hxxp://namastekhabar[.]com

Analysis

user interaction
yes
max time kernel
298s
max time network
300s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
02/08/2026, 01:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://namastekhabar.com
Sample260802-bc1exsbc24

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3784	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134301060591271978"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{493AD81E-ED1C-4CCF-A62C-2F4E39F8B33A}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5316	msedge.exe
5316	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe
5000	msedge.exe

Suspicious use of WriteProcessMemory 51 IoCs

description	pid	Process	procid_target
PID 5000 wrote to memory of 1304	5000	msedge.exe	84
PID 5000 wrote to memory of 3784	5000	msedge.exe	85
PID 5000 wrote to memory of 3716	5000	msedge.exe	86
PID 5000 wrote to memory of 3568	5000	msedge.exe	87
PID 5000 wrote to memory of 3716	5000	msedge.exe	86
PID 5000 wrote to memory of 3568	5000	msedge.exe	87
PID 5000 wrote to memory of 3568	5000	msedge.exe	87
PID 5000 wrote to memory of 1976	5000	msedge.exe	88
PID 5000 wrote to memory of 5064	5000	msedge.exe	89
PID 5000 wrote to memory of 1976	5000	msedge.exe	88
PID 5000 wrote to memory of 1976	5000	msedge.exe	88
PID 5000 wrote to memory of 5064	5000	msedge.exe	89
PID 5000 wrote to memory of 5064	5000	msedge.exe	89
PID 5000 wrote to memory of 2012	5000	msedge.exe	91
PID 5000 wrote to memory of 3272	5000	msedge.exe	92
PID 5000 wrote to memory of 2012	5000	msedge.exe	91
PID 5000 wrote to memory of 2012	5000	msedge.exe	91
PID 5000 wrote to memory of 3272	5000	msedge.exe	92
PID 5000 wrote to memory of 3272	5000	msedge.exe	92
PID 5000 wrote to memory of 2264	5000	msedge.exe	96
PID 5000 wrote to memory of 2264	5000	msedge.exe	96
PID 5000 wrote to memory of 2264	5000	msedge.exe	96
PID 5000 wrote to memory of 3384	5000	msedge.exe	97
PID 5000 wrote to memory of 3384	5000	msedge.exe	97
PID 5000 wrote to memory of 3828	5000	msedge.exe	98
PID 5000 wrote to memory of 3828	5000	msedge.exe	98
PID 5000 wrote to memory of 5104	5000	msedge.exe	100
PID 5000 wrote to memory of 5104	5000	msedge.exe	100
PID 5000 wrote to memory of 5104	5000	msedge.exe	100
PID 5000 wrote to memory of 384	5000	msedge.exe	101
PID 5000 wrote to memory of 384	5000	msedge.exe	101
PID 5000 wrote to memory of 384	5000	msedge.exe	101
PID 5000 wrote to memory of 420	5000	msedge.exe	104
PID 5000 wrote to memory of 2360	5000	msedge.exe	107
PID 5000 wrote to memory of 2360	5000	msedge.exe	107
PID 5000 wrote to memory of 2360	5000	msedge.exe	107
PID 5000 wrote to memory of 4136	5000	msedge.exe	116
PID 5000 wrote to memory of 1836	5000	msedge.exe	117
PID 5000 wrote to memory of 2908	5000	msedge.exe	118
PID 5000 wrote to memory of 1532	5000	msedge.exe	120
PID 5000 wrote to memory of 1532	5000	msedge.exe	120
PID 5000 wrote to memory of 1532	5000	msedge.exe	120
PID 5000 wrote to memory of 5520	5000	msedge.exe	124
PID 5000 wrote to memory of 5520	5000	msedge.exe	124
PID 5000 wrote to memory of 5316	5000	msedge.exe	127
PID 5000 wrote to memory of 5312	5000	msedge.exe	128
PID 5000 wrote to memory of 5404	5000	msedge.exe	129
PID 5000 wrote to memory of 5312	5000	msedge.exe	128
PID 5000 wrote to memory of 5404	5000	msedge.exe	129
PID 5000 wrote to memory of 4360	5000	msedge.exe	130
PID 5000 wrote to memory of 4360	5000	msedge.exe	130

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://namastekhabar.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffdd527c188,0x7ffdd527c194,0x7ffdd527c1a0
  2⤵
  PID:1304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1756,i,11104926532532363407,1528672727219514794,524288 --field-trial-handle=2724,i,9634664213543618252,8863106788387515435,262144 --variations-seed-version --mojo-platform-channel-handle=2920 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2428,i,18392729395263708344,2771534383931148162,524288 --field-trial-handle=2724,i,9634664213543618252,8863106788387515435,262144 --variations-seed-version --mojo-platform-channel-handle=2948 /prefetch:8
  2⤵
  PID:3716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,9146602342462706632,11693863663494709140,262144 --field-trial-handle=2724,i,9634664213543618252,8863106788387515435,262144 --variations-seed-version --mojo-platform-channel-handle=2720 /prefetch:2
  2⤵
  PID:3568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,11053667018572806501,7408085855441237480,2097152 --field-trial-handle=2724,i,9634664213543618252,8863106788387515435,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:1976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,7450463931845017103,1364854070208708962,2097152 --field-trial-handle=2724,i,9634664213543618252,8863106788387515435,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4160,i,1494497470117349039,2457549839387199017,2097152 --field-trial-handle=2724,i,9634664213543618252,8863106788387515435,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:1
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4188,i,6506013834998869750,6039787432252020515,2097152 --field-trial-handle=2724,i,9634664213543618252,8863106788387515435,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:2
  2⤵
  PID:3272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5100,i,5029807574981748256,5268412166189946556,2097152 --field-trial-handle=2724,i,9634664213543618252,8863106788387515435,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:2264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,3184270570442538468,11454092704339825472,524288 --field-trial-handle=2724,i,9634664213543618252,8863106788387515435,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:8
  2⤵
  PID:3384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5288,i,13230808275353744503,8952288661082362832,524288 --field-trial-handle=2724,i,9634664213543618252,8863106788387515435,262144 --variations-seed-version --mojo-platform-channel-handle=5336 /prefetch:8
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5952,i,1324825210108284753,14284868071940634465,2097152 --field-trial-handle=2724,i,9634664213543618252,8863106788387515435,262144 --variations-seed-version --mojo-platform-channel-handle=5964 /prefetch:1
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3548,i,8340986055203076011,8893216554725251846,2097152 --field-trial-handle=2724,i,9634664213543618252,8863106788387515435,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:1
  2⤵
  PID:384
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,317989347163323528,3421273313768031362,524288 --field-trial-handle=2724,i,9634664213543618252,8863106788387515435,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:8
  2⤵
  PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,317989347163323528,3421273313768031362,524288 --field-trial-handle=2724,i,9634664213543618252,8863106788387515435,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:8
  2⤵
  PID:420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6212,i,8297153853474540509,11036149051225533300,2097152 --field-trial-handle=2724,i,9634664213543618252,8863106788387515435,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:1
  2⤵
  PID:2360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6328,i,3577578006500782242,1475916267048010389,524288 --field-trial-handle=2724,i,9634664213543618252,8863106788387515435,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:8
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=140,i,5522257457739829000,7484368108346958567,524288 --field-trial-handle=2724,i,9634664213543618252,8863106788387515435,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:8
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4240,i,16949695549565411098,7569014133002762209,524288 --field-trial-handle=2724,i,9634664213543618252,8863106788387515435,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:8
  2⤵
  PID:2908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4948,i,13535835992511655152,7672323367304160873,2097152 --field-trial-handle=2724,i,9634664213543618252,8863106788387515435,262144 --variations-seed-version --mojo-platform-channel-handle=5276 /prefetch:1
  2⤵
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5968,i,18265862238432020445,9729489289134938843,524288 --field-trial-handle=2724,i,9634664213543618252,8863106788387515435,262144 --variations-seed-version --mojo-platform-channel-handle=6856 /prefetch:8
  2⤵
  PID:5520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=760,i,8037637240083681871,15813894342327261262,262144 --field-trial-handle=2724,i,9634664213543618252,8863106788387515435,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5424,i,2602960568488694050,15989751928143872151,524288 --field-trial-handle=2724,i,9634664213543618252,8863106788387515435,262144 --variations-seed-version --mojo-platform-channel-handle=5620 /prefetch:8
  2⤵
  PID:5312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5988,i,9783891009517737050,7144595538507588255,524288 --field-trial-handle=2724,i,9634664213543618252,8863106788387515435,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:8
  2⤵
  PID:5404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,302092752517109439,9216082322665655784,524288 --field-trial-handle=2724,i,9634664213543618252,8863106788387515435,262144 --variations-seed-version --mojo-platform-channel-handle=6604 /prefetch:8
  2⤵
  PID:4360

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1288

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 ec7d777e9f82cc87481e9d10104c57698c3c97a34d89b261eeb50f12674e7956
MD5 8aaaf81f3f8900791d26638b9e218183
SHA1 e2f1a9ec6734d72b58ea4e2397ab028e8f07c40e
SHA512 0559cfe716ce981fc50b412d895d80097df3499250d9b944185ce8f2f8e5d8ca563df8795a83c910636b772d5e0ab8a741c9736f5eee5ba6623f2d8051d5945f
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7a:fwUQC5VwBIiElEd2K57P7a
TLSH
T1F9B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

04d71b52-598d-4926-be33-7500c500f368.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\04d71b52-598d-4926-be33-7500c500f368.tmp
Size 30KB
SHA256 982035dc34d6b73be3650c526bd87aa402a6628cde8945ec9386385991526c2e
MD5 e3f29bf48159602777048271bd0cc433
SHA1 5714176376d61e3466a2fbd7d91178469aa317ee
SHA512 f2a1bc404d76b3c5ad4cb32df5826020f8d777cb364afbc3bdf394c91bbe0f5439a59d554d2034a69623e2f529ff6c1208a58ab5c238cf60738ab2050a42541e
SSDEEP 768:pps6pD1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJNqrogq:pps6pD1WvxzWju1jahILIsNBgq
TLSH
T165D2FA3B680CCB7E4F841E5CAC2AAF967DD801CBAB98895447FA444C03C77EA51275DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000095

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000095
Size 310KB
SHA256 ce1715091e5aa1c89042bfbf72b028d0862d7880635c6097c4f8df9689cb4b9b
MD5 d8a6b67b17e4dde7b5ac47e7b16777bd
SHA1 568aa7394d2f44ec8dc04408a9f8fb432d0450de
SHA512 0c2b8e0d8c2762a7861bb9c7094d07c0cd763101d69c50826125516c1288b837bd011bb46bd5a614e972d76d7c9530bef804f3f03a20a128cdc16f79758f461e
SSDEEP 6144:/YCYDnON9YPvaWYf0Wjn4P/im0S09aIeHyxmnqgdsG6Ph2:/EsuPiWYcWjnTAKaIeHyxmnqgdsG6P0
TLSH
T1936423F3DECA884481FA9A7A3A9585C5F44A9FDCD39C3904FDA55428FD924E80FDC808
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 d8fe5f5d4e8dcdb8a733d97757b2053c00927e2d53cf996c080776f4506437be
MD5 890f89f3ea50f6bf73702d5fbcdcacd1
SHA1 56acc04b8f04536d1ff96533b02c7bc56e4a7c57
SHA512 d6b894a05c56f552ea16438afdb8956bb7ecfb8eab028462051cc98eac8aced56b6a82f9bad663b8d037e66151e64ac0062f14519257c123376cca2335b541e2
TLSH
T17281C4750E22C886DBB147F1D4D03FFC71F992B219135EDA1240897D9A5FFA3A138925
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 679e91f73f9bbe5a57534f7171f116d2ebfc42af3c85bb5461e8d7818f4b2e3e
MD5 5cfdc3c5857242c7c16bf505fc9e9e30
SHA1 0469780ee20974fa085fb9ba9f2939f2a54561fe
SHA512 54e111a8491a87116b155c91a8837a011fb0bf6445736c7ef9e65239c4d574a75eaad57bb426ae00f62673b42e139a1899611f132d294bf5ac75dc364a04e82f
TLSH
T15C712B340D22C886E7B157B2D0D13FFC34F980B60A136ECA0240997D9E1FF63A038924
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58bd8e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58bd8e.TMP
Size 3KB
SHA256 4623c0c11d3efd4a224ccd30c44302884d346fd92843120857dc9bb917f6f01f
MD5 d7eb7dab7405d3fd028e2ea5dd86a9dc
SHA1 ec83d97547fefd37c5450cead7d561675705d473
SHA512 3810d3a515a385e9b5e27360a9362ad80e3ec2b333f2b103c3b6731e86069588dfa63e12d6f74e08ae58947d8def56a6c3d69e72161ea079c0ec958304c7ab37
TLSH
T1576109380D22C886E3B117B1D0E13FFC79F991B50E632DC9018499BE9A0FF63A139508
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 6KB
SHA256 d1522aae428b3b4152dc93c74fa87892357cee643e9704c955836d44a8d54c8a
MD5 38cc527be546f0a8b0517f80a32cb92c
SHA1 30c89f72ec01c2756834505335ba5e8ced760f0b
SHA512 498f75821ab1714ddaf4a943b67efa6e8ab558817cc75f513f3ed5c93003b37740bbecaf73989556bd3756131f558a8115b78702f380c66913b0341aad16d5c6
SSDEEP 192:DDty51JAJprJn7c11tgn1f8GNv8I7XVWe0x7PiEyhoP2kPl:DDty5DMprJn7c11tgnp8GNv8IhWZx7q0
TLSH
T15FD156B783D4872DCC6163F0A6246E2ACF2E096543983925C5D8EF5ED3F61B1E28154E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

af854b6c-be88-4399-b1ac-e7106b694383.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\af854b6c-be88-4399-b1ac-e7106b694383.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 0bf3ca5bfe37df3dfde0aa0fadc95dc66d41e31c3ec33bc3783c9e663f0bc8f3
MD5 b0b27cdcd7507c5f340afa1a14d0576a
SHA1 93e79e9772d243cc9f5ed1b22e57119eca6ee98a
SHA512 c52ce4a3ef91017b3d47890890fcc26faa21730ed5c8b9cf1c572fa896d8ed1fc8170d76a64824a8d66626ff85df46b16ea3fcf32ec11db81fbba43b054b620b
SSDEEP 192:sxZsRWyM/jK1Ml8Mk5/f4snGhIdpU3HW6+WNDXt/YLsyTDIg5GJ:sxZswM5/f4snGKaHbR/ms
TLSH
T17A5208116B346977CCDBD208BA45BF53D6F9447392900E58AAFCDA1C04E6BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 7f3a589c1a155c1539fde1eb4f993bce4abf1b970fbc2009141b93ae1c6053c3
MD5 bad0c4b7b178253e5fab3722b6ec1774
SHA1 987557c4854b5a3018b647d4d79dc16499b820fb
SHA512 5f36016b0bdc91cce320108fd879e98c4ddfeee4bcbad751bf06d8c1499798d2ae18bc0a7e593b413174eaaa419ca2765f3758825209653247badce604d592eb
SSDEEP 192:sxZsRWyM/jK1Ml8UQDk5/f4snGhIdpy3HW6+WNDXt/YLW91DIg5GJ:sxZswqo5/f4snGKgHbR/Ls
TLSH
T1A752F7116B346977CCDBD20DB945BB53D6F94473A2900E58AAFCDA1C04E6BED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 9bc9efeb972607841f7c0828076aa6b6dc8222d81b7d28e49b0c89a1348e2ce5
MD5 4783d0d3b8cff2ae194b65f513562f3d
SHA1 69add30e199297ee6c0fae004ced2f3517d995e1
SHA512 610a432a8318cc9b9e57d202a5cd483647da50958b80cf12e3f9949b6722f61363c58c1cad2993bb811bb5379c878d8f995447f8621f4bb485faa722d5b86590
SSDEEP 192:sxZsRWyM/jK1Ml8Mk5/f4s8oCIdpUKHW6+WNDXt/YLy2TDIgrJ:sxZsAM5/f4s8orfHbR/89
TLSH
T1245208116B346977CCCBD209BA15BB53D6F90573A2900E58AAFCD91C04E6BED2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 6bdceb96773836b362d11d7e209a51aff8fc4bda2b7d0e90616a7cc52a29762d
MD5 af05b5a2c656ee70a6d2678d3ed99073
SHA1 39b098312de72cc07ec4d522c1ac88d76fd5c961
SHA512 a268c5a6feacdeb0cf9d4a5ddcbe5983275e6fd19a8f9121863595389dd00295ccacc6e95ae05a3706a9d21c8a6d94b8d091de0f328eb4132929a2f836a09a8b
SSDEEP 96:KUAAKtePbJSKqoCe589p7nTkjn2PdhkKlBdzkRJpW7U:iieBe589p7nTqn2lhFBdz6JpW7U
TLSH
T1F3A1B35236B703123C3E2918E2A487268782FA537018E92F77AC50755EA7E384DFD5ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59400d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59400d.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 8e2080735c647df68ceee2f6092e996b49999c32cba6eeff9e6d2ffad1470b4a
MD5 b2680c74ba7648d3fa6aa1cf599d6e4d
SHA1 cbd9e2f452d4153c0e4718cce5d71d5b969cd521
SHA512 f7454ed85829abc0f3bcaadfacd148eb96fb46f876cad0ec9c42f56506c9b171839320258b0e76ff2bf5f838c1fbb4fff2765feb7a02a5ca2021015efd765cc4
SSDEEP 384:UZcIhsNzpCyySGxa9wvzJrqzHnTKwBODNZOCxKDa:Shvk8h4HnewBKZOKB
TLSH
T137928D725C3C6C765DF2E145F94731179EF88173F9D92A50A2EDAF1C00EA5A81307D26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 cc08ea959ec0b9b0b53d4754b3e06aa80dc93682d158c4280a47fcceec77f9d5
MD5 d6e84d0b86f3caec7fb1165bbab67653
SHA1 13b7813a9028cfcae0b2a68ddaf7a057b0f18807
SHA512 001d4fbcbf75a82fd9a22624ae80f88107772649813b0d81e931a10493d71093751eac8d263857569a8746a8e6c898781638b67ff635a06264beae92498041d2
SSDEEP 384:5iFiZcIQzsNN8TUNTUlIlcCyySkxa9wvzJrqQHnTKwBODNZOCxKDa:QFQMwwgpk8hNHnewBKZOKB
TLSH
T1D2D228F248DB9836DDAE9743A77E2D138EBCC063B4856A50B39D5A1CCC961BFD306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 dede77cf9362f3182a9f645a47b49584fa5772ef725c27922391e2c69a5884d1
MD5 71c267895d4e49812c66e33d4f918c64
SHA1 a8fcb8679abe9096d717bdf5e6f483f940384ce1
SHA512 0f865cbc451fe1746296d90cfc55ba922421c30afe96ddbabc48a602576729676e995cb8bfeb83a207b7514bebc1d140e4a9fd10db45ed37777faaacf1a27b24
SSDEEP 96:nqONkXQsjpfg7+otEol5ih/cIPURHl8h4otop5aJDmB8PHvIVytb0gigBabJxgGx:qONL6O7+3hQmiUyS2Gttb0j3bvgGQ6U6
TLSH
T10102F9357C6C6CBB8EF2AD45F58737235FA5117BA9A62F80D6E81E1C00D766C2343826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 24a1c2e06a14e658d797b198ee37abdbb499d12c4dae98ece137eeec8cf06fea
MD5 703cc8e4b576cde9e7219ed953f2882b
SHA1 83992aad67c18ea2ff68f2029dca6743d38e24d7
SHA512 a896e23addf586b09856df2497a39d359a95d6c3328cec4c0463cefd0532f33f40ed32042d5c50d464605cc1c7389705c220936aa34ca2b673e365b0cae6ddd7
SSDEEP 192:7ONm6O7+3XQmiUyV2Dttb0j3bsuF0SJrqOXcNyqgaU6:7ONm6b1Dt9wvzJrqzHU6
TLSH
T1011209366C6C6C6B5DE2E540F58B32235FB5416BEA8A6F40D1EC2E1C01EF56C2346C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 a0bcc9c68e3c3e51b6d564e912a304bea3aefb1f2e78efc3f7f4b3ffd56c2372
MD5 91695b1206f0ef4d80e59bb254eb4ed0
SHA1 7aa6fe9a0a2e642815d577a4dc7e67d38d872a9c
SHA512 5c998de6c80da1807dde37dcf27cf1a772389bf6155805733915c3cdad50de3dd9a6ec3c6eeb260bb050d718f2fa8336095dc039f89f3b20803feea3a0bc1ec3
SSDEEP 384:dZcIhsNzcCyySGxa9wvzJrqzHnTKwBODNZOCxKDa:Fhmk8h4HnewBKZOKB
TLSH
T105928D725C3C6C769DE2E145F94631179EF88173F9D92E50A2EDAF1C00EA5A8230BD22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

53ab5788-dcc5-4c3f-a5e6-5f24e47553b2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\53ab5788-dcc5-4c3f-a5e6-5f24e47553b2.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 089de1e664b984e837d70a25108bd9330d0a8675d9806f51d16bb89fda12d4a7
MD5 c5290eb0a89f82fb14e769951a410ce9
SHA1 6119ea472135f9d6eccc70b47a105c7ad475ff98
SHA512 98f43715b0b33e532fc6321f1a1303c0f323c557a2ada310ad2f213a04ce6a1a93b389fa5d6db87e11006c9f2ed11d365b201e84fd03dacdaea1b891cdb2390b
TLSH
T10F410C59AAFE1154B3B77E5AAFF6A85D443F78372E06D84D10110E4E0A67A40C872B37
MD5 SHA1 SHA512 TLSH

Submit Download