f998421eeaf59af914795d4c87fb78753bcc4ca62211694f8187e97e0d1a5701

Analysis

max time kernel
899s
max time network
734s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 05:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
.html
Size 12KB
Sample260731-gp9f9abl4y
SHA256 f998421eeaf59af914795d4c87fb78753bcc4ca62211694f8187e97e0d1a5701
MD5 8be1ae43e5e5aef8c2058f4653149a38
SHA1 78b6f83f8aa1965297ba92ca7c35c3d3c35ad9ca
SHA512 cd9723578f0bdf3ed979f48f24935dfe983b809e21efa1876d808cfc4c6a7065b916ca50dc1cf89af0b81d4533f2fe5ecca5671265e89907e1f8e233e33dec53
SSDEEP 192:Xb9DJhySVEJfU1DyexOOgjy2IGaXD1Og4G7qpy0ZArZ7yyw31VzF3K:1yRGLOOseD1OyZFwlVzFa
TLSH
T1DD428513EEA00D2B437F16F92FB16789E947898FD24A5C01B0EE7584AF95F13C813586
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
684	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134299512379646293"	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{F6FF448F-F961-4A05-B3A5-A0302A2DF9FF}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2288	msedge.exe
2288	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe
1340	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 1340 wrote to memory of 2696	1340	msedge.exe	89
PID 1340 wrote to memory of 256	1340	msedge.exe	91
PID 1340 wrote to memory of 684	1340	msedge.exe	92
PID 1340 wrote to memory of 256	1340	msedge.exe	91
PID 1340 wrote to memory of 256	1340	msedge.exe	91
PID 1340 wrote to memory of 5424	1340	msedge.exe	93
PID 1340 wrote to memory of 5424	1340	msedge.exe	93
PID 1340 wrote to memory of 5840	1340	msedge.exe	95
PID 1340 wrote to memory of 5840	1340	msedge.exe	95
PID 1340 wrote to memory of 5840	1340	msedge.exe	95
PID 1340 wrote to memory of 4212	1340	msedge.exe	96
PID 1340 wrote to memory of 4212	1340	msedge.exe	96
PID 1340 wrote to memory of 4212	1340	msedge.exe	96
PID 1340 wrote to memory of 3968	1340	msedge.exe	97
PID 1340 wrote to memory of 3968	1340	msedge.exe	97
PID 1340 wrote to memory of 3968	1340	msedge.exe	97
PID 1340 wrote to memory of 5124	1340	msedge.exe	98
PID 1340 wrote to memory of 5124	1340	msedge.exe	98
PID 1340 wrote to memory of 5124	1340	msedge.exe	98
PID 1340 wrote to memory of 5800	1340	msedge.exe	100
PID 1340 wrote to memory of 5800	1340	msedge.exe	100
PID 1340 wrote to memory of 4564	1340	msedge.exe	101
PID 1340 wrote to memory of 4564	1340	msedge.exe	101
PID 1340 wrote to memory of 6016	1340	msedge.exe	103
PID 1340 wrote to memory of 4744	1340	msedge.exe	106
PID 1340 wrote to memory of 4744	1340	msedge.exe	106
PID 1340 wrote to memory of 4760	1340	msedge.exe	108
PID 1340 wrote to memory of 5028	1340	msedge.exe	109
PID 1340 wrote to memory of 6056	1340	msedge.exe	110
PID 1340 wrote to memory of 4076	1340	msedge.exe	111
PID 1340 wrote to memory of 4076	1340	msedge.exe	111
PID 1340 wrote to memory of 2288	1340	msedge.exe	113
PID 1340 wrote to memory of 6096	1340	msedge.exe	115
PID 1340 wrote to memory of 6096	1340	msedge.exe	115
PID 1340 wrote to memory of 1420	1340	msedge.exe	114
PID 1340 wrote to memory of 1420	1340	msedge.exe	114
PID 1340 wrote to memory of 2884	1340	msedge.exe	116
PID 1340 wrote to memory of 2884	1340	msedge.exe	116
PID 1340 wrote to memory of 2724	1340	msedge.exe	117
PID 1340 wrote to memory of 2724	1340	msedge.exe	117
PID 1340 wrote to memory of 3268	1340	msedge.exe	125
PID 1340 wrote to memory of 3268	1340	msedge.exe	125

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2e0,0x7ffe4df3c188,0x7ffe4df3c194,0x7ffe4df3c1a0
  2⤵
  PID:2696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1552,i,13224715109127548980,13146200202725529393,262144 --field-trial-handle=2220,i,18005811557235030989,17403770661030480424,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:2
  2⤵
  PID:256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1748,i,15158100428223415264,6569578680841432329,524288 --field-trial-handle=2220,i,18005811557235030989,17403770661030480424,262144 --variations-seed-version --mojo-platform-channel-handle=3104 /prefetch:11
  2⤵
  - System Time Discovery
  PID:684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2328,i,1755379940761294430,17244985625572921592,524288 --field-trial-handle=2220,i,18005811557235030989,17403770661030480424,262144 --variations-seed-version --mojo-platform-channel-handle=3228 /prefetch:13
  2⤵
  PID:5424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3652,i,12115113497712577344,2822857460494327003,2097152 --field-trial-handle=2220,i,18005811557235030989,17403770661030480424,262144 --variations-seed-version --mojo-platform-channel-handle=3708 /prefetch:1
  2⤵
  PID:5840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3656,i,7743029805828967572,8348036710961598748,2097152 --field-trial-handle=2220,i,18005811557235030989,17403770661030480424,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:1
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4344,i,10880018366542680853,7044581680625423502,2097152 --field-trial-handle=2220,i,18005811557235030989,17403770661030480424,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4356,i,17156531872013433210,7912732543266060232,2097152 --field-trial-handle=2220,i,18005811557235030989,17403770661030480424,262144 --variations-seed-version --mojo-platform-channel-handle=4596 /prefetch:9
  2⤵
  PID:5124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3800,i,16875388932252635233,6098201225545136516,524288 --field-trial-handle=2220,i,18005811557235030989,17403770661030480424,262144 --variations-seed-version --mojo-platform-channel-handle=5272 /prefetch:14
  2⤵
  PID:5800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3828,i,12682312935968805019,29361101743622451,524288 --field-trial-handle=2220,i,18005811557235030989,17403770661030480424,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:14
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,3535676949727620183,9720400131439311107,524288 --field-trial-handle=2220,i,18005811557235030989,17403770661030480424,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:14
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6096,i,3535676949727620183,9720400131439311107,524288 --field-trial-handle=2220,i,18005811557235030989,17403770661030480424,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:14
  2⤵
  PID:6016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,16055264101710289199,5679034796148971054,524288 --field-trial-handle=2220,i,18005811557235030989,17403770661030480424,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:12
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6532,i,18128253782742314380,3703134129626133180,524288 --field-trial-handle=2220,i,18005811557235030989,17403770661030480424,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:14
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,14530064531350589307,14265542882912639685,524288 --field-trial-handle=2220,i,18005811557235030989,17403770661030480424,262144 --variations-seed-version --mojo-platform-channel-handle=4548 /prefetch:14
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,6537204726832928493,1691225533256468366,524288 --field-trial-handle=2220,i,18005811557235030989,17403770661030480424,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:14
  2⤵
  PID:6056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5628,i,152537511549399853,17590289136699168265,524288 --field-trial-handle=2220,i,18005811557235030989,17403770661030480424,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:14
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5760,i,14521630542194694466,8452718363961841481,262144 --field-trial-handle=2220,i,18005811557235030989,17403770661030480424,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6176,i,10233346641659386750,4959315975402817997,524288 --field-trial-handle=2220,i,18005811557235030989,17403770661030480424,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:14
  2⤵
  PID:1420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3848,i,7874313643483938103,11709008236694394273,524288 --field-trial-handle=2220,i,18005811557235030989,17403770661030480424,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:14
  2⤵
  PID:6096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5560,i,12188710037935235742,12576241274593605132,524288 --field-trial-handle=2220,i,18005811557235030989,17403770661030480424,262144 --variations-seed-version --mojo-platform-channel-handle=1944 /prefetch:14
  2⤵
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3132,i,15856395515782568871,2235781166281930187,524288 --field-trial-handle=2220,i,18005811557235030989,17403770661030480424,262144 --variations-seed-version --mojo-platform-channel-handle=3344 /prefetch:14
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6808,i,14049425918163558067,259722288146526331,524288 --field-trial-handle=2220,i,18005811557235030989,17403770661030480424,262144 --variations-seed-version --mojo-platform-channel-handle=2792 /prefetch:14
  2⤵
  PID:3268

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5764

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5428

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1260

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:4656

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 d481677033dfa301f05fef196aa51c558edfec9bdb91f5fe134c30d55d3084c0
MD5 95f6137e670bc994ca96e76df942dd09
SHA1 7aea7e028581c27d937e146a259da69ff492c02e
SHA512 0fedb7ee90ee736e8a64b30ecfe6ce5a5a3368226fffc56ef28f70c84054769e06db73a9a74951448506061425b64202f9b5eb3e5e86e61eb61db00e3c63394f
TLSH
T1B2E0208804CCC21DD18474C781F8774DC384370BA2C86D59574C8698700744067CD9D4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 bd2447301ed4969d2518b2fd26218e57e821c2b9fdd1a08c5a1af7728f465577
MD5 54a14f47019eb2903c61cec4f9eb6a40
SHA1 7c6376f3b80239a5cdab47b5162b201e2091eb4b
SHA512 c27f2ea46fca60dbe5fb38bbf732a8f46c89b4d11a352dc7a6598948eacbfb1f07856117f981ede087b4730056505c34372a7fa4cac721d3ad37d42a5ca59376
TLSH
T1F0E020C405DDC35EE15C74CB917473CD8180774F93C4AE691B08865C7102544679A9DA
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 db9185d72463aab093b1d75375e03536df72771a9d68c19e89df16afd285d206
MD5 e72a430321beb45a70caf0a89e2970d0
SHA1 953d4d8c41a6ca919eb16874de36929cc445ff33
SHA512 5d6be43bfc66d6f35602b3cc1d11e8713391fdcd4ab267f68548f16cc0444f5358f82df5e073d8bd43d99e6fc2609a5fe0a158232ce069871d44dae25e9d305b
TLSH
T1DDE0208409DCCA1EA38C64C7815693CDC388370FA3C5695527048AD97002050638DDD4
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00005e

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00005e
Size 945KB
SHA256 9d8a13d250ae3c04f3718a479b52a40e3513d71e1ff2a3c5c96dbc923b2a3a78
MD5 fabf240085e9609476a3eae4c5928f02
SHA1 3595f4deb69bbc8ace71e6f8278dc1f68b2626da
SHA512 c2ffb607a638792db088a62c094ee1f242667b531a98eae866512927fbac8bf14fc2c8cc4b39b020582d025dcf197bb5c16e7c291ee7d651f4b17b84388c5fbd
SSDEEP 24576:QD0KiyZuKzhYINIkFMGEiuBfVsKSat/sm2HIS8zFY:QDliyZuIKIR2diMmWMR8zFY
TLSH
T1492523878348ED9EC57DE8B58447F252AA51E01CD28F5B87162DB4DF0EA80E2FC5037A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 2453cfaf22c9d2b1b0d6826506ed2905c09ebc23fc0bfc90dae7a82aa3b8838f
MD5 af50f2b11ff3568287efcd230f0b68b0
SHA1 8b417972c98a13f8c79d4b6cb2abaf2c3a525e9a
SHA512 7ef96c1308311bc2d817d7fdaa3fd7e461e4f48d883bd7f0e459f07ee5746d3d232ff6a1cd59a6bf02a46ccc85604da750a4e6a97c5a15e37d091cdf1e9bbaaf
TLSH
T115512B1DA33615D6E3240772BDD394883FF5CC9A08075E1BA0419EB868C2F17AED2AD3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59d920.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59d920.TMP
Size 2KB
SHA256 f4b55a9c760c77fee887ca7d9db10c5b5280f1470f3d19f78d384bc275b6e7dd
MD5 96be26a471d73cf84d6e284abeeb8f44
SHA1 44db54bbaf4849301470d31731b05267a2a5d5ea
SHA512 2654108a5b9c397fb952387bfead8e95db08449ee855249a14125868425f76d212014a7b436491e8a2eba73cd7f3c9a090809d27d8b30727fa21bf62f14b0fb0
TLSH
T179512E1DA37514D6E3240772BDD394883FF5CC9A08075E1BA4419EB868C2F17ADD2AD7
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 f7a1830f459d36f9bf8cee2aaa65ad6110e2e806f99d4b4af78a1259f22702cf
MD5 2cf580195519b7dfee6b4df2f48784b5
SHA1 e59ac4b377d665d0ba783762fa1812e228903272
SHA512 ffdf9bd453b8ebc5fb67dca3083c288635dbbc5716b5eb72444505a33bc31ce48950f6d8c46db764c8169abb3d9abfc962915145b3ab4c599bbb1a78e4f4d629
TLSH
T1F1419BF783F4967E8A1192F4AA186E1BCE1C0416432C7CA6C9E06E1BA3F2471E14179F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 9fd83cd49d856f9956457ee225eb38ba5aa8d95d44c3a639c8aa9e9c344b8737
MD5 18fcdafacaddcee2ee97a5e90bf6d842
SHA1 aea2c7c9a19154c7c8266bd1f6a773848b0201ed
SHA512 c1ee383cd5187eee9297a45a1da24758b01eb302db8ce4013bcbc829acad05e76be0bd93955b7fedb00a3d72e915f9365156aab1917662fea1b3440f07e48e08
TLSH
T11041AFF783F4567E8A1192F4EA146E1BCE5C0416432C7CA6C9E06E1BA3F2470E14179F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 79dddbd867e30bf9b6fd0bcd673ba6502947d1db03acf3ec7a9331304d3b0f93
MD5 c8b18a0a12234c8344d9718797a55ba9
SHA1 1c64325ebd2d60bcaaad8a9d50fd91f1fa1b37eb
SHA512 010b73885b6388646e3db24d5783a572d698e996f6ec0d1c55c97853448fe370f205f7d99481f5717562b443ec2edef726c15e9ed25f200de3d9ccc720ecb214
SSDEEP 192:sxRarb7/ftsIzprQ56zoA8p4f/g6+WNIYn83hqG5IgDDJ:sxRaP7/ftsIz26/5ITxrx
TLSH
T19932B7166A28A83B5CCBD21DBB55BF53D2F95033B1D05E48BAFC9A0C04E76CD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 f039338a76542843b3e3f7752274f1a69ee1a0fdcaa158f99b1f8f5a5fd5c367
MD5 334924264a9b041efde7d8bb13e5c198
SHA1 47e1cac1b641ba3890d6c3962e29619e334f666b
SHA512 734211b98ac9f0d93198dbc95e24831e1ecb3b3e9829a433dc5defaf20d52ee3b0a30ccea760e9947c6194d94812ec7aa24ffb692bb4f22872712609f04665f2
SSDEEP 192:sxRJrb7/ftsNzprQ56zoA8p4f/g6+WNIYn83hqG5IgIJ:sxRJP7/ftsNz26/5ITxrs
TLSH
T1AC32A7166A68A83B5CCBD21DBB55BF53D2F95033B1D45E48BAFC9A0C04E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 9236d486c7b508993f3800dbe70abbfb2fa71234d40cfe89d19e05c8ad9a78c9
MD5 a763c419cc1f4c4cdebed70fb2343a28
SHA1 3ea0a13b562fa392d63e9a54f218f970f6450e53
SHA512 2f2240a423f4e52a6cffefcaf1ec17c0ba83c11cb8fcd32774702e67e50bee0771c65797a1e13d603552ed5ab98d8dab4bdc41e853a71adf88fc37aab65cacd7
SSDEEP 192:sxRarb7/ftsI2prQ54OzoA8p4f/g6+WNIYn8OchqG5IgDFJ:sxRaP7/ftsI2X6/5ITDrb
TLSH
T1B042A81669689D3B5CCBD21DBB55BF53E2F95033B1D41E48A6FC9A0C04E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 21d19578d10d44f3036b33dc1fd28cc62c35884202ee58e92f02afeddd954c40
MD5 eedc8f547e10a8bb7bf79bea3d3614c9
SHA1 98cf75b175c523e795f3847b4f991d01324646d8
SHA512 7d24a7fb7f9139fb46a768ef3b8314d1988e3876ea3110ba6bbcb28092bd3cf4ef35f5291cae7403541a6450e88caa094f878c3d1a0f622e5d956bbd89c79d33
SSDEEP 384:wum8dzAfCtgoSFf6MKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVU494oRPvCrohz:wb8dz6Wgouf6M8F1+UoAYDCx9Tuqh0VC
TLSH
T101B2EC3B604DCB7E5F800AADEC19AFDB7D9802C79A988D4447FE950C02C77EA51194DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 370B
SHA256 d2fd4f7f67a981799eadcf6a75600a872d082e19099c60b136f6dd6807611f1a
MD5 d319dc96ff6149542cc7a6ef0f69b549
SHA1 16818b595220d765618c73dd8279b69ca8cfdc42
SHA512 9d107dcd8e88b782569b59129085e76655eb429c6e6ed789e79da83e9e221b292dd857c1af932a28794ac683ec7714472aa86b6caf3b271ec86dbf9e70cb486c
TLSH
T17CE020773FF72804FCEFD7DA283564510510B464844EBD4F7815E2D714B235434AAC25
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\faf0e859-46ec-46c1-b6ae-43acad597e56\index-dir\the-real-index
Size 72B
SHA256 7e963378e823f08a6e043dfab5c74067a93b028d24af525a6440d4a9fcadbfed
MD5 1da488586f20c6323453654cebdd8c1f
SHA1 f9fb1a00ab01d2352bc9cb1ed8e90d3a17090819
SHA512 05b56276c883f5e98f90a9cf422d19d8c1570c12d9b72a30aadad319eeaf93246cfae558de078036e5fbc48c8b7b4fe1f53e66b675f6e5702c556423fa543ba7
TLSH
T1C8A0029211E40245D8149FF1149B15763665BD170D0713D28CE0F1568D7BAA07712C40
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a31a0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\faf0e859-46ec-46c1-b6ae-43acad597e56\index-dir\the-real-index~RFe5a31a0.TMP
Size 48B
SHA256 dc17b3322c7a370021c564b6da2928003ac9cb8a6de0f5dfc6fb29f08d2b0e9a
MD5 5708094c199232fc32f3ce1af7f03acd
SHA1 2ddbd10870301a944d39e226fb3ee793ef7ba910
SHA512 7b86f9ec933ef7900f59370595e15041a130eee2ae1504d4182a70a303a29c3091d7806ce3618f13f27c7d09688f638fb3ffdbd9c549cb0fb9545d41d2629186
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\index.txt
Size 109B
SHA256 16fd724286dcfb428cd4dc88b2da1223891476ab5a2e8a1c70b1c38de9b3adaf
MD5 8f51efac2f623a009d55132b852b6750
SHA1 59bddeb774f38e3c13b9673c0b8b2429428f93b2
SHA512 19c6abc0fc2848ba8fe506d9b2770b0ab1cd9534d849223490eb5b0ce2cbb270728abda9b6c4ad439231c3132745ee46cf7ede8665adf466fa4392f2093e8776
TLSH
T17DB09210E9A52A7C914A0609075608022E2EF00462112A86F88C8C0208A5A260AA4EF3
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5a31cf.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\index.txt~RFe5a31cf.TMP
Size 114B
SHA256 7e8351807696d5c886d95de92d4d9980c9fcb9e7d751ca4813403c7964ad842f
MD5 a4d41ea9dba06d991a99e5eb014325f6
SHA1 7f947c7a409bccbbea9f59546b642ae5a1b64e78
SHA512 6e6f2d34e0cfd93a26a420c8904dd116452cf18b487edfa33efe65527c9e67df84ac8c6ebc8bbefb97f7391345680f210b6f65d434a6780ffc8cdbe8d5040bae
TLSH
T137B09210F0A52AACD24A000A876608422E2EFC0462012A86F88D780208B5A264AA4EE3
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 26fd78547aa60c96260ae408ac3fd68b6310872810f8e7680659d598d3384f68
MD5 47e33caf7e1cd97a8a5b74b3b74329e0
SHA1 bd5ecabcd81b614a9e8965682ee3172e1161f69b
SHA512 258be285c4ff027d2a1bb0435ee14fef31fb95cd7595ce2a4d7ebbb7591f9f08a4b2ba414e2dd8185593778b883266d257ea8f610d3253ca4483ceab2feabc7f
SSDEEP 96:KRoZs4q26gWeDzgggK41gCgcwgziItHU1gkeCGEWCPvgsEK4hgmEcEkve7jOKU4H:CoZs4q26neDsgU1gC/wgziItHU1gkeCf
TLSH
T10D913354317B03C4387D661C84A4A96FE2C2B963305CB9AB7FA841559F67E034DFE8CA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 3a5062dac7a0a1acc03402f817c7ef45c7e3684b3aa268dbf09a854cc39320db
MD5 c4cf95142fe2380a8a2bfc2e62d57506
SHA1 7d38031f741ce47a02eb94eb8f49961fd659ea0a
SHA512 7750e114981e14ecab92d06d6c05ffd63a1d9d82e9b20aec519ad46922ded72bae877988ef1d2b34f326ef51cf7964430c02ab5567b30ca4ad20d34ff76be5df
SSDEEP 768:vrv+4UNbdX3DnDZIO0Z/+Nzc4ReyIsP0oug:vbsbh3ptc44bsMa
TLSH
T1BA03AD32F8389D77ACE6A685B10B35537EF4521782C91A94CADD6B0C094B5EE132FD23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 d631d285d190163d6d93389ac040a157d83fc10d51921aec18c8714f9386f0eb
MD5 453319b03d37acb3892256c3b210bdc2
SHA1 936a5e054e07b704cebb38fe0cb8b3d79bec197a
SHA512 7cc2c1bb16a93cad9142140934dd012cb7b1052c327412e03a228d4834d015d97f538073dd54e4a4be45c2e976d8192e5ff4d5d7c8930d8583ac24222f82c8ca
SSDEEP 384:chZcIc38NYjVaGwLhJDZNfNoXOVSUURXvFAiXSFUETRzcoXfK86sfxEZxxsIj4lA:yc32nDZIO0Z/+Nzc4ReyIsP0b9ME
TLSH
T1CAF2BF32EC349D73ACE6A742F6463162BDF19227D2D82E84DADDAF0C09475AD031BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 d099bf0bd085744eb54e04630df96907ddeaf25f830bc0eedd60ac2c529efd0d
MD5 9e17c56037530e3814883d2563b0226d
SHA1 87949e8d5d6bde801b643e9331bea066aa529f00
SHA512 1b0bcfeb07fa23519621a90f8fd101762367ebb8d62dc5ca7bc34c7a421940f801536e880d378e691494a1826d9667bffdc95e4230ec76cf85eaba6b72979c89
SSDEEP 384:0iZcIW38NYjVaGwLhJDZNfNoXOVSUURXvFAiXSFiETRzcoXfK86sfxEZxxsIj4lA:vW32nDZIO0Z/mNzc4ReyIsP0b9ME
TLSH
T169F2BF32EC34DD739CE66756B6463162BDF18227D2D82E84DADDAF0C09475AD031BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 2c797d5e4912560af775f497a2eb445814bd757d66676de8e6993ca0421a8187
MD5 f4dd86a7c5d9cedec0163c3309397af1
SHA1 97aa8170ec3942a3375f15ec8bb98ea48a8ba23d
SHA512 d1168639a3db17c94c47338e24d584a4c220f1dcb013bfee431c69a7464843f246ecbe0e1075687a186f3cf6ea80b80f82f6f4877c4cab6cc346057b84b764ed
SSDEEP 768:6rv+4UNbds3QkDZIO0ZaNzc4ReyIsXCeVH1S5D:6bsbS3Vtc44bsSEH1Y
TLSH
T14903CE32E8788977ACF66786B14B76533EF8512782981B90C9DE2F0C4A4B1DD131B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download