hxxps://bitter-math-3c38[.]elmereveretttur58546pag18855[.]workers[.]dev/account-trust-manage

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
30/07/2026, 14:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://bitter-math-3c38.elmereveretttur58546pag18855.workers.dev/account-trust-manage
Sample260730-sasqqstyfx

Score

5^/10

discovery

Malware Config

Signatures

Probable phishing domain 1 TTPs 1 IoCs

Phishing

T1566

description	flow	ioc	stream
HTTP URL	77	https://www.cloudflare.com/cdn-cgi/challenge-platform/h/b/orchestrate/chl_page/v1?ray=a23535cfcde8f37d	5

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1492	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134298969525368459"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{5497BA98-53A5-42B2-9D55-D57A96C513F3}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4204	msedge.exe
4204	msedge.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe
1556	msedge.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 1556 wrote to memory of 4524	1556	msedge.exe	87
PID 1556 wrote to memory of 1492	1556	msedge.exe	88
PID 1556 wrote to memory of 3704	1556	msedge.exe	89
PID 1556 wrote to memory of 3704	1556	msedge.exe	89
PID 1556 wrote to memory of 3704	1556	msedge.exe	89
PID 1556 wrote to memory of 4596	1556	msedge.exe	90
PID 1556 wrote to memory of 4596	1556	msedge.exe	90
PID 1556 wrote to memory of 4484	1556	msedge.exe	92
PID 1556 wrote to memory of 4484	1556	msedge.exe	92
PID 1556 wrote to memory of 4484	1556	msedge.exe	92
PID 1556 wrote to memory of 3864	1556	msedge.exe	93
PID 1556 wrote to memory of 3864	1556	msedge.exe	93
PID 1556 wrote to memory of 3864	1556	msedge.exe	93
PID 1556 wrote to memory of 2836	1556	msedge.exe	94
PID 1556 wrote to memory of 208	1556	msedge.exe	95
PID 1556 wrote to memory of 2836	1556	msedge.exe	94
PID 1556 wrote to memory of 2836	1556	msedge.exe	94
PID 1556 wrote to memory of 208	1556	msedge.exe	95
PID 1556 wrote to memory of 208	1556	msedge.exe	95
PID 1556 wrote to memory of 816	1556	msedge.exe	98
PID 1556 wrote to memory of 816	1556	msedge.exe	98
PID 1556 wrote to memory of 1312	1556	msedge.exe	99
PID 1556 wrote to memory of 1312	1556	msedge.exe	99
PID 1556 wrote to memory of 4428	1556	msedge.exe	101
PID 1556 wrote to memory of 2952	1556	msedge.exe	106
PID 1556 wrote to memory of 2708	1556	msedge.exe	107
PID 1556 wrote to memory of 4128	1556	msedge.exe	108
PID 1556 wrote to memory of 3696	1556	msedge.exe	112
PID 1556 wrote to memory of 3696	1556	msedge.exe	112
PID 1556 wrote to memory of 3696	1556	msedge.exe	112
PID 1556 wrote to memory of 1876	1556	msedge.exe	113
PID 1556 wrote to memory of 1876	1556	msedge.exe	113
PID 1556 wrote to memory of 1876	1556	msedge.exe	113
PID 1556 wrote to memory of 3768	1556	msedge.exe	114
PID 1556 wrote to memory of 3768	1556	msedge.exe	114
PID 1556 wrote to memory of 3768	1556	msedge.exe	114
PID 1556 wrote to memory of 5024	1556	msedge.exe	115
PID 1556 wrote to memory of 5024	1556	msedge.exe	115
PID 1556 wrote to memory of 5024	1556	msedge.exe	115
PID 1556 wrote to memory of 4788	1556	msedge.exe	120
PID 1556 wrote to memory of 4788	1556	msedge.exe	120
PID 1556 wrote to memory of 4788	1556	msedge.exe	120
PID 1556 wrote to memory of 4800	1556	msedge.exe	122
PID 1556 wrote to memory of 4800	1556	msedge.exe	122
PID 1556 wrote to memory of 3020	1556	msedge.exe	123
PID 1556 wrote to memory of 3020	1556	msedge.exe	123
PID 1556 wrote to memory of 3444	1556	msedge.exe	125
PID 1556 wrote to memory of 3444	1556	msedge.exe	125
PID 1556 wrote to memory of 4204	1556	msedge.exe	126

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://bitter-math-3c38.elmereveretttur58546pag18855.workers.dev/account-trust-manage
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7ffa98b6c188,0x7ffa98b6c194,0x7ffa98b6c1a0
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,8412623940229149431,3041793580447254454,524288 --field-trial-handle=2620,i,5082578065164976614,14649121780184714040,262144 --variations-seed-version --mojo-platform-channel-handle=2916 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1760,i,14428421480280625432,10216560394407557939,262144 --field-trial-handle=2620,i,5082578065164976614,14649121780184714040,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:2
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2368,i,11834067240051099560,7801018369858704303,524288 --field-trial-handle=2620,i,5082578065164976614,14649121780184714040,262144 --variations-seed-version --mojo-platform-channel-handle=2948 /prefetch:8
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,8448813832253680439,11915064158458488037,2097152 --field-trial-handle=2620,i,5082578065164976614,14649121780184714040,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,16392859958821195486,13371895136277807305,2097152 --field-trial-handle=2620,i,5082578065164976614,14649121780184714040,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=1796,i,8815392760306279952,3083068512248587781,2097152 --field-trial-handle=2620,i,5082578065164976614,14649121780184714040,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:1
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4216,i,9250150666976570560,17516618199653971621,2097152 --field-trial-handle=2620,i,5082578065164976614,14649121780184714040,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:2
  2⤵
  PID:208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,1506939893126842920,10826476085208442125,524288 --field-trial-handle=2620,i,5082578065164976614,14649121780184714040,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4976,i,5020491237907194247,17320757498040285739,524288 --field-trial-handle=2620,i,5082578065164976614,14649121780184714040,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:1312
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,10092853887544177835,12273269942362863119,524288 --field-trial-handle=2620,i,5082578065164976614,14649121780184714040,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  PID:4368
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,10092853887544177835,12273269942362863119,524288 --field-trial-handle=2620,i,5082578065164976614,14649121780184714040,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4300,i,1630969798247965522,9060487329803719186,524288 --field-trial-handle=2620,i,5082578065164976614,14649121780184714040,262144 --variations-seed-version --mojo-platform-channel-handle=5932 /prefetch:8
  2⤵
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3600,i,13071734522690104202,17555267736426883840,524288 --field-trial-handle=2620,i,5082578065164976614,14649121780184714040,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4292,i,3215800138408890437,3973270392923467018,524288 --field-trial-handle=2620,i,5082578065164976614,14649121780184714040,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:8
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=2776,i,2126630946124256626,9479722077807373895,2097152 --field-trial-handle=2620,i,5082578065164976614,14649121780184714040,262144 --variations-seed-version --mojo-platform-channel-handle=2148 /prefetch:1
  2⤵
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5456,i,7052120146628256685,2419829353435955496,2097152 --field-trial-handle=2620,i,5082578065164976614,14649121780184714040,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:1
  2⤵
  PID:1876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3708,i,7236902711360703444,10353590925616807643,2097152 --field-trial-handle=2620,i,5082578065164976614,14649121780184714040,262144 --variations-seed-version --mojo-platform-channel-handle=3732 /prefetch:1
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4460,i,17069878727960604372,10958736310999202789,2097152 --field-trial-handle=2620,i,5082578065164976614,14649121780184714040,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:1
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4908,i,564139930143214721,9913900851152438549,2097152 --field-trial-handle=2620,i,5082578065164976614,14649121780184714040,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:1
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6484,i,2065354018295429541,11356849318646815958,524288 --field-trial-handle=2620,i,5082578065164976614,14649121780184714040,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:8
  2⤵
  PID:4800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,7222371644265867332,14553888398693173697,524288 --field-trial-handle=2620,i,5082578065164976614,14649121780184714040,262144 --variations-seed-version --mojo-platform-channel-handle=5860 /prefetch:8
  2⤵
  PID:3020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5776,i,14649246098746138262,13200721710171451470,524288 --field-trial-handle=2620,i,5082578065164976614,14649121780184714040,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:8
  2⤵
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6268,i,17643611359641715528,8679687206225624491,262144 --field-trial-handle=2620,i,5082578065164976614,14649121780184714040,262144 --variations-seed-version --mojo-platform-channel-handle=6192 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4204

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Phishing

T1566

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bba2e49c11cb10e1da3782e96a0839de38ec558ccceb0d68515b04792179f852
MD5 34d661b06bc0857903247c15b32b3124
SHA1 72b12aeb58848c0b8474acb525b5e3c41cf32367
SHA512 ff623932c1d85ab3c9cf10c993d26b94c5e1d9968c6a6f9a48925137edcf7379ba3bc8d216e7fc052000ec59dab883f4b498f2262f7941a46d3328c62092e788
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7U:fwUQC5VwBIiElEd2K57P7U
TLSH
T1E0B3A931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6d0f88884e23b1418c456620b79662feebdfd970ca9325ba2981c94b3b0f0b2f
MD5 7060eae8ec426d15de2849b1f7d261b4
SHA1 b252d90b9d7050d0b9b7c03141d9d3b7cae404ac
SHA512 8791005fae20dc1dc5dc5b0086efe814e0b1e36781ef1931cc1fc699fc4cb34d62ab3f9a83f4967824f3bb71aef6adc6ad457ab7a6addcba99f9e9b473eabb4d
TLSH
T118D01222BE08A415E65BA271A502C7141F5954A124938651E224D86CD9F84D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4d517b88a0fb88494276c126764235de9ee52961c86cc4d3abaf517b10a649a8
MD5 dde9ea8dd9c7e315ef614ab3476af02c
SHA1 e03e201e89770d15b4040d579c2cce8684959a2c
SHA512 410e016336529d709de957d44e67238e4f6592b9ce6646395a9e45ce592e7810b4cb6b1b6df5d8b26875a6aa235b77d41c0983ccc055556f8b8c02224093fdd1
TLSH
T16DD012227E08A415E65BA271A502C7141F5954A124938651E224D86CC9F94D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 7da55b3087c18924b894f4a6654c43897c698e94f41c1461d41c27ce2d64b877
MD5 482995013b23a99f3aacd5fb76ca4c9e
SHA1 ee244da47b45895ed7931519336e14c9560dfd1b
SHA512 ffddc6b4f54175418a38c8ab6140b8a545455000662db8e906ba5f8107d6baf4af56f29d95b3b61bdb09ad17525e122bd425da0bc9ac88f571b2907e1d3b1a6a
TLSH
T1BBE0DF9A9384C3E8D388A486804A739CC1B2B1079ACC949E3BCB6C9E66601018394DC6
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 249358b1eab901f0b034023569e7f01b1f94c9179591789d99d6f279761d6e1c
MD5 e3fe72c0f542fbb29d9eb8933eefb382
SHA1 fce9a5a6bf89b76d58b4c0f0c691531330ab3b3e
SHA512 f71315278d44c74df19833e56e16d62705ddd45cc9bbabd13be55f51927a3d7464736846a1c4bcda6770c5b8c0720e1defbfbddb5206de648079efb1a9250340
TLSH
T17EC080D9BD4D845FD385187E5716F00007906511942796171650FDC032419A01E29220
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_0000a4

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a4
Size 127KB
SHA256 e5f1dabe89a7a1d0ae94bd8e14a273cb5144a6541c34a54192411677c18c43a2
MD5 f944721bd55cbb39c452593638459aa1
SHA1 085940738cf5737b614a586d0f2005ff0445d6e5
SHA512 33c8c2882fc81062027733dc7f1d52f2194957cf94b34c6d71e393ed90f37a378a5c7122cbfe4dc35f7e63c26f7c4440886e9b3884663aea2a8183087611b3af
SSDEEP 24:5bglATIKl7DCmTpHTyxpEo1HM9kvfkzyfkmoyfkoRfkIRfkwhNfkm7usyfk6sRfn:qlg116z1+ukYkwkAkgkw9kugkxkY
TLSH
T107D3356D2F958FEAF0F12770E684BF4CB3D96E6251EFC35E1BCC1906BAA00D01048A85
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000a9

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a9
Size 100KB
SHA256 27bce9e85eaf3567a4695ba2b612e32615394d80d0a3a2dcb07b1fbfdfababc7
MD5 f134fda98a277b1c8f20ab8fbe2fbd58
SHA1 a922796190a1f5bbb3c410c6ec591502050df04e
SHA512 2b2e8338afb9b0ca9b5fa3d452dfd80368b5d17566120ae6351b6d03572e5a69cedb97f165fbc31ffb3addcc00506a3fc0761cf2404a5d9826a8448a7c4d9f17
SSDEEP 3072:fd/tI0TeVA5o0VgTuGmxrMRZ6aLxuC+Gtn5HBZ4I/:f81VAMuGMrMX6Mxu9+fCo
TLSH
T108A312846579CDBE5EDC1D06AB21ED4CA2BE53F66B5E367483100E054FF4FB49AB0288
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 dc394cf1382135533f48941c1932f3b16c91d2650e994f46b49fd37eb98f9de6
MD5 2a349320f9efce615e2725c104529f77
SHA1 e00ea452f8ad4a45f261adf8bc1bc3c536f8d4ab
SHA512 e407caf9404aaa10d2aec200e77ea1e2805cbe90216f03702f958338f0ed48841c459ce52e6893abc911fefdce374f5125b1941925ec929b903f60ad73c600e9
TLSH
T1CE712A35E602D4A9E3B413317082236DF071B9C8FA6ADECD3E7358B78504F29B21D916
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 795f9083947f4e4bf560174e0864daae1efc45455efdb32d97a7bdac9b84eb09
MD5 76bea28e90d4afbbd632ce69d252c790
SHA1 3dfe0fcedb6bdc63d53b6eb43951bfe0f0cf5f4e
SHA512 ed35a7c3aedebae85adb3107e00ebda033b3ed85fce8c3f6de7027cedaee3c866e46245061a5b920c64d47b6901da733d5e0148cbd78d73c77d50e40cfc13058
TLSH
T17D816F78E201D49AD7B003307481136CF072B5C9F9AACEEE3D7758B39505F287A4D926
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a88f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58a88f.TMP
Size 3KB
SHA256 99d3b945d281f56a35cec279ab0ee14aa118b9db9dff48cf590738ec95f13719
MD5 219a07c3aa2674356d9bf5cf12f4e562
SHA1 b4186d03f8c63fb129e64b24c0d00a17f95142c8
SHA512 3b32ad1c3a885448d5c62c3a3e0af81ce2190edd07be97771b276facc9c5c6a5c8ae4206af93433128bb884e863e4d17f38ef0efbe3583576f2f3ac0162e8453
TLSH
T169713C35E602D4A9D3B013317081236DF071A9C8FA6BDECD3E7358B78500F29721D916
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 0baaaeb76db5dc99bcbef7600c90024954a8e5e34985e77968e0d1373c069fe7
MD5 dd39e451deb55e7bc3533d02e9758032
SHA1 1ae4a7c91046cb40d484d366811a8697e9cc09ee
SHA512 72c3f044045a7bd5da6cdb211e821f41d878c238f2ea7e0d95fc0325184052b57d541669d15e1dded5a815724e0b8ea09d4fade62a224e91e56c5de681f60656
SSDEEP 192:DzHFSOpKWhz0vTjvER/TDGkFWo/1osiMiTFi+ivYuj0EIS24zShN1cM:DzHFSOpKWhz0Lj8R/TDGkFWo/1osHYF3
TLSH
T1E7024DF7C2E8CB5DDA1152F5E7143E2ACE59092852783867C9D5EE4FE3D24B1E201A0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 281ac4525b7ce1c89c51040f1bbd6b405bc516d4ce34447779492c45d0e7fcab
MD5 08e908e35b4e3b1158c215b98e0a1c80
SHA1 2ab774177924e480458d14025eb68d895655b0ab
SHA512 892e0f0c5a9b84772165063d2458b5f89cc3e6c39edb14109e58fc65f4cbd2dc5733e62061a043e8a4ecb3e33cd0faa1b770594fbbbdaf16c5e5febf6c2e636e
SSDEEP 192:DzHFSOpKWhz0vTjvc+R/T1FWo/1osiMiTFi+ikuj0EIS24zShCcl+pVx:DzHFSOpKWhz0Ljk+R/T1FWo/1osHYF3Y
TLSH
T126024CF7C2E8CB5DDA1152F5E7143E2ACE59092852783867C9D5EE4FE3D24B1E201A0E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 6c94221b6a4a81cfcdcd408a8c058b5afd42cb837b9b35a1267b11f6e3ebdfa3
MD5 40c599e2e81cee49932d91e9c54524e7
SHA1 d2580ccb0b21caf85fbbef86dafce8b5adbbda74
SHA512 b58e6bdddb6f16c193cf181dd50db09a6f8b5bb635f7a2496ffd4446ca2352af7e118c8648e5ed81b178361378a16a05257b852948831e59ed7882775b34ec9c
SSDEEP 192:sxZsR8yM/jK1Ml8Mkq/fOsWufp2VAIdpb1HW6+WNzjG/Yv4RTcBXIgrJ:sxZsmMq/fOsWufpYJHbe/TcF9
TLSH
T18B52C7166B349977CCDBD20DF945BB53E6F55472A2940E44AAFCCA0C04E6AED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 9d04b6bf35ea24c0251f52d12e047232354b53e88edb651771d2d773b7860a84
MD5 c3c1c180c2b2ae77d3452d29f79e96a9
SHA1 03ec973f044adf7ab19c2529812b21f853c3d5f4
SHA512 9235456c783ffe9a19c629961aef6d79d60dd7cf879cc00c9778381cb38f6b13d8d7c9b541c5ade93f904b1cbf1fa6ddbfcdc36ce3876f9af5f4b1ea58dd4d23
SSDEEP 192:sxZsR8yM/jK1Ml8UQ9kq/fOsounpVFVAIdpk3h1HW6+WNG5XlXYvGUARcBXIg5sJ:sxZsmqWq/fOsounprAHbqXhpcF6
TLSH
T11C62D716AA349977DCDBD21DF941BF93E6F51472D2904E44AAFCCA0C00E6AED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 e5c4d007ec2f265fb500d50d432c93c38bd4cfb324de5e9018c6b6bbb1d57bfd
MD5 88c2bf267cf9a5f4b152facacbfabd98
SHA1 87b75af9fe8e724d6bda38808756aa11fe3d095e
SHA512 41a3ec7a88d321342cb42c7eb739a350efcde1caea4aca0128d1ef8a45a79c22800707e521f3fb19f05cf6db6a6c371804f4809b0e6e3adc0e346f04a0b87de1
SSDEEP 768:T/seJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0ppYro3L5:T/seJ3xWvhfynu1jaVcL88pjN
TLSH
T11ED20B2B280CCB7E4F844E6DEC266F966EE801CB57984D5487EA884C03C77EB51275DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 a2da2ea6edb5f054fabb226e2c49e1bc48e4b85eb57983bee1612136751a853c
MD5 16c2be7e1508c751348c9e012105d4e3
SHA1 97d1dbf6e18496df3a47ebf524fb51d7773a4228
SHA512 b162af932d2c4e3dadffa957706d146aeabecefca56d7331482d1d214a0d954d3da88540262612ee2cac4e942c3b7ff0e50bbc7637eb3b7cf8385a0ede721767
SSDEEP 48:KYHIhKggkXyZqIvK7i4Pyd9I5Kec07/yxFnpG:KYH+Kggm6qUK7iqW9yKecE
TLSH
T1D8915B12363F020238BD2558B2A9997B8F4135A37458A86FBFF804754E6BD112EFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 03e9f7fc69f3506c8b3098cbb7531e5ed650a472556eba46303d2adad5a7f73a
MD5 cb8ee4c445f4d902323aec40260b1c70
SHA1 13047259f50bcdead2cc692fe28aeed5e534927a
SHA512 e2089972fd315e7074a9d83058089c4202d2cf555cfda34418a3aa26af2598f9edcbfb29aff9a268d151f8f587a7e62762c09c2ee1c7e01f86661d7b4b85a737
SSDEEP 192:urm+xasuheOwQxMGsNzYuQAG+/6GM7YcbQmiU1/Py4MTRV+FdLJ65rSfyS8z1YqZ:HZcIhsNzYuB47ZNZ9xd9tqLfLj
TLSH
T10C626C725D749C3BA9B7F589F08A36031EF4D067E7C46B54E6ED7B0D00DA5A8030B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e2c48bad8956588763762e6da3201d4796e71a4ceeae556cfc4f70653c877993
MD5 37da40e7e35d7e3db8312f67d580d718
SHA1 3c1b35f6a131b2e9145c5a55a99857f5d6265339
SHA512 8fd06d26e9b2e8f824fc0fa98d4895128ef949d565483a91d2181ca60e7dbc539ac07112f0b3875aaca99b76c95e27af9fb2269b29c86444f0c12d2bf42b8914
SSDEEP 192:lON46vMtPQmiUypyThTRV+FdLJ67847gOU/u:lON46UtR7Tad9IXU/u
TLSH
T1E7020B36AC785CBBAAB3AE49F48A37171FE4517F95D01B54EAE82F1C00D764C1303826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 778890bb83890c0f7858e5fc5eded98e55787590bc6de4669191349cff7cd0bb
MD5 e34bceed7df9a89614ff31e805300bc9
SHA1 573c09b5b084efcfec45af894ced065654cbf414
SHA512 ca50b41783c32a5723b5f8ea87fd7050afd105fc631ae66ba05f233ba878d4db07aee996a097b9aa9bb277ff35506159dc1933e2cf4808607d45811a3ab6cc04
SSDEEP 192:QONfF6vM2PQmiUy4yfhTRV+FdLJ65rSfyS80IYqFU/u:QONfF6U2RYfad9tqbfU/u
TLSH
T11E120B36AD649C6B6D93B585F08A32131EB0D16BDAC46B54FADD3F1C01DE69C130B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 15abd7946b9594e282cb2875c0df3e59b4fecc7d8a53981fd99aff50fa79cee2
MD5 9c92e5b2db239ea60df59ba39e533b02
SHA1 04f72a3a6b1444a0af1fa51778eb8a0d2249d01d
SHA512 3a5ea7a1f73456140584736eeafb5f6bc84e0c6ec86663604a715e9a999ca51fdb3d3b689c227575f8d04fa14e457f2f90340ffa8a522840bb35b6a74d02569d
SSDEEP 192:uBm+xasuheOwQxMlBzsNzYDQAG+/6GM7YcbQmiU1QPy4MTRV+FdLJ65rSfy88v1n:TZcIUzsNzYDB47ZNM9xd9tqxfLj
TLSH
T11CA2E7F258E75836E9AEA34BB37D2D021DBCD027B6845A40B7D86B0DCC9957FC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 197706d72df34b058819c1c8a4b0b7aa6c420f2327c67c03740916f10ef54f0a
MD5 33727a75e2dede4de404da48a3bc06a0
SHA1 0a4a55f84e889e49466b487310a7dc20895355c5
SHA512 20e5f2fffdb46ec40ddd9af0b79107ab86eb398c7ea8e4328818d39fb2fa67d9deb122c31a350937128eb691cbdb5ed26ddefea3e3dd84d422ee74dbea00dfdf
SSDEEP 192:uIm+xasuheOwQxMGsNzYDQAG+/6GM7YcbQmiU1/Py4MTRV+FdLJ65rSfyS8z1YqZ:kZcIhsNzYDB47ZNZ9xd9tqLfLj
TLSH
T1DF626C725D749C3BA9B7F589F08A36131EF4D027E7C85B54F6ED6B0D00DA5A8030B82A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 dd483e9beb00f4c587ee5aa959c5f37a4f9213618f371e6a3ff0e808af899944
MD5 6c51f010f4a2c9f80fe71e4be49b3609
SHA1 40866e5613ce3629c98a9986f8a3b5e6c2c8f265
SHA512 99b6078f4fc7fe4106157bf96d053e51606ef03ac5a345ce0b7e7051f5e5f604a2b79dfce93ff4ee230041ea9973798142c23f728832dcfcddec7b813061d5ba
TLSH
T1F3411858AAFD1148B3B37E1AAFF6A86D887BB8372E07D45D10010E4E0A22B44C971737
MD5 SHA1 SHA512 TLSH

Submit Download