f998290721106926d4c17adc59286589809707800e5a724ddd98423368adb27a

Resubmissions

31/07/2026, 03:48

260731-ec5anacb98

31/07/2026, 03:45

260731-ea8kastbrf6

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 03:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 31KB
Sample260731-ea8kastbrf
SHA256 f998290721106926d4c17adc59286589809707800e5a724ddd98423368adb27a
MD5 e5b2266e6277b3c049be5b91878ee214
SHA1 748868f4152248945f7b7f0efdfaaa93a8bbfd3a
SHA512 59a620b13944b355992fdf9109b266ee1864ccc96ff7e957d78b5faabac27fd8da0588ca05f62ec4a2c7fa4345b8cc48b83d56a1924a440f71bb5dc7cdf7df64
SSDEEP 384:GNoFX7BFOSsCJjsBKv7FYYYoYNYUYkYcYhYR2YEYNJClSvLroWNT2ptedVakGKbn:mo9BWNT2pMS/KbGLkPk11H9N0V2o
TLSH
T1F2E21D2491F8A037408782C62A656B5B3EC2E58BCB5B520076FD97E86FE7C87DC2351D
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 7 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
8	discord.com
9	discord.com
49	discord.com
90	discord.com
238	discord.com
239	discord.com
256	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5696	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134299431369100337"	msedge.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3989226554-2204910950-1522900112-1000\{DF524829-6B19-422F-966A-FB433DAAF960}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3989226554-2204910950-1522900112-1000\{65473AEC-DF55-462F-B979-4F9581FDF62C}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3352	msedge.exe
3352	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe
1744	msedge.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 1744 wrote to memory of 4640	1744	msedge.exe	89
PID 1744 wrote to memory of 6080	1744	msedge.exe	90
PID 1744 wrote to memory of 5696	1744	msedge.exe	91
PID 1744 wrote to memory of 6080	1744	msedge.exe	90
PID 1744 wrote to memory of 6080	1744	msedge.exe	90
PID 1744 wrote to memory of 5008	1744	msedge.exe	92
PID 1744 wrote to memory of 5008	1744	msedge.exe	92
PID 1744 wrote to memory of 4240	1744	msedge.exe	93
PID 1744 wrote to memory of 4240	1744	msedge.exe	93
PID 1744 wrote to memory of 4240	1744	msedge.exe	93
PID 1744 wrote to memory of 4252	1744	msedge.exe	94
PID 1744 wrote to memory of 4252	1744	msedge.exe	94
PID 1744 wrote to memory of 4252	1744	msedge.exe	94
PID 1744 wrote to memory of 1680	1744	msedge.exe	96
PID 1744 wrote to memory of 1680	1744	msedge.exe	96
PID 1744 wrote to memory of 1680	1744	msedge.exe	96
PID 1744 wrote to memory of 204	1744	msedge.exe	97
PID 1744 wrote to memory of 204	1744	msedge.exe	97
PID 1744 wrote to memory of 204	1744	msedge.exe	97
PID 1744 wrote to memory of 4208	1744	msedge.exe	98
PID 1744 wrote to memory of 4208	1744	msedge.exe	98
PID 1744 wrote to memory of 4208	1744	msedge.exe	98
PID 1744 wrote to memory of 2892	1744	msedge.exe	100
PID 1744 wrote to memory of 2892	1744	msedge.exe	100
PID 1744 wrote to memory of 1716	1744	msedge.exe	101
PID 1744 wrote to memory of 1716	1744	msedge.exe	101
PID 1744 wrote to memory of 5080	1744	msedge.exe	102
PID 1744 wrote to memory of 2896	1744	msedge.exe	103
PID 1744 wrote to memory of 5080	1744	msedge.exe	102
PID 1744 wrote to memory of 3184	1744	msedge.exe	105
PID 1744 wrote to memory of 5336	1744	msedge.exe	109
PID 1744 wrote to memory of 2396	1744	msedge.exe	110
PID 1744 wrote to memory of 3064	1744	msedge.exe	111
PID 1744 wrote to memory of 5548	1744	msedge.exe	112
PID 1744 wrote to memory of 5548	1744	msedge.exe	112
PID 1744 wrote to memory of 4444	1744	msedge.exe	114
PID 1744 wrote to memory of 4444	1744	msedge.exe	114
PID 1744 wrote to memory of 4444	1744	msedge.exe	114
PID 1744 wrote to memory of 1776	1744	msedge.exe	115
PID 1744 wrote to memory of 1776	1744	msedge.exe	115
PID 1744 wrote to memory of 1776	1744	msedge.exe	115
PID 1744 wrote to memory of 2344	1744	msedge.exe	116
PID 1744 wrote to memory of 2344	1744	msedge.exe	116
PID 1744 wrote to memory of 2344	1744	msedge.exe	116
PID 1744 wrote to memory of 3352	1744	msedge.exe	117

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x240,0x264,0x268,0x238,0x2c8,0x7fffc098c188,0x7fffc098c194,0x7fffc098c1a0
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1588,i,10049822659653288306,14849872689417678546,262144 --field-trial-handle=2732,i,12966278800551479381,21476122991600493,262144 --variations-seed-version --mojo-platform-channel-handle=2728 /prefetch:2
  2⤵
  PID:6080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1800,i,9225719161967016780,15985802954543496271,524288 --field-trial-handle=2732,i,12966278800551479381,21476122991600493,262144 --variations-seed-version --mojo-platform-channel-handle=2764 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2292,i,13866417923274966038,14648012487501579578,524288 --field-trial-handle=2732,i,12966278800551479381,21476122991600493,262144 --variations-seed-version --mojo-platform-channel-handle=3216 /prefetch:13
  2⤵
  PID:5008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3468,i,558833620286029693,16254043545065012061,2097152 --field-trial-handle=2732,i,12966278800551479381,21476122991600493,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:4240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,17076059498162714083,4202517758219197046,2097152 --field-trial-handle=2732,i,12966278800551479381,21476122991600493,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:4252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4276,i,8694326300808594795,11695839704048267113,2097152 --field-trial-handle=2732,i,12966278800551479381,21476122991600493,262144 --variations-seed-version --mojo-platform-channel-handle=4332 /prefetch:1
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4288,i,16496095310346029103,2545368140652162606,2097152 --field-trial-handle=2732,i,12966278800551479381,21476122991600493,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:9
  2⤵
  PID:204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5224,i,8959276121269135485,17178985185486823679,2097152 --field-trial-handle=2732,i,12966278800551479381,21476122991600493,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:1
  2⤵
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5640,i,13620967861970448620,16155668371822026766,524288 --field-trial-handle=2732,i,12966278800551479381,21476122991600493,262144 --variations-seed-version --mojo-platform-channel-handle=5692 /prefetch:14
  2⤵
  PID:2892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5636,i,16440462054177287329,11575251178321762361,524288 --field-trial-handle=2732,i,12966278800551479381,21476122991600493,262144 --variations-seed-version --mojo-platform-channel-handle=5664 /prefetch:14
  2⤵
  PID:1716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5496,i,4195896471348945699,14029233189306052953,524288 --field-trial-handle=2732,i,12966278800551479381,21476122991600493,262144 --variations-seed-version --mojo-platform-channel-handle=5504 /prefetch:12
  2⤵
  PID:5080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,7755067858363346774,3152615206224525366,524288 --field-trial-handle=2732,i,12966278800551479381,21476122991600493,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:14
  2⤵
  - Modifies registry class
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6536,i,16874829996778103118,3998615396537763710,524288 --field-trial-handle=2732,i,12966278800551479381,21476122991600493,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:14
  2⤵
  PID:5152
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6536,i,16874829996778103118,3998615396537763710,524288 --field-trial-handle=2732,i,12966278800551479381,21476122991600493,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:14
  2⤵
  PID:3184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6580,i,9293039961795001703,15003462154232927239,524288 --field-trial-handle=2732,i,12966278800551479381,21476122991600493,262144 --variations-seed-version --mojo-platform-channel-handle=4700 /prefetch:14
  2⤵
  PID:5336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6620,i,5432923783762486011,5338223118344766370,524288 --field-trial-handle=2732,i,12966278800551479381,21476122991600493,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:14
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6568,i,18197591207924273035,5486522241940350595,524288 --field-trial-handle=2732,i,12966278800551479381,21476122991600493,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:14
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7016,i,13530378301862835993,13137768246048431081,524288 --field-trial-handle=2732,i,12966278800551479381,21476122991600493,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:14
  2⤵
  PID:5548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6492,i,3550518282786741543,10005240973915230882,2097152 --field-trial-handle=2732,i,12966278800551479381,21476122991600493,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:1
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=4752,i,10086349275060999391,10051160366831170501,2097152 --field-trial-handle=2732,i,12966278800551479381,21476122991600493,262144 --variations-seed-version --mojo-platform-channel-handle=6596 /prefetch:1
  2⤵
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7248,i,90721611955680543,12157095057556643351,2097152 --field-trial-handle=2732,i,12966278800551479381,21476122991600493,262144 --variations-seed-version --mojo-platform-channel-handle=7352 /prefetch:1
  2⤵
  PID:2344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7496,i,18269046811086498962,1398843294356091347,262144 --field-trial-handle=2732,i,12966278800551479381,21476122991600493,262144 --variations-seed-version --mojo-platform-channel-handle=7436 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3352

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2392

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2548

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7f7f7efafb9f87082470af84df3b906033b9d533fb7a188458a4e181362f2170
MD5 8af1f60999c332d8cf9a392cd968a81c
SHA1 93834a1f070ff24041a0deb17d95d868998c98ba
SHA512 95d5c6b0fed3c3dce459178eafa2e9fa13b06caf50a5b294d66ecf16bf91357eccebec57e01d50e054232862c252fc80f7300e865318ec24078f9288a88c63d4
TLSH
T17BD02B206A444A4CCDC0B03064A2EA18E2104135680013C44001B06988901830B970DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5e34bc4625bf22507150f49d8c28444bda8222ea36c2a7d431bbdaae5c134a9d
MD5 e1ae04b3e73ad5ac4854b3b71e22d4d3
SHA1 221461b4f2d9e84e2f881b5a79edfef3705178db
SHA512 58529610d3f5dd7778bff3b81dd8abd9d79702eff78583d0294f3999089de0bbf84f0abad703269c0988835522b1d8d48e9f3c65472a409c5868fc3547c3fb1b
TLSH
T138D02B206A54494CCDC0B03464A3EA18E2004135140013C44001F07988901830B970CB
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_0000c2

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000c2
Size 331KB
SHA256 db4ffbf0ec662620013dc14bc1268bdad6256d19d7d511ec7eff8446887e6900
MD5 05ef8155cf66131654d3bb9c9cba5853
SHA1 e79d53fcb604921222dd1dbc2f1c10c631ff6075
SHA512 ee38793245d91683ddb1f847e5b56a09864fd32ec059055459b3ebe101abed79683ee59c80f30b8f6249d2bbd83fbf7bca83dafb4ef2b634ceff6969c80fed23
SSDEEP 6144:FljUD58FLTW53eaLkNv+Ps0dj1fpqaGjYf0NIcB3bM1rJZ24:FDm5uaLcv+PFj7ajJNImbM1rD
TLSH
T1247423A9B50E3C8AC94F9473827EAFD2A4356FF38D47BAA3634241F401874342E4676D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 115f770f00c71f6df50dcb1b43a9b307699af7991d5063b589e44e3c405bf29c
MD5 4e59d02f800646376bc13411a935e1a4
SHA1 bf2b5e138c74f8a42635e9f66d7d529d4ebfa01f
SHA512 e7cebb112083b46fd58932d073a311c543a4b13ac6988dcc6d57745575bda648ca421fcebf1cfe0017d40c14e017fa812ba6ca757fd80a24fa8b4bda9d45fcc9
TLSH
T1CD510D6847A32BD2EB245B72B6D144A937FDBCA94B0B1FA055D27F38490FF2861D1113
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 cc7bcfb7ef1c1bf53af682c7ae83e3587fcb1e76a590a6f3cdea5e1594ca8c07
MD5 d56633e3dd4eeb07e6bb406dacb80dc3
SHA1 a8bd85a110ace0eba02876ccba129816dc2a3165
SHA512 dfab686146dcd402d7bd3275f7402ca6cb9d71a10b51697224f842c3434bdcf0de96ab51f7d679fe40c39b4068d0ea10c04da7c2fc92059b9f36d20a0aa4df25
TLSH
T11781722887A727E1FB245BB276D088AA37FCAC650A074BD605817F39580FFEC10D1123
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe598c87.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe598c87.TMP
Size 2KB
SHA256 e4dc24ba8791f4257afce0e2b69a647832ad0e7ac2709f1c5d42decc949ba5ef
MD5 5f6fbdeb491ec2c798cf9f8afffc243b
SHA1 3d4626756cd86efec1127da4c8fc310ca66cc8bb
SHA512 6dcbaee5e115d22f3d436d8ad0f181ff07bfaa346f8130aaf2c60fb8d0fa54485bafa9f90e26e7feea57c2f8a3419809fd9288865b099f4867eb5c87990c6c54
TLSH
T1EE511C6847A32BE2E7245B72B6D084E93BFDBDA80A0B1F6045D27F38490FF2861C1013
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 d5cd7301a9f1b5db4bf7bab5fb2189085e78260a76724c0f3610234176ba8b52
MD5 f8d2f407df804bd425e9f4b777ffd34e
SHA1 3e03ef5c137c6ac3d319b1af52aa7b089aee2231
SHA512 94c43c8a4fc71560886098d4d1a1e881f9f524779f52bf47fef178f54d807b936c8db3a5e3781c5f8e64bfd3e360e91901a906f14bd313ef75cadf123095f33d
SSDEEP 96:DIt0ORMPkbfwB3uaxJi0oZOJZA0zRQuZGFXGIJwJ:DW/WPk7wB3uaxJi0oZOJZA01QuZGRGIA
TLSH
T1ABB1CEB6C3D8477D881256F4AB257D1ADD1D055A422C3C2689F8EF1F63E24B1E20165F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 9b86f90911890123a380f23051c65676c4576ca0c5afc375497641bb74c4a720
MD5 2053c8668203346e691fc7350eab43c4
SHA1 5d1f92e9552cc2f930394d4539c09a2830829890
SHA512 ebfab7ca2c71992ab0ee8d9d3dc9b938b3b056887206ab8ed00356dbc039a807f9c98c6a722df1390ce418e2347c769bf03a4273872707ea757ffd1af72e4ea0
TLSH
T11321B1F7C6F8557D894182F467147E1BCE2D0814532C3E9AC4D4AF6F93E2871D24095E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 12KB
SHA256 61356e1b4d3f44a0662ce74d1234fce2a0c156d2249a7ad3f6196dbcdd57ff43
MD5 04c575ffeaf40b64be14a6b5b6486828
SHA1 362572523b8ee932128ad0ca015269ce6f404b9f
SHA512 bcf41192a29988dbe1a4687a2b1959caec108f316baf04c52d38f4786f619573232213b92669e08d37b16e2088b5675d5f686460ffa52efde3796a639b2c3b9d
SSDEEP 384:DW/WPk7w5dhfq/B+VPdP6+axJi0oZOJZA01QuZGjIJO9fK+PGMuFHHeN/gILAt86:FiecwILeHmpj
TLSH
T17D42BAF7C3E4873D895256F4AB147D2ACE290529532C3C6789E8FE4B63E2472E24164F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 02da2af57390c1bd9e1e265da01b66bfe237c66711d20b0c3e132967342eede2
MD5 5f24bef5275eef61996fe58827d9bb80
SHA1 1289f4cda9c850062ce047054c6df16fb89ca331
SHA512 6b3e2569995b26719deec7932a09cfbf686ab6be1089573e79a07e8188936d7adce0660b2ec406454458575132e416cb4e086a09d5c0754e00c6479571f8d48d
SSDEEP 192:sxRDR3yM/jK1Ml8wbjf/f2sKEHm2Sm7awtzoD8pQ587/g6+WNIY3s8GSIgDUJ:sxRDVljf/f2sKE2e3/5IyM
TLSH
T12D62D916A5245A7BDCDBD219FA517F53D6F95162A2901F44AAFCCA0C00E6AEC2203C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 a13c4316a7bbe910b595698972c06edc78c206a4037314b3bce8d7751077337b
MD5 c6c554d8ded690941c943caad46e8c6d
SHA1 bef76d5ef92a5c4cefe291a492d6d9c2c8d72424
SHA512 d1c16b6a23156c1fd69801750dd335ada3b350afee51b59ead2eeb39ca45fca476f3af474be8f601ecd0956c3af935d5db40aafce9c3fa46fa2d15575f5ebfa3
SSDEEP 192:sxRdR3yM/jK1Ml8wbjf/f2sK8Hm2Sm7avtzoD8p47/g6+WNIY3BL8GSIgDOJ:sxRdVljf/f2sK82Xq/5IA+O
TLSH
T16A62E815AA249D7BCCDBD219FA517F53D6F81173A2901E44AAFCCA0C00E6AEC2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 3dd3b48ecf1ed8932dd2a59f613da9daf9966b5e3e018850b5197f94be2208fe
MD5 0687fd94f36c18ff3471567091110e0b
SHA1 43704644e3eaac029e300c539c81815395e1aaac
SHA512 2e65b0350b74a0a4f320c2bf0c300ca55a71525f846b6d04bf2ed3f074996636dc87fbc7cc834eafc1a2b1356bf8b81024db5703041be7a990a3d3c05e0651e8
SSDEEP 192:sxRCR3yM/jK1Ml8wbjf/f2sy8Hm2Sm7avtzoD8p47/g6+WNIY3BL8GSIgIJ:sxRCVljf/f2sy82Xq/5IA+s
TLSH
T11E52D815AA24997BCCDBD219FA517F53D6F95563A2901E44AAFCCA0C00E6AEC2213C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 a48b1c84dbe35782364d30d131b80e93e8328e9b5a2ad968ff838a232240e1fc
MD5 7f28616320ce41ecd7e36421636cb6b6
SHA1 c5b161c10b05cc3699f11c47359521ed9b384a94
SHA512 771ae4078ba97a7ee90193d9100f2121822f9d5225ced2a866ec264b44643870a5f84bdc8c4fb41202b4af7d5c8870cda7af5734a1e6863862b0eeeff7247cf8
SSDEEP 192:sxRDR3yM/jK1Ml8UQJbjf/f2sKEHm2Sm7aDtzoD8pQ5M17/g6+WNWld/Y308GSIG:sxRDVqhjf/f2sKE2vl/5i/cp
TLSH
T18472EA1665245A7B9CDBD21DFA527F53D6F95062E1901F44AAFCCA0C00E66ED2313C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 9b9c308f8e453096f2ca757308ba00cb96921258a60cd9a13aeabdd6fabafde8
MD5 dfd1456e231bd3e61e7b84e64e6051c9
SHA1 b714ec101f9138b7254a841e0ede5d1476f39a88
SHA512 60af620e1e2c08b3eb2dc47c064e7d1be0fa8f9ff142ccfc8db2ccc8512127348d0691b641a1dbefba0fee860003f7dee621b982ec54e8a555f4d2b6d774d5c5
SSDEEP 768:GiqbvkWg0CfZs8F1+UoAYDCx9Tuqh0VfUC9xbog/OV+MW6KroZwiso:GiqbvkWg0CfZsu1jaDF6hZfz
TLSH
T105C20B3B640CC77E8F804EADEC26AED76D9801CB9B588D5447EA890C03C67FB511A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 31f5c02a862c1381db96bf746a258f65e11dfd07c943892a5fc470cc1eaa4588
MD5 441fcc754d40d90f11e4dd233e1517bb
SHA1 e50c9a950d3b056953bea984f6b8a999fc20bc42
SHA512 5c98953356951b1bb30510b2244c4c5eaa28c2f58c66ab46dcddc4e61dcb7f096594a5ea2e25f071eaf0acfeb22443617cb550f82d9ae29dc7e2250a7aa9402e
SSDEEP 96:KR1i7PF/DnWrw+gXnK4mgpnct1o7zsHT8ZNbRRtWFKAg1tK4MgbtcjbylxWHYp8n:C1i7PF/DWrwfX9mgpct1o7zsHT8ZNbRm
TLSH
T125912255313B0240393EAA1CD4F9D82EC6D2B8A3305CB46B7BA905A60F67E038DFD4D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 f1e5b6f77265777fb1a0c77d310f27818e66026379ca2b5ffd06de9c34fbe1a9
MD5 7db78f203974f092046c216c89c18870
SHA1 aa0fd578d6d81e620a32a34b6379e7b16ecbc314
SHA512 eb1de9aa0bdcc8f62938cfa5e3c1874d8a13dd2c2692f9f3df0df1051042fa98d819cbd32fda2b2f94484aeba3883c802e0c777d54fa1a025aa9113ed7766ac9
SSDEEP 768:1y34qc+wfZOifr66Sf766TvShCQRfKb9MFnA:1y3bwfhf+6Sfu6TvSjKb+FnA
TLSH
T1A7F2CF71DC704A339DD7825477863B13BDE5A273D6C85B48E5DD9B0C05C36AE2B0B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 35053b813e314e4ab07073f430a17c09deaf96972f829b71bfbc8c3141fa278a
MD5 cd831161ac01846ef2abb42565e69f4e
SHA1 6586183f3bf26a003fea94d299f5140058b5a394
SHA512 70d010c1ad71fcd11ec899e0d6de97f0b394b8dc3e3258171ca50db53de73837767b259f718798a66e2e8eb9b097cc1d28a43445f48e30d9984f62723011af04
SSDEEP 768:7rv+4UNbdt3yqc+wfZOifr66Sf766uvShCQRfKbYI:7bsb73lwfhf+6Sfu6uvSjKbl
TLSH
T13B03CF72E8789A339DE3825872477B53BEA86263C4C85B48D9CD5B0D01C76DE2B1FC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 4e0b8b0084ac56ffe3e9b906d2f19d8698d25ac5f87d9a8b910d8a61f6ac85eb
MD5 fed25c339384a8452b4ca70c792fe879
SHA1 662b0d569f3986cc8f42c2e426a0f7b3cfc23f67
SHA512 08e96aa711b9fd3097bf1cc246632bdf2643583a7880967844af1d15f9238e49b8fc5ea29c54b9a1d920f10e1844ef6bed447ce2f3c291229a7210465888e2b0
SSDEEP 768:ZX34qc+wfZOifr66Sf7668vShCQRfKb9MFnA:ZX3bwfhf+6Sfu68vSjKb+FnA
TLSH
T1CEF2CFB1EC704A339DD7825477863B13BEE5A273D5C85B48E5DD9B0C05C36AE2B0B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 ebf4ef7aafaeb2646023222e2c48977c044276f846e307c41743b57cafe6fc21
MD5 269aa53c15de58e07b3e3d9253862fd3
SHA1 9715cddf30b4ce45874a66b5f1fa51f9927d783f
SHA512 7df3e674eea13171271586b49d9d387ce0573af2875c70834f0a36a9f1f7751bbc59ebc923ecdc0df17c3fbfa966f32b1cd24227c04f5688562d4fb79e2206a2
SSDEEP 768:Rrv+4UNbd43bIkc+wfZOifr66tvShCQtK2bwWV:RbsbO3bNwfhf+6tvSe0wO
TLSH
T10803CF72E86899339DE782487646BB63BEB861B3C8C54784D6CD1B0D018369F370BC67
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 9b2a8b3a03978a5d74e5fc1db8489cb6f481a0c890b12ff9ca9e336cbb8c922b
MD5 b79d122ac17b7af8bf259948caacd1f0
SHA1 28b7b141bf001580d9880b7535df02aa528d1c8d
SHA512 2296612d916f112273150cf356cb3f045807b110e54dd39306e49151b254f0c52bf6e0a03245bb3aff551b5ef217623e24e37f3a8208637afa6005bd559da1cc
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe5b127b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5b127b.TMP
Size 392B
SHA256 6aaa8e380db65cc728979b9353ab2c2fa2bf492be5b78c4a297240079af3ca1c
MD5 c52de306bc1cea3856bf6c946d1ee7cd
SHA1 caefe267745b9b7137ed218a7a62ec0bcdcb0413
SHA512 ddbc86f9f7a7c5869697dc6608f9f5ef690bf7a9b9e25b88d523b9dea09d844f9cb4100fb16a2280a4a0a0f747b3cd7920abd316e2166bdd576b0938e1bc684a
MD5 SHA1 SHA512

Submit Download

d08467b0-fb61-4009-a00e-8e32dab6d5d6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\d08467b0-fb61-4009-a00e-8e32dab6d5d6.tmp
Size 35KB
SHA256 8bddb70c335e9dafa6c4b6688f7c98e5dc28765333ca19b5efeacd5be32a5666
MD5 6af053c9a695820e85616c8b00d7536b
SHA1 33519fdd1836d554368ff870f533ceb92d74aa13
SHA512 f3e283a91e64c5c005e05457c683560b165fe6e3ae1f32fd71afb7ef928e5a9b8d03287b69868fd7462201fb06960d10e50211dd69cce412ae5f8f7fa2f26871
SSDEEP 768:Ry3jqc+wfZOifr66Sf766TvShCQRfKb9MFnA:Ry30wfhf+6Sfu6TvSjKb+FnA
TLSH
T15AF2CF71DC704A339DD7825476863B13BEE5A273D6C85B48E5DD9B0C05C36AE2B0BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download