hxxps://comfluence[.]boldepine[.]vu/yy3fxe47na/

Analysis

user interaction
yes
max time kernel
299s
max time network
297s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/07/2026, 14:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://comfluence.boldepine.vu/yy3fxe47na/
Sample260731-razzdathrd

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
764	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134299800462380156"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{5B1650B1-7551-4D86-9946-50FB5EEF767C}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
204	msedge.exe
204	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe
1736	msedge.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 1736 wrote to memory of 1104	1736	msedge.exe	84
PID 1736 wrote to memory of 764	1736	msedge.exe	86
PID 1736 wrote to memory of 4684	1736	msedge.exe	87
PID 1736 wrote to memory of 4684	1736	msedge.exe	87
PID 1736 wrote to memory of 4684	1736	msedge.exe	87
PID 1736 wrote to memory of 4744	1736	msedge.exe	88
PID 1736 wrote to memory of 4744	1736	msedge.exe	88
PID 1736 wrote to memory of 972	1736	msedge.exe	89
PID 1736 wrote to memory of 972	1736	msedge.exe	89
PID 1736 wrote to memory of 972	1736	msedge.exe	89
PID 1736 wrote to memory of 1996	1736	msedge.exe	90
PID 1736 wrote to memory of 1996	1736	msedge.exe	90
PID 1736 wrote to memory of 1996	1736	msedge.exe	90
PID 1736 wrote to memory of 4468	1736	msedge.exe	91
PID 1736 wrote to memory of 4468	1736	msedge.exe	91
PID 1736 wrote to memory of 4468	1736	msedge.exe	91
PID 1736 wrote to memory of 2940	1736	msedge.exe	92
PID 1736 wrote to memory of 2940	1736	msedge.exe	92
PID 1736 wrote to memory of 2940	1736	msedge.exe	92
PID 1736 wrote to memory of 2556	1736	msedge.exe	99
PID 1736 wrote to memory of 2556	1736	msedge.exe	99
PID 1736 wrote to memory of 1108	1736	msedge.exe	100
PID 1736 wrote to memory of 1108	1736	msedge.exe	100
PID 1736 wrote to memory of 3944	1736	msedge.exe	104
PID 1736 wrote to memory of 3904	1736	msedge.exe	111
PID 1736 wrote to memory of 2412	1736	msedge.exe	112
PID 1736 wrote to memory of 1972	1736	msedge.exe	113
PID 1736 wrote to memory of 2192	1736	msedge.exe	115
PID 1736 wrote to memory of 2192	1736	msedge.exe	115
PID 1736 wrote to memory of 2192	1736	msedge.exe	115
PID 1736 wrote to memory of 5072	1736	msedge.exe	116
PID 1736 wrote to memory of 5072	1736	msedge.exe	116
PID 1736 wrote to memory of 5072	1736	msedge.exe	116
PID 1736 wrote to memory of 3108	1736	msedge.exe	117
PID 1736 wrote to memory of 3108	1736	msedge.exe	117
PID 1736 wrote to memory of 4056	1736	msedge.exe	119
PID 1736 wrote to memory of 4056	1736	msedge.exe	119
PID 1736 wrote to memory of 204	1736	msedge.exe	120
PID 1736 wrote to memory of 3164	1736	msedge.exe	121
PID 1736 wrote to memory of 2200	1736	msedge.exe	122
PID 1736 wrote to memory of 3164	1736	msedge.exe	121
PID 1736 wrote to memory of 2200	1736	msedge.exe	122
PID 1736 wrote to memory of 4232	1736	msedge.exe	123
PID 1736 wrote to memory of 4232	1736	msedge.exe	123

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://comfluence.boldepine.vu/yy3fxe47na/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2b8,0x7ffe392dc188,0x7ffe392dc194,0x7ffe392dc1a0
  2⤵
  PID:1104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1948,i,13980087726896473504,8794080023833661455,524288 --field-trial-handle=2888,i,1757474822178974762,12281051018545974525,262144 --variations-seed-version --mojo-platform-channel-handle=3064 /prefetch:3
  2⤵
  - System Time Discovery
  PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,3774098643269439582,10470214664891242075,262144 --field-trial-handle=2888,i,1757474822178974762,12281051018545974525,262144 --variations-seed-version --mojo-platform-channel-handle=2884 /prefetch:2
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2240,i,7711897262401222930,11895426057862978806,524288 --field-trial-handle=2888,i,1757474822178974762,12281051018545974525,262144 --variations-seed-version --mojo-platform-channel-handle=3080 /prefetch:8
  2⤵
  PID:4744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,5358670977062200520,7232283218843833993,2097152 --field-trial-handle=2888,i,1757474822178974762,12281051018545974525,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,7843805161260547391,2150685839127455387,2097152 --field-trial-handle=2888,i,1757474822178974762,12281051018545974525,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:1
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4148,i,15226761939442165079,4509317520974030069,2097152 --field-trial-handle=2888,i,1757474822178974762,12281051018545974525,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:1
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4204,i,3040319062615940417,5182138739376917450,2097152 --field-trial-handle=2888,i,1757474822178974762,12281051018545974525,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:2
  2⤵
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,3438126798310486027,17252406153661903812,524288 --field-trial-handle=2888,i,1757474822178974762,12281051018545974525,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:2556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,13259984078945459678,2945224474517508890,524288 --field-trial-handle=2888,i,1757474822178974762,12281051018545974525,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:1108
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5752,i,15913630240939920727,1923675569866264026,524288 --field-trial-handle=2888,i,1757474822178974762,12281051018545974525,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5752,i,15913630240939920727,1923675569866264026,524288 --field-trial-handle=2888,i,1757474822178974762,12281051018545974525,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  PID:3944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1624,i,10449485800188159563,16963077881713694684,524288 --field-trial-handle=2888,i,1757474822178974762,12281051018545974525,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:8
  2⤵
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4216,i,12632797580519935371,17337385630511803269,524288 --field-trial-handle=2888,i,1757474822178974762,12281051018545974525,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:8
  2⤵
  PID:2412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4628,i,4861507299119073884,14103387005890026533,524288 --field-trial-handle=2888,i,1757474822178974762,12281051018545974525,262144 --variations-seed-version --mojo-platform-channel-handle=6060 /prefetch:8
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6288,i,12776741014720106677,2303004400335968431,2097152 --field-trial-handle=2888,i,1757474822178974762,12281051018545974525,262144 --variations-seed-version --mojo-platform-channel-handle=6272 /prefetch:1
  2⤵
  PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4556,i,16073392514253475538,9937744808764459612,2097152 --field-trial-handle=2888,i,1757474822178974762,12281051018545974525,262144 --variations-seed-version --mojo-platform-channel-handle=4548 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6456,i,1329802381699141835,1811512108897281547,524288 --field-trial-handle=2888,i,1757474822178974762,12281051018545974525,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:3108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5960,i,1646635368429556799,8149448020033683177,524288 --field-trial-handle=2888,i,1757474822178974762,12281051018545974525,262144 --variations-seed-version --mojo-platform-channel-handle=5972 /prefetch:8
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5704,i,4880459031897327524,2192710650789900165,262144 --field-trial-handle=2888,i,1757474822178974762,12281051018545974525,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3984,i,2572661539465823692,1327258659123244829,524288 --field-trial-handle=2888,i,1757474822178974762,12281051018545974525,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:8
  2⤵
  PID:3164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3356,i,15570694063947616493,18281964172516834044,524288 --field-trial-handle=2888,i,1757474822178974762,12281051018545974525,262144 --variations-seed-version --mojo-platform-channel-handle=3360 /prefetch:8
  2⤵
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6636,i,10947148137851885723,3935142841506142049,524288 --field-trial-handle=2888,i,1757474822178974762,12281051018545974525,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:8
  2⤵
  PID:4232

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 d5217640df91248fea94d342f3c3c5ed0657d3ad28421a019ce0669e40197978
MD5 78b9de034e3a7edea6a485a8b51bf1bb
SHA1 6f4ef3e49b6a55fcf4440d37ef29e5d9fc82f4ff
SHA512 c503627f0c4e23b000b3131bf927030af409f64a95359222d1cae683858fdd5627327d7a6ec74effe1cf8a491d6eb4671448b4eb8c35c8a35f43f76c7e4baaf2
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7J:fwUQC5VwBIiElEd2K57P7J
TLSH
T14DB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6d0f88884e23b1418c456620b79662feebdfd970ca9325ba2981c94b3b0f0b2f
MD5 7060eae8ec426d15de2849b1f7d261b4
SHA1 b252d90b9d7050d0b9b7c03141d9d3b7cae404ac
SHA512 8791005fae20dc1dc5dc5b0086efe814e0b1e36781ef1931cc1fc699fc4cb34d62ab3f9a83f4967824f3bb71aef6adc6ad457ab7a6addcba99f9e9b473eabb4d
TLSH
T118D01222BE08A415E65BA271A502C7141F5954A124938651E224D86CD9F84D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4d517b88a0fb88494276c126764235de9ee52961c86cc4d3abaf517b10a649a8
MD5 dde9ea8dd9c7e315ef614ab3476af02c
SHA1 e03e201e89770d15b4040d579c2cce8684959a2c
SHA512 410e016336529d709de957d44e67238e4f6592b9ce6646395a9e45ce592e7810b4cb6b1b6df5d8b26875a6aa235b77d41c0983ccc055556f8b8c02224093fdd1
TLSH
T16DD012227E08A415E65BA271A502C7141F5954A124938651E224D86CC9F94D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 dd2ce3bfb13ab68205735762a8584a1d7c755d02b5ad0cbfa985d2271d49d6b7
MD5 1376fce38894723b10251d08da876d11
SHA1 4122f53335ed70ac89b305ab20b3f8417da9e7f4
SHA512 e46157de95ada429e86375e714c2294e09a7d824c48b88252969eb816128ea0def08cd1d37c05bfb7d413eb30f09d58885d812ff97319c0002b1775295b28603
TLSH
T1D8E0DF6B13ACC7A651C294CBC059629A907471A996DC8CDF2F18689E7902861C3D998B
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 249358b1eab901f0b034023569e7f01b1f94c9179591789d99d6f279761d6e1c
MD5 e3fe72c0f542fbb29d9eb8933eefb382
SHA1 fce9a5a6bf89b76d58b4c0f0c691531330ab3b3e
SHA512 f71315278d44c74df19833e56e16d62705ddd45cc9bbabd13be55f51927a3d7464736846a1c4bcda6770c5b8c0720e1defbfbddb5206de648079efb1a9250340
TLSH
T17EC080D9BD4D845FD385187E5716F00007906511942796171650FDC032419A01E29220
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 01fc60997ad94da0272b242b4213c355d35e7d16e7ec529f172de2a0bc195290
MD5 c98fba60b16965362c2f14213035702a
SHA1 0b2ad78ea821c9b65c0253d57a238f7b93c5a6e2
SHA512 008ae7e6130994c68d556152f62355af8a420fd094c06b58bd95459189e8c157ce7570a391066931b8ed1d29e1331395cf7379da7d7265339e96ea37b27fd2fd
TLSH
T17981C6B5811B35A9EB0C4F3190DA0D4A32306AE9FDFF3FAF5D8424B98779355052B468
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 aec8b4fbfafd83b6fdadd468e90f081e75d0ceb75c40be6b7cfa5403e745f468
MD5 78822e7a6f32537bb4390c942a16e132
SHA1 d7949ef02244f9eeb6eec78f59aaf264b0da8b5a
SHA512 e2862f8c9d1973eb124a6afd9785f167aa8d2e2b7fa66e998843e1703cf81657034779cd6f67a53162cbdeb587c55b24a0bfa547f4bac7009fa21e124ef8c172
TLSH
T14F81E6B4810B35A9EB0C4F3190DA0D5A32306AE9FDFF3FAF5D8424B98778355052B469
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5871b0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5871b0.TMP
Size 3KB
SHA256 7588c4a18051f0b921d7a3242a7ca2abe9097bb9d18c480dc8ac9fba565e9abe
MD5 a4b154625475436c99474e936ec5143a
SHA1 b0658ea3ea318aeba53bcd96cf1e3a4b02e0bbd1
SHA512 ef5c63d3a8f0203b5f1875d263397133bdfb7e61c756d986fae4fd91952219e8db13e2be247d98bfac838ac37b63b613940d4ca40d4b9cf6804050fd97b3b27a
TLSH
T11581E7B8811B35A9EB0C4F3190DA0D5936306AE9FDFF3FAF5D8424B98778355052B468
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 b39c99147e46f3f8eb46d0189897a2ebe184712b3b241d307dee3bfcb36fddf0
MD5 629ec7c90569ce27a1d99ad27712feb5
SHA1 a69ab8efa07ebdf1a8c02a06debf4c4e2a337f15
SHA512 7a488f5d7a6b47888c8e503e44345948449c76dc931259752cbd8adae387d4842242c7680aa783fab904a8a75e03e9a7f808f61681b8f6af8db89ee9d823cffd
TLSH
T1CC314BF787E4862DCD2152F4AA186F1BCE6D0915432C3916C9D4AF1BA7E24B1E101A9F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 850c73fe6783220aa8fd9ca4f0a03411191d5d626f43eb3e9b2257239896bf84
MD5 8461bd79398b7ae9bccd51505c2013c4
SHA1 db3127563908b5f97f8c68969132a35ff0948e19
SHA512 c75c44b5be1bf6a59d3b9fb4f0f2df9ad6dee8589e8e4def0703298093112b010e6406df8a383a20013e285218d057b04706d7161be02ef429930e8af0588b67
TLSH
T14E3159F787E4862DCD2152F5A7186F1BCE1D0911432C3D16C9D4AF1BA7E2471E101A9F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 fdeeb8bf430561bc67444917248a920119b69e15fd9ef92ce01db837c74e6113
MD5 6216f131cab3d671f6ed868a26e88df2
SHA1 cc8c9783c13ee407fdf395dfb6353f94cb63409c
SHA512 e5e04191984110c12fb981ef0ed42f0da4fe950e656076b0380361fd2f810311f12e641495206afcad837a1f5d65274d8b003de88a8b5fe5e39a2381a8e860c1
SSDEEP 192:sxZb/yM/jK1Ml8Mkj/fjsIykGyTVNIdpJHW6+WNGYvx5jvJIgrJ:sxZb5Mj/fjsLXzJHbGyN9
TLSH
T11B42E8126B38597BCCCBD20DFA55BF53D6F51562A2900E44A9FCDA0C04E6ADD2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 2c946520d4a6efa7db228e0f17674fe2cba393f59bc4cbe0d6e2458805131c33
MD5 5c8c5828aad3df9bf284c173095885cf
SHA1 ab63e320c29310c0f48b8b9a65ce9511f094006e
SHA512 6d0b3302e233b5544732d6a59702a29ae9d3b016640dd7db50a1f97e7fbdc53ad8fef15a6970af9f64cf55c2d0e501776f96f7be8627d9dc39b8d0f04db70ea8
SSDEEP 192:sxZb/yM/jK1Ml8UQ3kj/fjsKykyHqVNIdpegIHW6+WN2maXYv0ojvJIg5TJ:sxZb7q0j/fjslPv4HbeX8Nj
TLSH
T18B52E856AA389977CCCBD209F955BF53D6F50472A2900E44AAFCDA0C04E6BED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 194925db526389562a08fa70667ea4db8ee5a6f6a0f8afd3e2423a56633af3dd
MD5 b2f90ce603d598bad5e7b95a0e71457d
SHA1 bac73571bb82d76db998e7052d157d5a1fa8ca5e
SHA512 4018d308841ca73447f0b65d1a7554d66c069d587830c22719991877a9e731b60dd1c0fcc52c9e1cdac0495bd7634be40bbe984c3fab1d1049c34a5d249fc177
SSDEEP 192:sxZb/yM/jK1Ml8Mkj/fjsKykyHqVNIdpAYHW6+WN2IV/YvbbjvJIg5TJ:sxZb7Mj/fjslPvdHb3/gNj
TLSH
T11652E8166A38997BCCCBD209FA45BF53D6F54572A2900E44AAFCDA0C04E6BDD2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 fd74d966fdea6a19704736f5fd945423808b596004107d1e14a59da8183d2fdb
MD5 263287f0aeda7eb77eb00fbf38b7803f
SHA1 fd77feb1f11132dc0503476051911964ca6901ad
SHA512 91d73731a935f0cf584d8319b3053d704691fd663aec7f13d4691e280fd4c6019bd668b498f47c96c7d90e980018a6fd64f6016d29bba2062080cae40395b185
SSDEEP 768:moseJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0ppVroqC:moseJ3xWvhfynu1jaVcL88pu/
TLSH
T1ADD2FB2B280CCB7E4F844E5DEC266F966EE801CB67944D5487EA884C03C77EB51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 633dedc1abb6d96e32a73a1bac07c8841d1c19482211bc0264d89b3b8ba53713
MD5 50fd8ce81aac1b04ba3e03865e0d369e
SHA1 165cd2a88d6c128fe9ed613270885b27c7b1c864
SHA512 3098662447905c979f11d12b82fcafd0a1e0dac3a11dc62805c168e3692dba67b6b5cf0122e06d6d1f1ecb48db01f08da619ce665584c365e20de9ede8e73a01
SSDEEP 48:KYHIhKggkXyFjIBKEYcXyBuIXKTagLIjKmQCyVz:KYH+Kggm2jGKEYGCusKTaCIjKmQCyVz
TLSH
T1D891F057353F0602387D254CA6A5A9369E4271A37454A8FFBFB844624F27E210EBCCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 49084221d3c61c648870eaa8c6604608595e79e0da6d378d0f8dccdfd8edfcf7
MD5 f854ad6bc4f0960b177def68ae4504be
SHA1 6a2181c4c8d16801dd9e41d72454f16086fe3c5c
SHA512 8a76a7ccad52d481b174f11ecf4db7cd24d6c8c0219efa5ce5697fe6249227a65b45c5c0054a57ba516526b77c87bf68957700d688e1be8b3ea79cbc21dfb85a
SSDEEP 384:nOFiZcIYzsNp8TUNTUlIl2rRC7ltU+yd2I5KGRQGv:nOFQkgwg6Cc+ydFlRQGv
TLSH
T1E4A208F258D7883AD9AE9743B77D2E024EBCC067B6849650B3D85A0DCC961BFC30AC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5015f02b320b29d9f5986b9b0f0dd709be744e8be189b05e10b153caf888b4f8
MD5 32c5b87cf05cf871dcb907b341041518
SHA1 0b3ed15e00196b3ac3286c64f4b3d283521b2adb
SHA512 73be34b7f0faf17b272157b40ddd167c0916ad0736ca30efabffb8c7d3a21215cb451f05bd3193e54e66733527ed75548f1ec5d6d1b87a7b7d0fc1d9aa7ba070
SSDEEP 192:lONny6vMtPQmiUyIpThThcC5KZ847btU/u:lONny6UtRdTD5KhZU/u
TLSH
T15D02F876BC785C7BDEA3AD46F48E27171FE4517BA5905B40EAE82F1C00D765C230782A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 dbf027845a434b9998dba28da9025495acdb214af7b9ee11d0738e2177819790
MD5 3a8093837e4befe8bf98618d955f4839
SHA1 4f5342a99e55238f480dff85baf16dd2d1db4354
SHA512 ac1344e5336f643fdd8c58b83372415d4c6bfe214bcb68621affeb702c689fad30a647928f4d23d7bd250ae55295a411b248a39ed94ffe501b4e73479d9e3435
SSDEEP 192:uF6Rm+xasuheOwQxMGsNX2QtyEs3pM7RL7QmiU1Ndj4MThcC5Kopo8z19qNGFYy:/yZcIhsNX2rRC7lt1MI5KGhQGv
TLSH
T12A624BB26C785C3B99A7E142F48A37031FF49167A7C45B50E5ED7F1D00EA6A8130BD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 b5d7c1f50c583d3f6d0b6fd95e070e8234e65615c84bc53948fc2231138f3336
MD5 65d618b33b2fd0926c3efbc603fa88c0
SHA1 9633fda827b3ba9d70515638a4c6511db027de5d
SHA512 d8721b787ce3aa67ddbf4a937ba9ddc26951dcb305dfea2431a410961debcf9bc159292baa6be084d0270dc0adf5d8856022891efbe80cfb37f919e2f5c30319
SSDEEP 192:uIRLsNXHQtyEs3pM7RL7QmiU1Ndj4MThcC5Kopo8z19qNUMZ:7tsNXHrRC7lt1MI5KGhQUMZ
TLSH
T1F1421B76AC689C3B9D93A151F48A37135FB4816B96C46F50E6DD2F1C00DA2AC130BD2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 040966c111c47b384dc954a2e36f7e86220daf754fcd004d205422f0d46ce86e
MD5 1c95f7be78d5ae9b28762d7bf76cf657
SHA1 cb0726e8ffaeeb7b869b9070766082c4f686767e
SHA512 dac98a332c85c4ce038a1869bfd0be77da83fe213990764b45538058d80a8cf19ce34f04e55e9046384f0f08410a1da4e2d450a5fe9a456fedbe0ed910ef0265
SSDEEP 192:cONS6vMlPQmiUyspchThcC5Kopt80I9qNU/u:cONS6UlRzcD5KGSQU/u
TLSH
T179120A76BC689C2B9D93B442F48A33171FB5926BEA849B50E9DC3F1D00EB66C1307916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VariationsSeedV1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsSeedV1
Size 2KB
SHA256 5285b522709e008d3c621bb06e362db3b101196c12b2a8d2cfb1f885d1b866fa
MD5 97513df706cd4418352f7b51e5ca87ae
SHA1 b8aabdb58106565c2ed6e219f9ea690525c2d19f
SHA512 7fb4735b93331ecf03aecab81a560128ef56a9a55efba2e4300bc244b4988b7d36edf76847ff8b4f51d1814bd5d4dda174fd436a6adbf0b704e0b55b723dd6da
TLSH
T10F51393939E296FB8D602E3A9F0447642F98DDF119A34086D2120DA44DCA1BB1C036EE
MD5 SHA1 SHA512 TLSH

Submit Download

cb126918-00fd-4185-b599-a0ece057ea4c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\cb126918-00fd-4185-b599-a0ece057ea4c.tmp
Size 484B
SHA256 9fd2b7fae87c2d863b486a425834283f19b1444749c84650d5a48c9eadb12e2b
MD5 e9289cc1f579fdfa9d46acfae9b38330
SHA1 7eac8e241d8c35d873280d6b9dbc1cca7a9b2231
SHA512 b1f37da50e387c8408a960ef5276a51336510286c1db7eaea4cde65af4efc343f8ac1d9de65df1fd0818513823a485733e5c155da615344bc044f46021ecf586
TLSH
T134F0543C33D821A4F08C46B23596ED8B88BF313247DC2631CA50F550315387701B5095
MD5 SHA1 SHA512 TLSH

Submit Download

d3f79d58-a3ea-4efd-923f-dbe4af406018.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d3f79d58-a3ea-4efd-923f-dbe4af406018.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 8b520166e7578efd4eed18744fd9bebdf1156d67a08e7ee50cd6ce63f23a3bd4
MD5 3de69837740f41fb470a9b28d3196e89
SHA1 f7468934f4a746e4c178cdbd026170ca606be571
SHA512 6154865e19155fe93dea9bce246a5dd3f771405c4fb2ad2ac14f631d5c9ae8cf23a19576d7be38f9f0b5512e4e4b6ba6088e19b1430b197831af50404642c34a
TLSH
T1B641ED58B6FA1148B3B77E5A9BF7A87E447EB9672F0BE55D00110D4F0622B40C961733
MD5 SHA1 SHA512 TLSH

Submit Download