12201dd26f8effc1f882c4171de6b4cdb5b3b84c1c74e37cf7b2bc29309b99c0

Analysis

max time kernel
899s
max time network
798s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/08/2026, 02:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
email-html-2.html
Size 44KB
Sample260803-ddhydabb98
SHA256 12201dd26f8effc1f882c4171de6b4cdb5b3b84c1c74e37cf7b2bc29309b99c0
MD5 b5a973c63dcaebb8f97db75ed08e748b
SHA1 82ce14cee5419ff80fd1b270bfcf28f12ca273f1
SHA512 d47336372cc700e267251fd8b66e0909478abacc373dea34e9aff4ed654532dbb87d369aefade4c12ae92729643271c3a1f84e72ccaa6f32f5aef5059c834afc
SSDEEP 768:zS05sO1g6ZPtD0Jcnc4unaqys/kXt5sO1g6ZPtD0Mcnc4unaV/ksg5sOWg6ZPtD7:zShgoyNPgwGgW
TLSH
T102236233F7540267A0D712C822F82BD17560C21CE313BC6AB676AF9933C99676B921D7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4596	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134301995938202353"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{32849462-CDB2-42FF-BDAC-1D2BA3CB541C}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3292	msedge.exe
3292	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe
3980	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 3980 wrote to memory of 1672	3980	msedge.exe	83
PID 3980 wrote to memory of 4596	3980	msedge.exe	84
PID 3980 wrote to memory of 4760	3980	msedge.exe	85
PID 3980 wrote to memory of 4760	3980	msedge.exe	85
PID 3980 wrote to memory of 4760	3980	msedge.exe	85
PID 3980 wrote to memory of 1836	3980	msedge.exe	86
PID 3980 wrote to memory of 1836	3980	msedge.exe	86
PID 3980 wrote to memory of 3740	3980	msedge.exe	88
PID 3980 wrote to memory of 3740	3980	msedge.exe	88
PID 3980 wrote to memory of 3740	3980	msedge.exe	88
PID 3980 wrote to memory of 2432	3980	msedge.exe	89
PID 3980 wrote to memory of 2432	3980	msedge.exe	89
PID 3980 wrote to memory of 2432	3980	msedge.exe	89
PID 3980 wrote to memory of 1880	3980	msedge.exe	90
PID 3980 wrote to memory of 2008	3980	msedge.exe	91
PID 3980 wrote to memory of 1880	3980	msedge.exe	90
PID 3980 wrote to memory of 1880	3980	msedge.exe	90
PID 3980 wrote to memory of 2008	3980	msedge.exe	91
PID 3980 wrote to memory of 2008	3980	msedge.exe	91
PID 3980 wrote to memory of 1600	3980	msedge.exe	95
PID 3980 wrote to memory of 4460	3980	msedge.exe	96
PID 3980 wrote to memory of 1600	3980	msedge.exe	95
PID 3980 wrote to memory of 4460	3980	msedge.exe	96
PID 3980 wrote to memory of 4588	3980	msedge.exe	98
PID 3980 wrote to memory of 2604	3980	msedge.exe	105
PID 3980 wrote to memory of 1372	3980	msedge.exe	106
PID 3980 wrote to memory of 5028	3980	msedge.exe	107
PID 3980 wrote to memory of 4704	3980	msedge.exe	111
PID 3980 wrote to memory of 4704	3980	msedge.exe	111
PID 3980 wrote to memory of 4088	3980	msedge.exe	114
PID 3980 wrote to memory of 4088	3980	msedge.exe	114
PID 3980 wrote to memory of 3292	3980	msedge.exe	121
PID 3980 wrote to memory of 4364	3980	msedge.exe	126
PID 3980 wrote to memory of 4364	3980	msedge.exe	126
PID 3980 wrote to memory of 4208	3980	msedge.exe	127
PID 3980 wrote to memory of 4208	3980	msedge.exe	127
PID 3980 wrote to memory of 1736	3980	msedge.exe	128
PID 3980 wrote to memory of 1736	3980	msedge.exe	128
PID 3980 wrote to memory of 2480	3980	msedge.exe	135
PID 3980 wrote to memory of 2480	3980	msedge.exe	135
PID 3980 wrote to memory of 3912	3980	msedge.exe	136
PID 3980 wrote to memory of 3912	3980	msedge.exe	136

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\email-html-2.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff90f1fc188,0x7ff90f1fc194,0x7ff90f1fc1a0
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1968,i,9898501352403299871,7258788309244578920,524288 --field-trial-handle=2408,i,9177937117981793043,1073214676661547425,262144 --variations-seed-version --mojo-platform-channel-handle=2444 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1708,i,16862631949633800677,15478104533998407562,262144 --field-trial-handle=2408,i,9177937117981793043,1073214676661547425,262144 --variations-seed-version --mojo-platform-channel-handle=2392 /prefetch:2
  2⤵
  PID:4760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2484,i,10307747305269936675,11371861085826822617,524288 --field-trial-handle=2408,i,9177937117981793043,1073214676661547425,262144 --variations-seed-version --mojo-platform-channel-handle=2504 /prefetch:8
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3480,i,5046801941147488166,16639212386792442924,2097152 --field-trial-handle=2408,i,9177937117981793043,1073214676661547425,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3488,i,7823928371117996984,550344840322102357,2097152 --field-trial-handle=2408,i,9177937117981793043,1073214676661547425,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4280,i,1392949613942426561,13974189867648155117,2097152 --field-trial-handle=2408,i,9177937117981793043,1073214676661547425,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:1
  2⤵
  PID:1880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4320,i,1940643940388873125,4963791117567816494,2097152 --field-trial-handle=2408,i,9177937117981793043,1073214676661547425,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:2
  2⤵
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,10917788440859108340,16575722698663875212,524288 --field-trial-handle=2408,i,9177937117981793043,1073214676661547425,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,2577585728306802604,4587004938323113387,524288 --field-trial-handle=2408,i,9177937117981793043,1073214676661547425,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,6353644786687457707,9717249537063636017,524288 --field-trial-handle=2408,i,9177937117981793043,1073214676661547425,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5896,i,6353644786687457707,9717249537063636017,524288 --field-trial-handle=2408,i,9177937117981793043,1073214676661547425,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4336,i,8070880001124029451,8117043393221435978,524288 --field-trial-handle=2408,i,9177937117981793043,1073214676661547425,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:8
  2⤵
  PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4576,i,9753774670742174672,2529953785929526657,524288 --field-trial-handle=2408,i,9177937117981793043,1073214676661547425,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:8
  2⤵
  PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4580,i,7117084997647921841,1570996836556728386,524288 --field-trial-handle=2408,i,9177937117981793043,1073214676661547425,262144 --variations-seed-version --mojo-platform-channel-handle=6016 /prefetch:8
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5216,i,8208087804636667468,18070949021843983733,524288 --field-trial-handle=2408,i,9177937117981793043,1073214676661547425,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:8
  2⤵
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2944,i,11220061797667834831,5717289634131184257,524288 --field-trial-handle=2408,i,9177937117981793043,1073214676661547425,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:8
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5172,i,1047975949743122129,17614949179714055473,262144 --field-trial-handle=2408,i,9177937117981793043,1073214676661547425,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,15409992461981227163,14459441486010184134,524288 --field-trial-handle=2408,i,9177937117981793043,1073214676661547425,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:8
  2⤵
  PID:4364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5528,i,1150609952516539216,5372131809846511270,524288 --field-trial-handle=2408,i,9177937117981793043,1073214676661547425,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:8
  2⤵
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2976,i,16150188755819580131,9643711219483091473,524288 --field-trial-handle=2408,i,9177937117981793043,1073214676661547425,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:8
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5952,i,18216873407875714325,4742669266006331372,524288 --field-trial-handle=2408,i,9177937117981793043,1073214676661547425,262144 --variations-seed-version --mojo-platform-channel-handle=3108 /prefetch:8
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4008,i,11099420714036478297,5400839046912757537,524288 --field-trial-handle=2408,i,9177937117981793043,1073214676661547425,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:8
  2⤵
  PID:3912

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4148

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cc11c2ba3ec4cb292b61dd36af338e083bb0ce5868e654b17f3c58ecf3c8fdfb
MD5 22bfe5ff5070c92c37e54f6f278efd25
SHA1 2fc94025f3a738879f1fcececb95937cbaa0cdd1
SHA512 b57abd220e674cf733b39ea299fc66d6fe964ab448ae0758482efe80597e3678909cd989b9635acc0317001af0fe6dbbbccfd3cf110ec5ad1b9e4c084de22188
TLSH
T16FD09220B719A2C3E24704BA94A6AB52A916C57AA0B7F7017232640CAE65089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 201729318e073e437978c4f830a6df095e397d14193bbab8cb94016e3e0e1540
MD5 038903102cb76ddedd18207430e00005
SHA1 e694b970e01eb43fddfb00d36857e2b64f8c931b
SHA512 bacb50167c8d736bccc259f2ffbffff915c7c6dc188c6c2c1476ded8cbd822ff968f690173d1b8e35c352ec62f9ace3913a556b80bc1a59211be000ee9ea7447
TLSH
T17DD092207759A6C3E24704BA94A5AB52A916C57AA0B7F7027232640CAE66089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 cfacea2fd0c03c283082700b5db4a19c18da76bbd433408e6e78b7ec8658fecd
MD5 871aa42bdf7426a6839287061d4be1be
SHA1 ede1872c3d78a7b0ca3bfc8b8d5cab5866eedd71
SHA512 706cb9e571f923a629707dc7b3ad1b85f5ae16e974c4915bb71f6b30037ccc53395c2c540ab30d185bdc54afe8988f3af232c1d37a00017f61eb980fca0a30e0
TLSH
T1CEE0268A14C8C2EEB600AA8B73AB534CC2D4770FAAC8A91E1708848E7042050E282AA4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 5c4b1d4e0fb0443746ec6a637382180e263cc0be0b3560c99ef0b3950590887e
MD5 f2370a8f33cb3d36ddaa91d13e8d8179
SHA1 6edaf9795c4176c2f76115d0ce49d4003cba206b
SHA512 0eec86466a7e9639e277f0da567fc6a34acffbbaea8653553b6e7ddcdf77c238aa7048afd201b35d7521b9df56b540362710dca842f46b658f6705e1c3dba75d
TLSH
T1B9E0268514C8C22FA614B54B527C874C82C1F64BAEC8AD1E170CCD897505440EEA2FAC
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 c97f82e8bbc5ded641cd589ff989e813b0b25176c68636fd40fe3700b67af31b
MD5 7aa100785c68f0d979ae61eab8795065
SHA1 2fcee1de19175e2b058a1c41be95afd2228c51b7
SHA512 f3d10829c29c5cc3efece858db4fa18bc2b66d6acf23ffe3e36f094b1d5fec3e5cf8aaa82e0dc842feae533a64133a55cfedfb322e00ceda534bf7ca41887197
TLSH
T15FE0268424C8C22EAA10748752B9434CC2D0B60BAACCAA2A672AC88E74050D4A393EB0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 2578feaa089519a16dd563cc56a7aac249df4ac1dc4b5fc75bbac4f5e63b6f5c
MD5 b368e64a85ae096b7ae356d7200f0372
SHA1 473392f925d09db87f3c8e8f173e513dd1d6c00d
SHA512 a44dfa2e8cbc39081acd8e16b17663a4391adad4bbff9d5c16544617df3346e0bba966530e9158e35c836a9e2a45e8e1104d4bf208c4159dd213d4a470b73df4
TLSH
T130E07DA414CAC3AFF600648B5178430D82C1B70FEAC8E91A7F00C4897883458F6C2EE1
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 dea493be94e882aa12e0477c987702df09e2d992282356d11c23a170b7ad91d0
MD5 c923c29fe30e64ae58743e888124d16f
SHA1 7442d485227965ca2ebfd528cc3922f337b223a6
SHA512 5fdc304558132cb4908599350fafc7bb3b0d04d5a28aa8807914591dc4e91d389ac9271df4f112ac9ed489b60be799eb7fb0bd305c0078bfd630cf5fa9f3310b
TLSH
T19B71403D192609A1D3A1893278CD12847DB1C9EEFE336DAE0179FA74E50D71B812F0B8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589a86.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe589a86.TMP
Size 3KB
SHA256 f57622910c640a91043489cb95f279007f31c5a75854c47cdfd3b052128fa667
MD5 a35aea3eec5d4e7e5b9a70784a7f3b10
SHA1 3afd8c039c2c41ac2ff9a4bc8c0550b73a4b649b
SHA512 78dbfc83b1041e8b9a6c39c50dac33e638af966cc44a6e82f0344eedbb5104bf1710fd2926e4de22fd417ec4a51db9524dc7b063867bf2c512f2adc1dac66a25
TLSH
T17C71413D192609A1D3A1883278CD12847DB5C9EEFE336DAE0179FA74E51D71B912F0B8
MD5 SHA1 SHA512 TLSH

Submit Download

d73f47cb-1dc1-46e8-aac0-1878998fb432.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\d73f47cb-1dc1-46e8-aac0-1878998fb432.tmp
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 966B
SHA256 3af47e8aa0968f3093a9a7a8dc2f94436ceb1d5ee837b9ea77f2a9a6ffab1b31
MD5 c2d598c3ab520dede0b2fefd019519a3
SHA1 52db2eb30c299f4833314741ea69b5b789f5c4e0
SHA512 edf8485027150e735cb6552a7a4680d670ec8e152bd2b37e3555f21641f556318686af8405f9344d5bf927a98530140afd2a80530c6552f30eb2b1d47bee8913
TLSH
T1B51138B387E5859E891116F09A28AE2BDE2D0506821C7D6989D4EF27D3E3075E102A9B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 d5a9618c584dde078fbba16b537aa81e8efc3a60f4c1b7bea9e2391711bbbd0b
MD5 addcf87a8f146fb16ffafccebaf68ef2
SHA1 b1a27b28faa74c99282a0f7a50b25c4426a154cd
SHA512 25f6d3e2fa9c55ea63e13f7ea58801603ef377ee015ed3c93d2348cf41231e2aa3798e139b85e75b9fd9bb707587884bacdf9a01358bc0023693c32793ba976d
TLSH
T11B1138F783D5856E890156F06A24AE2BCE1D050682187C1589D4EF6793E3065E10255B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 854e699cfb4c7b5f8636f764f46ff020f0b9bee3707bd95c7d43646b2403efa1
MD5 0c48b84b2862f4f263a1a27716284c05
SHA1 699c4d22a39c31f64963b7625be3e05fb5455538
SHA512 10cc488cae545041093cbce597314e0800a57ae48a5d44f766f6d0159edaa453da54f5dbd48e13bf40c6e0ac4ae3966ac1f2f74701b874084359cd546048f5f8
SSDEEP 192:sxZtRRkX/f3sUKQMIdpd7HW6+WNGYIkV++ZXIg5vJ:sxZtEX/f3sUKQVZHbGni7
TLSH
T18922A6126E38A47B9CC7D21DBB15BF53E6F95032A1941E58EAFC961C08E7ADD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 55209e8f9b7f1ae616ab41db63da0b2436e889868372f93e032eaca6797b1836
MD5 e41a18d9d6a4390c0a635ca903edeb91
SHA1 6eed4bc143eb62ac635de494af9486e5092b3381
SHA512 531bf86e536e9afc86e09138c810c75d5b4bc24aab793aa9e98500be9d48a00c8547b158cfa63291c1b4e630b2a8e9894d7f675fbb4063eaff1d857293f948c1
SSDEEP 192:sxZtRRkX/f3sUKpMIdpd7HW6+WNGYI1R7++ZXIg5NJ:sxZtEX/f3sUKpVZHbG7Ii9
TLSH
T1E022C7126E28A87B9CC7E21DBB15BF53E6F9503251941E58BAFCD61C08E7ADD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 4b9f65fbe115cfccec05695b914849d03f0dacc37fde51ef78827ff0dd81c901
MD5 c01392b20f1e13f3fcbe2aac37ae73af
SHA1 83281a93a5d630381219c53b020ffe3953504086
SHA512 34c11095b9c41f718160007fc22b74ed32ae3e3eb948b24ead092c065b0e708face2854a0ee0e178314df21686c8d3964f9481d3d6bcbea8eb6a65e265176ef0
SSDEEP 192:sxZtRRkX/f3sjKQMIdpd7HW6+WNGYIkV++ZXIgrJ:sxZtEX/f3sjKQVZHbGni9
TLSH
T1B422A6126E28A47B9CC7D21DBB15BF53E6F95032A1941E58EAFCD61C08E7ADD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 1d8ce39cf486e5037ae3a19b27ce43ade56e460cea568da9ec76e9bceebc60a3
MD5 e1ac090c2ca73c88bfc89724018e7166
SHA1 8b76fd3dbfff824f3f3e4558d9811a1cfe287e61
SHA512 dfd294b75da84b6df83a807726a2c5a03ddae2f42e186042fa053d77ddbb431e46a5ffd8b8b1142d6bda8eb393c3faf98f4c705a72173dc5653eea7dd627d980
SSDEEP 768:knyqbblWvJDjT8F1+UoAYDCx9Tuqh0VfUC9xbog/OVE4Ll6AR7/roQcU:knyqbblWvJDjTu1jah4LAs7sQB
TLSH
T176C2F93B654CCB7E4F800A9DED5A6FD73ED801CBA6588D4047FA994C02C77EA512A4CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ee743e92-8f67-4188-9bcc-a865d9829eff\index-dir\the-real-index
Size 1KB
SHA256 21ab22917affe966bc880e91e5db1c6c09e66596ffcc5343876c6bf8f04f4bd2
MD5 a21b0fc0b5de47582f5b893fbd4d13d4
SHA1 6d02e448caf8ff9795ec9d9f016bf2f5fcddd570
SHA512 3fc9e0d45b77493e161f00323ce08717a25b3ae80287b510050f016436636eb5935c74dde92af9faaffa63555c1c742e606819f01008b39afee0d97b2ef8de3c
TLSH
T1AE210EDD4E91554FE9A549B31072A1E033B0C9CC6F11E3535C7C32772C223892A4B1C4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ce026.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ee743e92-8f67-4188-9bcc-a865d9829eff\index-dir\the-real-index~RFe5ce026.TMP
Size 1KB
SHA256 9f541f3c422597b1782acd7f9b7becbb75fe9fc2d8116acf6dab0de0964bc160
MD5 95011ff487a4ab2007748f955b8dcb1b
SHA1 d7d51a3aad541aa4fa36e6258a2eac350a40002a
SHA512 770e300b9486d6b6c196d7ec69e8933ce80fd9dc304f4b48c2a134ce3a8edf25c47b6db546a91aa6ffdfd70d8985d42b26a8274aef6be8a047577c961063c232
TLSH
T11E2140CA87A24A0FECE040B60553A4F83374C9006722B3D3A879633E5C3679E2E8B0C5
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 5ee01528dfe041ac332d549a75297dac7c61a291cdeaa57aeb2cbb943994fbab
MD5 d38b0b7143a2bd7bd1c7e663bde1fdd0
SHA1 63bebc8b4913f2529b51c9fae2cae04e0709e485
SHA512 bdc73dd36e27484b0d307d7b9def0c43536b6a9754b119328d40c96234e82acc71aed681be045a2a95e9d48d53bdb9c187e94874c56f99616c5f9132c1393b4b
TLSH
T13EE06FBA2AE70800A8ABC7EE087344A64410F828C8A1EC4F1029A28750622B02822C26
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 2190e79cb9ad9bca4fd29fca19f064bb67f6736f808c58d7be6af4db0ffa2bef
MD5 56611e37569f1752b161b4ba08b956e6
SHA1 ecd890db9126d251bae8f8b0e814bb47bd3752b5
SHA512 a5dad6273df9c57fff0b9d51f3315a3494c6ff3328a2db0856b30bbfc86aefbe8c58b62ae913a4fe19e0bbd4748b7e59e060bfe26fb47c2f08108bda4d856f36
SSDEEP 48:KPYNs4iCiac6vpI9IaKGveOaS4K7H2oTyuEVQUK+agembzIfcgKU1cCgAswpLikT:KYbaKYIKOfuKQY+S2gKnK+
TLSH
T188914416757E0342783D2998B3AA99374F4532A33019A4EF3FB850624E66E120DFDDED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

72c4932d-e6b9-46cc-af1d-cb91eea879f9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\72c4932d-e6b9-46cc-af1d-cb91eea879f9.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 c9727e0be12f097236ad2d66cd674a470babe6d2e1f072cd011ccf9a2536dca4
MD5 ba4bcd32b9640433319999b6a8dade57
SHA1 9041bddd482bb211db296301bbe2b637d712818d
SHA512 f2b82cb69da175cf90bfd807c5510cec280640a30a14001c2caafd32c2b84e244732a25ae0a8b0f45601e22c804ed1515c9d2b3e4ec1740e22ca5a2530f94b37
SSDEEP 384:7ZcIhsN4UjjGbvmGVRNT6b6x6HlytEDq1kAKDw:jhkkHT/xoy6DqTj
TLSH
T1C9928D3158341C3BADF7B515F88B36135EF89037ABC82E90A1ED6B2D05DB5E9130B925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 ae4ceac04367e90a293b6be4dadc7f1d4bb40e076228ac65a2fdaef74b6cb8fa
MD5 74029aadc49f2b7d887ca73f0338b351
SHA1 2f213b9e37cc4949a85b345674b71c8938c8e5eb
SHA512 27d2c8a135492ac7477c2c673db5ef0d1fe44f4e3e8878535957b4bd7e046cb0d7137daec21552b08e97729a9a952080cb30e1a353cbe2c6201cd35e353aa76c
SSDEEP 384:MZcIhsN4UyjGbvmGVRNT6b6x6HlytEDq1kAKDw:ahxkHT/xoy6DqTj
TLSH
T1F2928D3158341C3BADF7B515F88B36135EF89037ABC82E90A1ED6B2D05DB5E9130B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 e11510241aaa1a82f0aab9b5db668eb05e36147906aad6f7bde1a58707961f88
MD5 8f2339f373f74f672cb9904222c35b4f
SHA1 58c1a812de8eaaa9f5efcdcacfb13f27fbce4439
SHA512 5f555b4cb71a28eb92dd0a1b349c861d840f2ffa9ffcf55cf219f19d3ff59540a87bbe9cbe50248d95fd25c8e22a2898431b1edf722231e4daf90d38e0be17a1
SSDEEP 384:ziFiZcI+zsN58TUNTUlIlyjGbvmGVRNT6b9x6HlytEDq1kAKDw:eFQeUwggkHT+xoy6DqTj
TLSH
T1D9A27E334864893FEDF7AA15F88A31139EF45077DAD8AE90B2DD5E1D009B1E8130BD25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 243407f223c54d19c01454756a5f8142bd6154335b179a48578b829416a7c2f3
MD5 cc49d1a9ec5cd3c940215f9209dc3f56
SHA1 9fd121e7e27e8a48dde45df9ac27defdec1c3b19
SHA512 e921690da1cc0cbcb053ff490d966d5b942017e0ca6ea46e2acf5fe101c404b8b7d1ea263d82ebb5faaf3f1eaed99509e2b820600f5aebec93b44e65edfe9a83
SSDEEP 192:tONb6JkRtQmiUytbW+RNKFCk5dZDh3LREU6:tONb6Ur+W+RNT6bVmU6
TLSH
T13202E935AC386C7B9EF3AE06B48737275FA4117BAA952F40D6E81E1C00D765C234693B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5d201ea219ef58da0c15e72b45edb2ecb5388c18876ece51f9fca7570a696090
MD5 3b429d7964617ad16b0fb266fab0cc2b
SHA1 2c0316a5393e9f2e6ae4cb752e09b3cffee0049d
SHA512 f709d48b23a2ffd5f942bbd826de0e47458c044fbbce0b8d2a2993b4948539150c70b00045a5b638c53d8c18366f30ce4895a18808346928068544a2b0dce00a
SSDEEP 192:uONy6JkR7QmiUy0bS+RNKFCk5dZc0vwVc8qYIU6:uONy6UtNS+RNT6bbxU6
TLSH
T19F120B36A8385C7F9DE3A905F48732135EA5526BEB897F40D5DC2A1C01EF99C130A92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

75680e57-53ae-4e58-b0f3-c87ea5ba4e07.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\75680e57-53ae-4e58-b0f3-c87ea5ba4e07.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 bf30e662e1315a53f51334f78b5fdb144540ee5e18353e4e3fb5276bf496a4f5
MD5 72016b5a56daf34c7d2a273ba1a39f80
SHA1 3575f2c4bdc1be340a22edb1c79a53c9e5e4ae43
SHA512 503e2b658add16868aa688cd7bb0bd384734624811af65c4b0a6e1d77ae6b63df3e33a32a25b86d820a244a632336dbb473897db208979aa183cd7ea9b60cdd4
TLSH
T14041F85DAAE91104B3B76F569BF668AE487AB9772F06D49E10110E4E0A22B40DCA1733
MD5 SHA1 SHA512 TLSH

Submit Download