-handle=2404,i,12915990113214085015,16906765656880200284,262144 --variations-seed-version --mojo-platform-channel-handle=4144 /prefetch:1
  2⤵
  PID:2672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4108,i,5555671621652838276,766625323082864258,2097152 --field-trial-handle=2404,i,12915990113214085015,16906765656880200284,262144 --variations-seed-version --mojo-platform-channel-handle=4148 /prefetch:2
  2⤵
  PID:1352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5324,i,976739486783904715,1202343791405256095,524288 --field-trial-handle=2404,i,12915990113214085015,16906765656880200284,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:8
  2⤵
  PID:1732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5304,i,6881593147959805689,11943776772194121938,524288 --field-trial-handle=2404,i,12915990113214085015,16906765656880200284,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:8
  2⤵
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,12007988036052979242,3649240151378811677,524288 --field-trial-handle=2404,i,12915990113214085015,16906765656880200284,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:8
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5924,i,12007988036052979242,3649240151378811677,524288 --field-trial-handle=2404,i,12915990113214085015,16906765656880200284,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:8
  2⤵
  PID:4512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5020,i,16234474143771319732,1189330708660857785,524288 --field-trial-handle=2404,i,12915990113214085015,16906765656880200284,262144 --variations-seed-version --mojo-platform-channel-handle=3828 /prefetch:8
  2⤵
  PID:2944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6484,i,11872421065870903217,11463518930098735685,524288 --field-trial-handle=2404,i,12915990113214085015,16906765656880200284,262144 --variations-seed-version --mojo-platform-channel-handle=4092 /prefetch:8
  2⤵
  PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6488,i,3236813944720159640,9145350275538335914,524288 --field-trial-handle=2404,i,12915990113214085015,16906765656880200284,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:8
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5224,i,13520672760756267905,9029873603152243485,524288 --field-trial-handle=2404,i,12915990113214085015,16906765656880200284,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:8
  2⤵
  PID:624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5508,i,11473478139580973860,16670554414227293962,262144 --field-trial-handle=2404,i,12915990113214085015,16906765656880200284,262144 --variations-seed-version --mojo-platform-channel-handle=6736 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2784,i,13208041556006677758,3613610260082160862,524288 --field-trial-handle=2404,i,12915990113214085015,16906765656880200284,262144 --variations-seed-version --mojo-platform-channel-handle=5368 /prefetch:8
  2⤵
  PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4000,i,1619447878531838441,14858541468494509105,524288 --field-trial-handle=2404,i,12915990113214085015,16906765656880200284,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:8
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6568,i,6624785437709412762,5676917119618282088,524288 --field-trial-handle=2404,i,12915990113214085015,16906765656880200284,262144 --variations-seed-version --mojo-platform-channel-handle=6556 /prefetch:8
  2⤵
  PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5584,i,8280551443704512766,12390860551360414951,524288 --field-trial-handle=2404,i,12915990113214085015,16906765656880200284,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:8
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5256,i,1620603952409667696,697294319842787757,524288 --field-trial-handle=2404,i,12915990113214085015,16906765656880200284,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:8
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2916,i,11642856649705840217,5814633460824088835,524288 --field-trial-handle=2404,i,12915990113214085015,16906765656880200284,262144 --variations-seed-version --mojo-platform-channel-handle=3296 /prefetch:8
  2⤵
  PID:4540

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1108

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 05210635590ecfe61f0ff004344f0d07b5a87e284e29db76f0bd61e97f43da5d
MD5 f3021567e2b276da7e7b2413e95d0918
SHA1 2925767ee01df1ce973aad0d342ba0f82a41cd81
SHA512 5b21fac88299defcd3a29d897631cfc4c2389199b22dd9059a42d23770fa290b889a287add6c819d88e1fd4c377eaeb1334a84e81ea1e94cb895145f971870b3
TLSH
T1D1D09B207A48F441C745017195059F553B2654542057D90AE165585D6CA519493D9682
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ec09ba5da501666cac506a8e17a37a0b19f2d9712ad11c5ba4ad14b3ce62e7db
MD5 e1404f4875306f456785e26a92aed547
SHA1 053db7b2ab0b6a59f2b44973d8f1751505d230ac
SHA512 a6ccf97239d40b1773848dd7f6ee31e91a3f8b90e05f43c6d7b13ead4ba9896a88cb2a9ebb06880b10b5223c52e29e192ba9e6e80528cece8415c817c164e52c
TLSH
T137D09B203A88F441CB45017195049F553B2654542057DA0BE165585D5CA51D493D9682
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 f0d884f737429d48f407ea0431b9af5bbf8e4a1c3a9e4c5b94dfb450d95b63de
MD5 a9ac3943066f538ad01660e23e3cb545
SHA1 05b02ce982332930eb474e88771881bbd121fec4
SHA512 286a44618ec51687a051a0db6eee517eef858eba087e7b639bbb467f88f4d2ea3bb449c2f52884d2fb869f3bf124a69eeab1c5b357ef76a0a1db67fd07b41db8
TLSH
T1CBE020944ACDC36FD34065474178634C4172760A93C47E59272988683581044E3916F0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 558B
SHA256 33e741ba3d0eb195ab32ba653a1562a39342a06befac6f00aeb42bef58dbcc1e
MD5 1ed229dcd663d8da2f0c414feed04c51
SHA1 97694c55d79bc5c6422660d45eb8c835b75b9c23
SHA512 d9234e6d4aa81a809c09df27d095d1e4c4abb0f32d6dbae5e716c1ffd4b4d1cf5d9a7e7a8d10f7a5c59ae8d8a8a1a08f6bec1226e9c1554495d70b7c73822892
TLSH
T18FF040ADB3C0D266E2209A8AC568738A00B07305EBCCE85B2A0EBC983C01241D2AD2C5
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 3162af488c283bbdb6565f4200727821b4e60ce0c47948b8d5b3655271a2625a
MD5 7b9f1e9c5ca7be7a0fd051116a616b72
SHA1 8a88b30a2e0c8a2c94e5512f0a5bb56573a6d8b9
SHA512 2c13705b178f640305a8b7685e6b6a7e49374c53b0713e7e54da2205c3c290a3f79ad3280c111728c5383ffc23941c73a23b34049e67b876aa1915e6e2992364
TLSH
T183C08058798C845DC280187FA726F400177155115817962705A1FCD031406A01F2D124
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 d9849b407c0e42d6bdd6d414444820c1e08eda6cc7bee8f961c339ee08e93c02
MD5 fbc2df466244a30aada7764c194bea94
SHA1 e19888a4af128f0e7c028989535590c97d70ed70
SHA512 8509c0ba08367e7bb4b2ea0b3d0ee5c4fd8cefce7421a9c29ef177773366cc853d9fd7dd6c13f1970e9a042cc844948d7747b520d181a274d64839a899ebca74
TLSH
T171719138199AB49CFB300273F6E03BFC37F2E1AA5D474EC611A018BE158BF724596408
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c38a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58c38a.TMP
Size 3KB
SHA256 e7c57e3f5171241bd6bb8e836e8cfab401cb366968ce79ade5f084760731b345
MD5 904acb96b82528091e6df7d085a0ae72
SHA1 79475c4e2a7a0fdde26b259b410a835a0804c672
SHA512 562aa2ba6811ce6ac5ed93b8394e4e5860d07aa6d24f103138816724de72b6be92f23b247700c4ca030762b1f5dca0be3fbb21543f7883ef5583ced1984630c8
TLSH
T1B261D6380A12B89CF3311373F6E03BFD33F251A94D5B5EC951A018BE158BF328696418
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 de29b85e76fd71bb8bb42803dc1e6e69bea1eda6645d00986b7995e5768c8098
MD5 28590d7f5f80f9a2b23f8abb412ab831
SHA1 48a8f27c539044f0ba03284d4f61f64e10b51553
SHA512 50481c90d29f67264e27bf18fb1e923f5dd54935e55b9e0368279f4f6127da79ad5a9f703fb86714f72756de07b22d001cda368952213c52116d48e3b673acd1
TLSH
T12F51EEF792F0996E981273F1AA047F1FCE280518836C3D1A85C89F5B93E3072E151A8B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 66d3fb43c6c58b27e9147d77c0c5ff9d93073ed64b077b26aa270aa145afda60
MD5 2c3c39f2bcc9995a81b3c110718c5000
SHA1 916f9af6e06e4a938c14b9a28b4a2a525dc75eb8
SHA512 272b51818468a972d24ab48a9839db49f294456f2d30f304115298c1e4eeb9a903941b5d314cdf8a1c895b27f31e76d87f045b936954725887fd259dc58b11df
TLSH
T11051CCF3D6E4896E9C1223F1A6147F1BCE290528936C3D1AC8D89F5F93E3472E15098E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 207aa3cfd5a3ee33cc6df8588d14824d831d79a7e524b8bc8eb2b2b39acbb6cc
MD5 bda27b6d0548858e50248bf077f1a06f
SHA1 c7c4861e549b59c0c20ffa043cb0a6827571f2fa
SHA512 595d1aada7183e7abac9d4495c92bf806f810f3bc8bc8edb144637a5fb41895dda67189cdfcaca7d8f4c858b9634483dd8f235534f607592c9197ed5eb9516b0
SSDEEP 192:sxZz1RryM/jK1Ml8Mkt/fuswL6IdpdfHW6+WNyELY0/YLpvc/CIgrJ:sxZz1VMt/fuswLTJHbV/o9
TLSH
T16552D8166B345977CCDBD209B955BF53D6F50472E2904E48AEFCCA0C04E6AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 2de9475d6e6667dc92cbdcf43f956d0276ff82f946de91651a4cd56599ca147a
MD5 45924e7eab62bd9c29e705b015c341d3
SHA1 3bce79a4328a53eaa897175b52b9b9b1e513d5eb
SHA512 0fcde779c89ce1a1d1d788589b871892105b4cddd73e81a97004daced0e2d46408848bf8495ed6d6e121e76b0b98b9b20ce6d636361a194580da14508c67aad2
SSDEEP 192:sxZz1RryMojK1Ml8Mkt/fuslL6IdpdfHW6+WNytrXYLEE/CIg5WJ:sxZz14Mt/fuslLTJHbcXj0
TLSH
T10D52D816AB345977CCDBD209FA51BF53D6F50572E2904E48AAFCCA0C04E6AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 6edc9f60f784e5101760a634a7715647027efe2339ec6a43156d04b246981d4c
MD5 7c230653020aa140c8cb6caa74df4995
SHA1 6134a365df93a52576f9a51cf04b5c8a0f70044a
SHA512 3420a55427543654400fc33778ba82be9151c07641108b0829df33f915f7f6d681342c2a8cdb30713082482c0b49d4e1269bab4b150ad7d149b48894dbf8810b
SSDEEP 192:sxZz1RryMojK1Ml8UQZkt/fusl46IdpHfHW6+WNylCnYLeHBCIg58J:sxZz14qat/fusl4T/HbZnke
TLSH
T19D52D8166A345977CCDBD60DF951BF53D6F50472E2904E48AAFCCA0C04E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 dc6bb65f63c07e98e3977c6124675d7f006985e62008d06b1e1300cc78aaa196
MD5 af7cd1def2d56930f99893596df3accb
SHA1 e981c93a69233ab09b66e35aff8df546c417d0dd
SHA512 2a3498b11bd30d7d2ca99884f8a725cb91e258775637a988f5c66d70890d2a2e6bada9bd6a3321e9c96d9f358aeb06e0d06400820a2d5d7951a50b0545fef649
SSDEEP 768:4is6pD1WvxzUj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJNIro2M:4is6pD1WvxzUju1jahILIsNz2M
TLSH
T1E5E2FB3B680CC77E4F841E5CEC2AAE977DD801CBAB58895447FA444C03C77EA512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 716c471c963b48014007ff546074ca583599dd802b04f19220bfe8a997fc7afb
MD5 ed4917b3aa5db7326c0f2882ca9270af
SHA1 642de969c96722097bc5528e9f2ac0142b2e450a
SHA512 fb07b50e4eca91c56da9633cc56bee265cc923248fb3fec54adf92cdd8ae9f63ce5a640f297bf2aca6ef39528874e266678e1075c20baf7fac8a9b536143a3ec
TLSH
T1F2E0DFBB6EA76820EDABE3E7287094B50241382CC855FC4FA86AA6C350B13557846C65
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 2d756643223be8f7bb2857ab04bac8546acfc78aa79a1a40c9a93575decb3325
MD5 71629a5ad536edc316136e81579250b8
SHA1 33c05f91b7e1ad94bad727d9e10a124c22ff591b
SHA512 ad7bda18e0dde433d3d11b9d87dcd16751eebe841176d4204efa647612e52c78eba6dc9bd25ca27f67edc9acd0fa8e3bc1bbfd4254b2026179f10ebd4abf69ff
SSDEEP 96:KUAAKtePJHohV/lR7whKKm97KeCmb7KHPCpxIJLsd5kNSKOsC9GXqW4UIg0Mpzu4:iiJHohV/lR8hK19XCmbuHPCpxIJLsd56
TLSH
T10FC1FF1235BB47123C3E290C9394972A5B82F7A33018E92B37A810B54E67E794DFC5ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c67a1703-640f-4242-ab7e-a7e31a25fed4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\c67a1703-640f-4242-ab7e-a7e31a25fed4.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe594898.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe594898.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 56c2c2f1e19b77a8b9e64d10fa81a860919c17567550ef9faf3c2d3eacd4d7c2
MD5 cb5c4952154e18833d63134a693a5f60
SHA1 e6e747aaca02a8e4f3435cadae74e4d1f69bf673
SHA512 6c455aa1e1b5323de42690390558f676047f36d5ceceec194c9e4324fcfaab80f5fad5ec4f716b06ac09a8ff9e8460a16b4563e7ba4da43238242a31a55a6d52
SSDEEP 384:eZcIhsNK2Vk03se2a9nODaw3uOObjI9G6w70I:chgk033dO2w3u29Mx
TLSH
T1A4929D36AC384C7299B2A551F8C639174FF4807BD7C91E84D5EDAF0D06EB9AC030A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 920ac7fd7c46e2b3ad0532d6686b2f314b6b3809b6f34a40c180f27ef30203ef
MD5 e06621431aa4c7caecf43924c0ac8e9d
SHA1 2d80318797f42f17fc40ff13e764ca7a93fbff39
SHA512 2ae88d8e233099f0dc75900b7a47dd74b5cb8979ab2e6e7e248acd6d3dd18d7cc5fa0b6f9b7026b29da0c4eb3ff1225b5c70413a16334a6d58d1995866c25934
SSDEEP 384:3iFiZcIpzsNS8TUNTUlIlLVk03sT2a9nODawquOObjI9G6w70I:yFQJLwgfk0+3dO2wqu29Mx
TLSH
T15FD228F658E78836D9AE5B43A77D2D134EBCC067F6855980B3D89A0CCD961BFC306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2de8c3b377ac0cb9565836f9123cc99b5e933761e512962e9f8d7a1a24d9529c
MD5 486b30b60121f74fbfcc02f2489f5ccb
SHA1 0e52a220919fc6e7d902176e597fffcfc5949840
SHA512 c2871a175796138f7806b153777d785dbbbb1d482418e986b0a6a2e81b5ee678b163e37e5f00227610ee310e1bee7ef851fa9a697f7ce0b82255a1b97280e290
SSDEEP 192:qONp6O7+3hQmiUysIGttb0mO2opgG4fU6:qONp61QGt9nOD5OU6
TLSH
T1E302F8396D7C6CB79EB2AE45FA8737139FA5103BE9962F40D6E81E0C00D765C2347826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 3952f5db19204fb2c452b2f8651118542df59a77336e81c0f8ffea1682804234
MD5 542c5d1872826870fb7882e25ea1a927
SHA1 5476e4a268e231de3b88ddf9e9abba023e4ec570
SHA512 0509cb2c4a2c86221520b76e1ffa8255978203735a81e705e56a5be2c27a17d14fc9a6749a657268ffcd9a1571dc5b0e843a44aa7cccd3864e9723465dd69064
SSDEEP 384:lZcIhsNKLVk03se2a9nODaw3uOObjI9G6w70I:dhjk033dO2w3u29Mx
TLSH
T106929D36AC384C7299B2A551F88639175FF4807BD7CD1E84D5ECAF0D06EB9AC030B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e9eb413f3c3859fc0d8e616832b0b24818c1cccb84b23bcbf46630095abd46ee
MD5 561608629429d039a49ce4da315b3f41
SHA1 1750255815438a3ec3077edae0d4f054ba9125b2
SHA512 1bba79dce4522e8e021cd05e51f168f3c0f31a2de99d5ee080aeffce329bce74acf791dc6bbe6fb44d621675e8f50e84fb565d442ac571486a6f53dc7a8e4208
SSDEEP 192:EOND6O7+3oQmiUyRIittb0mO2oazEdcNZqzbU6:EOND62Hit9nODaw6uU6
TLSH
T1F8121A366D7C9C775EE2A585F98736135FA50037EA8A6F80D5DC2E0C01EF6AC234B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 69f7910b61929d1d36a88fdd98f267420d32a143730a88ae6a446136b1c8697b
MD5 5e02fc0125f4f79f4b65e55b0d20e3f6
SHA1 7f9ddc4434c8441477b762048383acc2b1701f24
SHA512 1b5dd275b576ee5f57235d0c13e353b3f0ed1e82c8e74d017afe87549e5a6b81300bae0570d6ab37b8c7f075b645d5ff4ec5547b61ff091b202aa9c0cf9eeeba
TLSH
T14141F958B6ED1148B3B36E5AABF6686E487FBC372F0A955D10110E8F0B36A40C871737
MD5 SHA1 SHA512 TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download