8891cd8fde4804a6a8fd3988d372655e88c87837f70fa922645759443725a5a1

Analysis

user interaction
yes
max time kernel
899s
max time network
737s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 18:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
foods.html
Size 5KB
Sample260801-xfr4lstepd
SHA256 8891cd8fde4804a6a8fd3988d372655e88c87837f70fa922645759443725a5a1
MD5 96e144040ef215762d51ce64310a13db
SHA1 21d70f3f6d2eaaf67c16d55dcd4bfe715391a1e5
SHA512 1b944f078bd77c8f9d24845b7aaeff824f9dba810159df99b212aecddcc934acdcd69d9f45172df8ad15b7595f5ad80dd1c45460c0c738374be2811d76dce976
SSDEEP 96:vv+spLnpN5mrr9eU8a1m1QO3QimzoVtwic90wQwNI+xbov9+aSWc6/u0/CH51unD:vvVpLnpN5mrrQUR0+OdsoVtK90VSI+9G
TLSH
T15AC18597B6B300913A538EB03BE367062364D017A14AC9687FAC628C8FC5F557DA379C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2520	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134300837016051624"	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{39030D00-C416-4BAF-AC18-4EEAB51E7279}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2028	msedge.exe
2028	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe
2564	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 2564 wrote to memory of 5776	2564	msedge.exe	89
PID 2564 wrote to memory of 364	2564	msedge.exe	90
PID 2564 wrote to memory of 2520	2564	msedge.exe	91
PID 2564 wrote to memory of 364	2564	msedge.exe	90
PID 2564 wrote to memory of 364	2564	msedge.exe	90
PID 2564 wrote to memory of 5172	2564	msedge.exe	92
PID 2564 wrote to memory of 5172	2564	msedge.exe	92
PID 2564 wrote to memory of 2616	2564	msedge.exe	94
PID 2564 wrote to memory of 2616	2564	msedge.exe	94
PID 2564 wrote to memory of 2616	2564	msedge.exe	94
PID 2564 wrote to memory of 2104	2564	msedge.exe	95
PID 2564 wrote to memory of 2104	2564	msedge.exe	95
PID 2564 wrote to memory of 2104	2564	msedge.exe	95
PID 2564 wrote to memory of 756	2564	msedge.exe	96
PID 2564 wrote to memory of 756	2564	msedge.exe	96
PID 2564 wrote to memory of 756	2564	msedge.exe	96
PID 2564 wrote to memory of 4184	2564	msedge.exe	97
PID 2564 wrote to memory of 4184	2564	msedge.exe	97
PID 2564 wrote to memory of 4184	2564	msedge.exe	97
PID 2564 wrote to memory of 5332	2564	msedge.exe	99
PID 2564 wrote to memory of 2964	2564	msedge.exe	100
PID 2564 wrote to memory of 5332	2564	msedge.exe	99
PID 2564 wrote to memory of 2964	2564	msedge.exe	100
PID 2564 wrote to memory of 3232	2564	msedge.exe	102
PID 2564 wrote to memory of 892	2564	msedge.exe	106
PID 2564 wrote to memory of 1408	2564	msedge.exe	107
PID 2564 wrote to memory of 3216	2564	msedge.exe	108
PID 2564 wrote to memory of 5888	2564	msedge.exe	109
PID 2564 wrote to memory of 5888	2564	msedge.exe	109
PID 2564 wrote to memory of 1568	2564	msedge.exe	111
PID 2564 wrote to memory of 1568	2564	msedge.exe	111
PID 2564 wrote to memory of 2028	2564	msedge.exe	112
PID 2564 wrote to memory of 2280	2564	msedge.exe	113
PID 2564 wrote to memory of 2280	2564	msedge.exe	113
PID 2564 wrote to memory of 892	2564	msedge.exe	114
PID 2564 wrote to memory of 892	2564	msedge.exe	114
PID 2564 wrote to memory of 4656	2564	msedge.exe	115
PID 2564 wrote to memory of 4656	2564	msedge.exe	115
PID 2564 wrote to memory of 1036	2564	msedge.exe	116
PID 2564 wrote to memory of 1036	2564	msedge.exe	116
PID 2564 wrote to memory of 3992	2564	msedge.exe	124
PID 2564 wrote to memory of 3992	2564	msedge.exe	124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\foods.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x28c,0x7ffc14c5c188,0x7ffc14c5c194,0x7ffc14c5c1a0
  2⤵
  PID:5776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1528,i,6468790495936653503,17802438452412239284,262144 --field-trial-handle=2240,i,12334671673536514857,4153388504049317257,262144 --variations-seed-version --mojo-platform-channel-handle=2236 /prefetch:2
  2⤵
  PID:364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1808,i,8748585806877381290,3519362412852881986,524288 --field-trial-handle=2240,i,12334671673536514857,4153388504049317257,262144 --variations-seed-version --mojo-platform-channel-handle=2832 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2280,i,4086386146768914743,11042912195222084020,524288 --field-trial-handle=2240,i,12334671673536514857,4153388504049317257,262144 --variations-seed-version --mojo-platform-channel-handle=3124 /prefetch:13
  2⤵
  PID:5172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3600,i,6180976868239693075,6635125405722034925,2097152 --field-trial-handle=2240,i,12334671673536514857,4153388504049317257,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3604,i,18187289078387611354,6659607469167260903,2097152 --field-trial-handle=2240,i,12334671673536514857,4153388504049317257,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4336,i,14150933967452583047,12832703474767694180,2097152 --field-trial-handle=2240,i,12334671673536514857,4153388504049317257,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:9
  2⤵
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4312,i,13536613481075819815,5401510620979644203,2097152 --field-trial-handle=2240,i,12334671673536514857,4153388504049317257,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:1
  2⤵
  PID:4184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5032,i,16760300784641428661,8176945747821164463,524288 --field-trial-handle=2240,i,12334671673536514857,4153388504049317257,262144 --variations-seed-version --mojo-platform-channel-handle=5464 /prefetch:14
  2⤵
  PID:5332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3804,i,13118608054834402539,14760256047158308774,524288 --field-trial-handle=2240,i,12334671673536514857,4153388504049317257,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:14
  2⤵
  PID:2964
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,8078393040105149951,12444538618116744673,524288 --field-trial-handle=2240,i,12334671673536514857,4153388504049317257,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:14
  2⤵
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,8078393040105149951,12444538618116744673,524288 --field-trial-handle=2240,i,12334671673536514857,4153388504049317257,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:14
  2⤵
  PID:3232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5984,i,3154577936248838504,14790184586350336476,524288 --field-trial-handle=2240,i,12334671673536514857,4153388504049317257,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:14
  2⤵
  PID:892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4412,i,9171478982069344875,10563555805912700231,524288 --field-trial-handle=2240,i,12334671673536514857,4153388504049317257,262144 --variations-seed-version --mojo-platform-channel-handle=5060 /prefetch:14
  2⤵
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5008,i,2334268302711084084,18048164017477636698,524288 --field-trial-handle=2240,i,12334671673536514857,4153388504049317257,262144 --variations-seed-version --mojo-platform-channel-handle=4860 /prefetch:14
  2⤵
  PID:3216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,5441469774994201397,5869112495663239139,524288 --field-trial-handle=2240,i,12334671673536514857,4153388504049317257,262144 --variations-seed-version --mojo-platform-channel-handle=2800 /prefetch:14
  2⤵
  PID:5888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6232,i,2298976031655335316,10522960725215188233,524288 --field-trial-handle=2240,i,12334671673536514857,4153388504049317257,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:14
  2⤵
  PID:1568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5460,i,8703578983415147724,12980724828301990715,262144 --field-trial-handle=2240,i,12334671673536514857,4153388504049317257,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3800,i,5741915074462764802,17467417405996926471,524288 --field-trial-handle=2240,i,12334671673536514857,4153388504049317257,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:14
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5024,i,1840476123860757776,5275302746804957782,524288 --field-trial-handle=2240,i,12334671673536514857,4153388504049317257,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:14
  2⤵
  PID:892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4328,i,4932737449061425295,4500247363968005023,524288 --field-trial-handle=2240,i,12334671673536514857,4153388504049317257,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:14
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6012,i,4137254533513862094,15352726710665339712,524288 --field-trial-handle=2240,i,12334671673536514857,4153388504049317257,262144 --variations-seed-version --mojo-platform-channel-handle=3124 /prefetch:14
  2⤵
  PID:1036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5012,i,4031978298717825117,7024118870962746035,524288 --field-trial-handle=2240,i,12334671673536514857,4153388504049317257,262144 --variations-seed-version --mojo-platform-channel-handle=5044 /prefetch:14
  2⤵
  PID:3992

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1788

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2460

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4520

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:4824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 2bb05c1d19f9b794852e07723e7b036c91ece056f156b66f421a12cefa6129c0
MD5 17b1cf59d820f161ac77872aa3c94522
SHA1 b3f21379bcb93d185d227fb15b1cd2b4c0da62fc
SHA512 a74ad2286ec6975ac87111bca6a8bb0565a8c0bc236f41e09bdc68d827dc0967f22dbaee50c64eee70a6e26713f791d6071d68096ea61127885eeffe4edeee08
TLSH
T17EE020D404C4C31EF60466CB527DA70CC2C8760FAEC8BDCD1701C4447041048A3C6F61
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 28d58ee247910cbd09149b9bb1b29462507d2e823407363a9ba32ce15683a340
MD5 ebf41c04cd51193dc8402abb07788b3b
SHA1 3d952dd36f261982344a822e454fcdf41396c9e0
SHA512 ddc9a7a44013e16d6ae81b27ef94618dffdbe13e2cd3fa19673bc0e524be4c981241ac7b48394b73fea3758076892da61f90be29bb51fa0c86cc7a3c5a3d5c60
TLSH
T192E0208408D4C29DBB0064C7D2BCD74E91C1361F9EC4AD0D57048844704394877A5F61
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 5403c21769afd170e18b77091360021495adfa36d835fbd7667d89af6fd6d664
MD5 020f6fd549c6c90be1fecc4886ef92d2
SHA1 83f44d2b1316047b90329a3d3f313e5065f9ea74
SHA512 a8f4278f34be09455c0d3623e6b878fb93ead976b2b6c81823195ce63dee4cd87be6419be0d47ba94b2697537b9214247facd9b2bd8d976de08c453b3340f58d
TLSH
T185E026C80AC8C2EEB702A487D1FE634D92D0361B9FE8E91E5700C8C57003144A3A2BA1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 8a8bc4515e5902b0ec912c9e765363f0b1b780a03645545d5457ad05681275d2
MD5 5b97ea4d0709a8299df42b9c11d52748
SHA1 7938cf60b8d1bc482d72c79823f009e8ac49b7a7
SHA512 afbe3e191c0fafe85301fc136173787643b63a1fbf3df9e2b49c8d1b92ee71884769b6e52b4b582d89768ffabe56e0ad4367b5a1cab2768a55cd644856c98114
TLSH
T118E0208445CDC25DB600A4C752BC531CC2C5360F9EC5B94F1704C8DD7001440A3EBB63
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 8c13991b4c5b12c53e9be2d59305fb89258fa0efe07731e1fad3a965d46414f1
MD5 bc318da0723c3475b66301b744a51347
SHA1 0e2eff38c9f5f8da46be4be3c2c6335bb891411e
SHA512 ec5da6681e27db6193e3ecf7dbb9338fdbf03d8e9cffd1de00352cedbfc7413d75b1505aa268cdd7edec5eaad4084eb3ef80a919ce632d320167b97aa9cbfa55
TLSH
T1C561821423E73AD1F32B5AF1B2E2A76876F4445D06072E139381BDF29406F38E8EA453
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59d400.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59d400.TMP
Size 3KB
SHA256 2bd95da21388fa675cf255897661233ee64acee684c4e68c7ba4ba513ebca2f2
MD5 de28f8960833cb45fabd90a79c13e6ca
SHA1 732542c1c355876e7d7b413ca4e17535b0505923
SHA512 7ab062d6b2ba8b0ec8c7ba109c1d1893922e849b5c36f7c80599d3691d74d17f7716bf46d866d4ae467b0888e7de651db6cc97f9b32ea929367a3b063d2a6e0c
TLSH
T16F61621423E73AD1F32B56F1B2E2A75976F4445D05072E139381BDF29406F38E9EA453
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 d7d12b663e4ebc621c8e7118f509d72572b0d8b4374671024955c813e6a916ab
MD5 8743d8d902c135ff603e8b67239e8b9f
SHA1 381554294911099889d7c8860aac4392dc06027c
SHA512 e14b32c3c339ec1ed29eec16633664c12d47479a6c2126bf61d34cc2cc4ad44a7e1eb83c2584358fac3e4b6019e9e2cf075eab46287cea9b6d02e6808d1383b1
TLSH
T1F341BEF7C7E4966E890196F0AA186E1BCE1D0915432C3C6AC5D4AE1BD3E2471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 a7cc8072448807c0493763a2a1fa74e13b84815cd971263a0eaf24261249fd0a
MD5 acf1a2aa4ba99402cd5b1dc5e1f9a109
SHA1 46f49c2aacef40236f6d5ccc970a91beb536d88e
SHA512 9881c1224afdb127d4a00604e4a673375e73995c9cb130109383d3d301bd02ae892a5bf1b00f29030edc027571cdd2b3903b551d675efc3e04cffec584e2a746
TLSH
T1AC41AEF7C3E4966E890196F0AB147F1BCE1D0915832C3D6AC9E4AF2B93E2471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 197e781e10dd5f80effffdb6d4bd802e9e4cd744d235db07fa56659156ff83e9
MD5 93b93716a91e245faf348e8a83b7d0b5
SHA1 779182a8f7d8e4b4c52cecc550df29137c58b029
SHA512 f82a04eed4b9a24ef27308e7e661898bbd2758f0a1503795c98affa36320c623e91414d4975de58f65a3a116b309fb05d76fa2441488af3fac58102bd5f032e7
SSDEEP 192:sxRARjbS/fgsLfNhprQ5BzoA8p42/g6+WNIYn83huGvIgDkJ:sxRAhS/fgsbbr3/5ITR9c
TLSH
T14E32C7166A68A93B8CCBD21DFB55BF53D2F9503261D02E58A7FC9A1C04E76DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 d98aec8e48475dac7608d47f6054f28496d4a8d87a2489601091f00b9f4dd8f8
MD5 7ed27aaf0581cf757bfa4e3d73376a17
SHA1 275f2146044df76261334b34a5b827109eee42d9
SHA512 58b664534f7eb462cf0d5cd0dc49538cf5b96f6ee0c906e0c8fd976ac917838c228c9aa4b12734256fc73196baa9d6a38d563552f0e3db5327f7e50a9629c23b
SSDEEP 192:sxRARjbS/fgsLfChprQ5BzoA8p42/g6+WNIYn8QhuGvIgDWJ:sxRAhS/fgsbwr3/5ITG9G
TLSH
T16832C6166A68A93B9CCBE21DBB55BF53E2F9503261D01E58A7FCDA0C04E76CD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 aeb5c99df3afcb37f90a1a0b5d660bca7de9746a458713951361bbfb84134569
MD5 1367500336f6455a10a7ab7c694567a8
SHA1 f81e4e842ba288f116d953cc48fe535710f867d9
SHA512 a943c069fe64e1e9a684ad28b9f4d4aeb66c9681fc1bbb468248ceb4ad6aaefd99c83398c28dda9e805a7c8cdeb9fba04cb47b7ee4e2766dd5bf1d031f5aa686
SSDEEP 192:sxRnRjbS/fgsYfNhprQ5BzoA8p42/g6+WNIYn83huGvIgIJ:sxRnhS/fgsebr3/5ITR9s
TLSH
T1AA32C7166A68A93B8CC7D21DFB55BF53D2F9503261D02E58A7FC9A1C04E76DD220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 d814e673d880474a8cfdf10581ae0fc030607c1c94457d4788009634e57d9b78
MD5 ce42dfea58fb0cc1164988f6ace2cb2b
SHA1 3d1bc79b3596c7ec3b4b0834f3230b298e6ae0ee
SHA512 305f4bb77dbce66d9c3d8746bac36e5ec81dbcb501b826873384bf12e2df95604a74148c4609c6e571300fcea633fcf4e88278892ea646026837e6ad9090131a
SSDEEP 384:wum8dzAfCtgoSFf6MKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVU494oRPPCrohs:wb8dz6Wgouf6M8F1+UoAYDCx9Tuqh0Vp
TLSH
T1D3B2EC3B604DCB7E5F800AADEC19AFDB6D9802C79A988D4447FE950C03C77EA511A4DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8ee8ad58-4f1c-459c-bc95-4ac98d1cfc38\index-dir\temp-index
Size 672B
SHA256 cac478087a9494350c8b07aedf0f4352a4ca303deab889b283ff880cfaa326d7
MD5 feb9b4a56cd8a751297796de62a5bc65
SHA1 112416cce9ea397c2ad8e4847f500bd4a6840246
SHA512 974c1c839ede133fc7d9d5ca8543a810bdbaa0b5893ee6b87441fda63dbd4351d1a7af3e6a1dd117a8c4826de0aa1a8036a1aa06592509ab15a44dcb6abe1239
TLSH
T145015487CCE69847CCA37CBB2A7A218E373D08FE1103CD97005D94358D637388140719
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5e1338.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8ee8ad58-4f1c-459c-bc95-4ac98d1cfc38\index-dir\the-real-index~RFe5e1338.TMP
Size 672B
SHA256 1c8b9e9633110184426e607a638ab2f923c426f3dd2928a9ff409bf78691afb1
MD5 1e4597cec87add2d3feecf0b6a73d3e5
SHA1 93fb476865e80f033c9969822a9f1eaf5c7a3f3e
SHA512 bdc18237f24e686139414bffe82f9726b9d82a4dcdaf627299d6222e58998783b59833cbadaad6d9e16b924090fc873e14618d250abcfa83f6fe712aaea286fe
TLSH
T12701D4E70091EC46DD5678B535155255723E0C312125DA4B21DB787A49727348185A51
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 7c768164c43ba5471834b187a2fc29738753f06027b4397a68f3fc7f9fca2870
MD5 11dd2864c23e806971254a1563ac402c
SHA1 e249164852325181520fbb1322cb722b8504daea
SHA512 daedc7110a63785b16c43aa32395c557219d39526dc8e149aca20b6281d8f2037aec70f0b6d94fd70d89772c98fcf2a4b3b596d32881a40cbabee3470c8dec84
TLSH
T197E020773EF72814ECEFD7DA6832745105507454844DBD4F7816E3D714B236434A9C61
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 995e4a57cc439e3a3f4e430c5cb0d004791797e8ccd0a83086be58258e2d1285
MD5 333251a690a868737009e6c04e12d064
SHA1 112a5528a728e451d2049d1deacf8c9901bd5b08
SHA512 4fcb2d19107b4182e9aa7cd5ce55b077df71bfccc373d1f81dcb2c85a97bac137739c41e49eac546277628fe84f9aa1fe9f0dbe6aacc41aa673d6c0ae38e09ff
SSDEEP 96:KRfItpfd9xWJmsgRxK44g/xcnvOR9SH5WnjRzHDW3EygrDK4aglDcJh8f48nm60p:CfItpfd9cJmtR74g/envOR9SH5WnjRzw
TLSH
T18091F100717A12413C7E7A1D80B5986F928174A6715A693F7BE921B64FA7E028CFDCCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

48f2f001-5442-4e4b-b71d-17e9a3e9556b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\48f2f001-5442-4e4b-b71d-17e9a3e9556b.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 00d4a40e349c94e6e3680b1ff60fa8eec51b4c03e560f1e94a44f30f32d4e06f
MD5 7955ca27865f7eca325cca5eb702dc3c
SHA1 610c5f4bbdf729e4858780ea681fc369900d2db0
SHA512 65664ccefbca1f04cb08005800af86c7ec1033811dd733e1383ac2ae7f4512d793b7c619a91121b2f21a1b896fb483980609c742c33c1646be2988f1d3f76f97
SSDEEP 768:lrv+4UNbdf32WVDZIO0ynfSeNzc4ReyIsP0eVH1S5F:lbsbx3pfSetc44bscEH1W
TLSH
T19E13BE36AC788973ACF66685B04B76537FF8611B82C80A94C5DE5F4C0A8B1DD134F923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 aa73e279b0e6f677667e50ea10ae09073e4483fbca945bb30bffd279d33bf816
MD5 5ef8d93c59de6113f3d05a6be627d918
SHA1 b541972f44498ae0d35315bb3ff4a7e606de584d
SHA512 fb15d3e008b5e6448521bb9c3e1e2730d78fa56c80247b016c26af7c67d9b63775058f698e3671b118e016e57002874fe78dd94aa54fc370e2ee692c2a2e4a2b
SSDEEP 768:Oc3fWVDZIO0ynfSkNzc4ReyIsP02ewBKZOxpn:Oc3wfSktc44bsc2evZ4J
TLSH
T1EFF2BF75AC248D73ACFAA655F5073603BEF49127D1D82DA4D6EEAF0C05872DD134B822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 fb6a0c9e1172ae9f92ff89fa22d7d1be8e9d8a57457aebd6739d0ab8cf8cae0f
MD5 9af4e650234060e9a5a3ab32669aed23
SHA1 685f0e94aba2d453a4fcf53cd8687f33b9305ad5
SHA512 42173d6aedda9414b576cf6cd0af5e49d5eaa38a96dba359a2bd9482a3e27854ca9539d02a5cea8989d094c0eeaf292f3c64333df916327238d1ddf6bc2658ad
SSDEEP 768:oFQq3JwghWVDZIO0ynfSUNzc4ReyIsP02ewBKZOxpn:Lq36fSUtc44bsc2evZ4J
TLSH
T15E03BE769C64C977ECFAAB95F90A3203AEF54167C1D869A4E7DDAE0C01472DC134BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 ea18b375ef215e0e418d0f6de8f2e27280d2c7ec0256dc62d45c79ee807ffaac
MD5 a519757095abc96f2a14a8b8ce8b5e52
SHA1 00fa9a6f7d46dd306ffd4826700e6dc743f92b6a
SHA512 9cff3e31f3974ed1615ee8685b3776de975f9c385f918fa8ab451f740ddf2b3215e0a37d57445cc1eeed23df2b4d6caf1b4ca33e6f4e6353a53642bb19156b98
SSDEEP 768:6rv+4UNbds3gdDZIO0ynfMNzc4ReyIsXTeVH1S5D:6bsbS3GfMtc44bsDEH1Y
TLSH
T1CC03CF36A8788937ACF6A686B44B76537EF8511BC2D80F94C5DE1F0C4A8B1DD130B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

577c3464-dced-476c-b511-d75f8a46f4a7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\577c3464-dced-476c-b511-d75f8a46f4a7.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download