hxxps://app[.]connect[.]awspls[.]com/e/er?s=893759278&lid=173884&elqTrackId=4CD710EB1C2828CF0415CA76E6AE1986&elqcontid=45988659&elq=4f0e540a7dc64860b8718d030e0d000f&elqaid=237967&elqat=1&utm_campaign=53171[.]001%20-%20SAS%20-%20Referral%20Campaign%20-%20AIDA&utm_medium=email&utm_source=internalemail&MAC=&elqContactId=45988659&disc=&elqCampId=213212&utm_content=53171[.]001%20-%20SAS%20-%20Referral%20Campaign%20-%20AIDA&elqak=8AF5AE30CCD6463F0CEEC4CA01051CFEB618320A456201EC8706C50A033037E97A91

Analysis

user interaction
yes
max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/08/2026, 05:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://app.connect.awspls.com/e/er?s=893759278&lid=173884&elqTrackId=4CD710EB1C2828CF0415CA76E6AE1986&elqcontid=45988659&elq=4f0e540a7dc64860b8718d030e0d000f&elqaid=237967&elqat=1&utm_campaign=53171.001%20-%20SAS%20-%20Referral%20Campaign%20-%20AIDA&utm_medium=email&utm_source=internalemail&MAC=&elqContactId=45988659&disc=&elqCampId=213212&utm_content=53171.001%20-%20SAS%20-%20Referral%20Campaign%20-%20AIDA&elqak=8AF5AE30CCD6463F0CEEC4CA01051CFEB618320A456201EC8706C50A033037E97A91
Sample260803-gl82basxbv

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1952	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302100975916399"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{E56D4F5C-79BA-4B08-8B1E-65DB4302D68A}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
860	msedge.exe
860	msedge.exe

Suspicious behavior: LoadsDriver 6 IoCs

pid	Process
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
4	Process not Found
668	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe
3816	msedge.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 3816 wrote to memory of 3868	3816	msedge.exe	86
PID 3816 wrote to memory of 1952	3816	msedge.exe	88
PID 3816 wrote to memory of 4564	3816	msedge.exe	89
PID 3816 wrote to memory of 4564	3816	msedge.exe	89
PID 3816 wrote to memory of 4564	3816	msedge.exe	89
PID 3816 wrote to memory of 2480	3816	msedge.exe	90
PID 3816 wrote to memory of 2480	3816	msedge.exe	90
PID 3816 wrote to memory of 1644	3816	msedge.exe	91
PID 3816 wrote to memory of 3008	3816	msedge.exe	92
PID 3816 wrote to memory of 1644	3816	msedge.exe	91
PID 3816 wrote to memory of 1644	3816	msedge.exe	91
PID 3816 wrote to memory of 3008	3816	msedge.exe	92
PID 3816 wrote to memory of 3008	3816	msedge.exe	92
PID 3816 wrote to memory of 2940	3816	msedge.exe	93
PID 3816 wrote to memory of 756	3816	msedge.exe	94
PID 3816 wrote to memory of 2940	3816	msedge.exe	93
PID 3816 wrote to memory of 2940	3816	msedge.exe	93
PID 3816 wrote to memory of 756	3816	msedge.exe	94
PID 3816 wrote to memory of 756	3816	msedge.exe	94
PID 3816 wrote to memory of 3040	3816	msedge.exe	98
PID 3816 wrote to memory of 1496	3816	msedge.exe	99
PID 3816 wrote to memory of 3040	3816	msedge.exe	98
PID 3816 wrote to memory of 1496	3816	msedge.exe	99
PID 3816 wrote to memory of 2084	3816	msedge.exe	101
PID 3816 wrote to memory of 1836	3816	msedge.exe	115
PID 3816 wrote to memory of 1836	3816	msedge.exe	115
PID 3816 wrote to memory of 1836	3816	msedge.exe	115
PID 3816 wrote to memory of 3144	3816	msedge.exe	117
PID 3816 wrote to memory of 5084	3816	msedge.exe	118
PID 3816 wrote to memory of 2084	3816	msedge.exe	119
PID 3816 wrote to memory of 1552	3816	msedge.exe	120
PID 3816 wrote to memory of 1552	3816	msedge.exe	120
PID 3816 wrote to memory of 4572	3816	msedge.exe	122
PID 3816 wrote to memory of 4572	3816	msedge.exe	122
PID 3816 wrote to memory of 4572	3816	msedge.exe	122
PID 3816 wrote to memory of 4332	3816	msedge.exe	123
PID 3816 wrote to memory of 4332	3816	msedge.exe	123
PID 3816 wrote to memory of 4332	3816	msedge.exe	123
PID 3816 wrote to memory of 860	3816	msedge.exe	125

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://app.connect.awspls.com/e/er?s=893759278&lid=173884&elqTrackId=4CD710EB1C2828CF0415CA76E6AE1986&elqcontid=45988659&elq=4f0e540a7dc64860b8718d030e0d000f&elqaid=237967&elqat=1&utm_campaign=53171.001%20-%20SAS%20-%20Referral%20Campaign%20-%20AIDA&utm_medium=email&utm_source=internalemail&MAC=&elqContactId=45988659&disc=&elqCampId=213212&utm_content=53171.001%20-%20SAS%20-%20Referral%20Campaign%20-%20AIDA&elqak=8AF5AE30CCD6463F0CEEC4CA01051CFEB618320A456201EC8706C50A033037E97A91
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ff85a41c188,0x7ff85a41c194,0x7ff85a41c1a0
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1932,i,8741613855933330684,9525788286197140733,524288 --field-trial-handle=2220,i,14287731417721406884,7946743873736721731,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1644,i,6423907400493189030,16290122745851723113,262144 --field-trial-handle=2220,i,14287731417721406884,7946743873736721731,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:2
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2532,i,17765852351476580038,2044622745104633770,524288 --field-trial-handle=2220,i,14287731417721406884,7946743873736721731,262144 --variations-seed-version --mojo-platform-channel-handle=2768 /prefetch:8
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3412,i,2065755191208424985,11574140693384205608,2097152 --field-trial-handle=2220,i,14287731417721406884,7946743873736721731,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:1644
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3416,i,18065264540194605525,6933062736923832467,2097152 --field-trial-handle=2220,i,14287731417721406884,7946743873736721731,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4172,i,16213286164223561004,4374717509874773617,2097152 --field-trial-handle=2220,i,14287731417721406884,7946743873736721731,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:1
  2⤵
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=2624,i,13541181165331503782,3024614557096476120,2097152 --field-trial-handle=2220,i,14287731417721406884,7946743873736721731,262144 --variations-seed-version --mojo-platform-channel-handle=3384 /prefetch:2
  2⤵
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3608,i,15942536814556565567,6831442331579588785,524288 --field-trial-handle=2220,i,14287731417721406884,7946743873736721731,262144 --variations-seed-version --mojo-platform-channel-handle=5132 /prefetch:8
  2⤵
  PID:3040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3596,i,13569011114715220258,794752942899781053,524288 --field-trial-handle=2220,i,14287731417721406884,7946743873736721731,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:1496
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,15350391941375231617,6599183809500327384,524288 --field-trial-handle=2220,i,14287731417721406884,7946743873736721731,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:1380
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5824,i,15350391941375231617,6599183809500327384,524288 --field-trial-handle=2220,i,14287731417721406884,7946743873736721731,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5824,i,12518440422443446734,14254144128019702784,2097152 --field-trial-handle=2220,i,14287731417721406884,7946743873736721731,262144 --variations-seed-version --mojo-platform-channel-handle=3548 /prefetch:1
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3496,i,3004166655011804871,9040221722004170314,524288 --field-trial-handle=2220,i,14287731417721406884,7946743873736721731,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:8
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3512,i,16166946180251525870,14372467252609185181,524288 --field-trial-handle=2220,i,14287731417721406884,7946743873736721731,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:8
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3416,i,13801113063882477753,69869526875040613,524288 --field-trial-handle=2220,i,14287731417721406884,7946743873736721731,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:8
  2⤵
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5212,i,6325352698399233778,15889360674156756474,524288 --field-trial-handle=2220,i,14287731417721406884,7946743873736721731,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:8
  2⤵
  PID:1552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5112,i,5298048647664586998,15582871668126812286,2097152 --field-trial-handle=2220,i,14287731417721406884,7946743873736721731,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6296,i,6754136327955785152,3226910914733576563,2097152 --field-trial-handle=2220,i,14287731417721406884,7946743873736721731,262144 --variations-seed-version --mojo-platform-channel-handle=6380 /prefetch:1
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6544,i,11106160894401335582,9269414929752630837,262144 --field-trial-handle=2220,i,14287731417721406884,7946743873736721731,262144 --variations-seed-version --mojo-platform-channel-handle=5440 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:860

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4304

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 81b365ea82409f1ccac31c98ea2ca4cb0be5b910a6b11b18a5c9be98e7453029
MD5 37a277076f38a82edcb5a0af5f60a32c
SHA1 339819b250b6da12057b67147abd36254c573078
SHA512 9e636589953c256d141c7fa0e049bee89baaf40dc67e09598af97004f3b13f57e1f222db27a50ded645e94d608a67a2b2df8f4c430c6547b29ed44a1a383327c
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7Z:fwUQC5VwBIiElEd2K57P7Z
TLSH
T100B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e2b315c59b1bfe8e547b0017a92548af7c81e08409e987a2628ad74667b4fec
MD5 7ab616f55807e9de5195a40c50f65e5b
SHA1 917a7797f800e5f30a1b9b8125127968246d7ce9
SHA512 da10f29803a072f42a2c102da0bee745cf1b1d47836e3d30e38b1e66beeb1abeaf2eb47b6c07b23682098f70fe2a4b29a0777eefa1380d0fff2509ff32d9b356
TLSH
T171D08023771D7182F35B41759053D7025A1680756463B701B325D41C9A740C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b976ac8901ffd41ec02a04aa583bc9d11350f0f9f714fb92d3341bb0bde4629f
MD5 504ce80b644a85a7e68d85bd24169289
SHA1 1f740a722dfa97fc8fb30626b0e3d6217e4a9864
SHA512 9406464a4f6becd85591c12af8a97fdecfa2208649138f347fb50d3e28f1583adec061050924fa0405e46eb75af7e299e6564c2ed039db9d82c50326da32a3c5
TLSH
T19ED08023371D7582F75B41759053D7025A1680756463F701B325D41C9A750C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_000095

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000095
Size 331KB
SHA256 db4ffbf0ec662620013dc14bc1268bdad6256d19d7d511ec7eff8446887e6900
MD5 05ef8155cf66131654d3bb9c9cba5853
SHA1 e79d53fcb604921222dd1dbc2f1c10c631ff6075
SHA512 ee38793245d91683ddb1f847e5b56a09864fd32ec059055459b3ebe101abed79683ee59c80f30b8f6249d2bbd83fbf7bca83dafb4ef2b634ceff6969c80fed23
SSDEEP 6144:FljUD58FLTW53eaLkNv+Ps0dj1fpqaGjYf0NIcB3bM1rJZ24:FDm5uaLcv+PFj7ajJNImbM1rD
TLSH
T1247423A9B50E3C8AC94F9473827EAFD2A4356FF38D47BAA3634241F401874342E4676D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b8837f01ccd23c9a4a693ea78a7294007391129a738c74b999b25ddac1e37705
MD5 50ae8b864013e8893c1ccc81b5f74754
SHA1 1d8850cefda8838383c77c8a10158d5098011ad2
SHA512 2929d35ccb80611c6d9f67fed97167089138098e3378ed26085d21f5941cdb4778d06f4f40645c29e1b5b576b8be302701e636849157de122f71ac6145701b45
TLSH
T1927161BC020701A1E356933AA8D3C1D63CF18BCAF96BEDE61110D4BE26D57618278F50
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 bb9f75fd80725ba0292b17f5fe6dce50f2bded5a0244c40ed975e9b6dd81164c
MD5 fc11608ae36fd3c7db868c1a77b001cf
SHA1 28112b4b0fe2ddcb49ef631a8fdcb386a1346a4f
SHA512 8d1b3030a464cb9ba74766c3deb4ef3e4574eed60761056ffc158891939e776551e125a92b7ccca575454653aed213e21f527224181c2abbb25fd205d88b0622
TLSH
T13A7162BC020741A1D351933AA9D3C5D63CF18BC9F92BFDE65220D4BE26C67614174F54
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 1378a0d8cbf0525420b21f48ffd1b6527f990836ed3ad81c83c67aac3c5719d2
MD5 cf9a8e5885f0591f02f815b4afc157e9
SHA1 e240851eb8e3c052672190d77211c21c8a6b90d7
SHA512 b453bcc321d27ab390f409b805adcf8895030b0000873435e72a397b4de4701f4bfcd5db7fce3ec8c32ef98c4f583bd6488ab165b31050a742c394beb19d22d7
TLSH
T1F88140BC024721A1D7525376A8C3C5D57CF18BC9F92BEDE71220D4BA15DA3B18274F14
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58b2e0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58b2e0.TMP
Size 3KB
SHA256 5e6cb5c28381389e02f43f47c1cd344760a9bdb7b71b98c799bd169ac5d042be
MD5 9c8b2d5197d0101e7e318b2a92e10fb3
SHA1 26f7acdf2ebdde55689ad405714d6e0b6fa9e25b
SHA512 29255e10e607f5dbade92b53e058d855b9af5a6df00f278e2a71e8c668d7d828b3213ab1b914cce7c61796111545885bf31902fe243b4951c1480dea036bcd86
TLSH
T1F17161BC020701A1E356933AA9D3C1D67CF18BCAF96BEDE61110D8BE26D67618278F50
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 9KB
SHA256 42283fa999b5c416747fba2cb3d0da48d3f9db642c82ba978c4c88d668e7598f
MD5 86a5bdb08099a00eb306b4bd003113ec
SHA1 4a8a6ca58a1b49d4fe0632048ad9df49f8309b0d
SHA512 4999d2d66dad3ac2e994758e332cf9584818e08fd4455a34b8b5966b7cb6e6d9db7ad4601411daebfcee693b593136031a91c5a167c37eb03d0fabcf7d636f00
SSDEEP 192:DcEePnFaDzQJSsnFyj1eIwcBR5+z5JJIVCF5wkp+hjo6y+o+BM+KIRK3VEUdq+Qg:DcEePnFaDzQJSsnFQ1e14b+z5bI0nwkn
TLSH
T10A227DE69BD4C23C984399FDAA75AE26CE1E05D802683D27CCD4DF1F93D1A61E20164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 64cdda3bf9d5f39606ee0bc1f71f30b4f5ed59b216a71cb5315ec52b81e75303
MD5 a080dde03d9fb717606b3058991fdc84
SHA1 e608030c72b594217770272df931cbec51b6ab96
SHA512 6566079cc6d1149508548ff05987a6ad5267a9fec72d3be6c5a7dcbbd2949b56754677994402d79fe3df6ba322e31ff7df289f17ee4800559948bfcbef859398
SSDEEP 96:DZOEePnsjzKGeZwQwcBR5+7n5q8+o5k3JJIVCF5X:DcEePnsjmGeZjwcBR5+z5p+o5k3JJIVo
TLSH
T143A1AFE68AE4C23C990359FDAB26BE26CE1D06D8436C7D27CCD4DE1F93D1A61F20054A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 f4834a15796448c676619bcff2f6a40676a7314c949dd2fa09b4f9e6e5caa188
MD5 04289c3a72c14c66c4f0bd3fc2ef7239
SHA1 7a87925141368619a94cf12ed3e7dd01f8e8fdc7
SHA512 6ad380b4936648fbb53f39fee9ea16e799cddd6d745b7861f1766c006bca1572f0d74b031c3626ec23838a1e94cf2dd4294c4ec939111bc9ba2f5d6ba83a339c
SSDEEP 192:sxZYRtyM/jK1Ml8Mkg/fKs+vE1JhIdpJHW6+WNGYIwpvy8IgrJ:sxZYRMg/fKsSE1JKJHbGK9
TLSH
T1DA42E711AB34A977CCCBD309FA457F43D6F90572A2900E48A9FCDA1C04E6AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 6ec3178205e47fecd9c4c74320d730a2d6eaea437d3a6d96079e1cbfb077836a
MD5 d82b687feb99b2ecb0509cae8fbb82a0
SHA1 ca48017992aa8105e935f817f14ef47ee633bd1c
SHA512 2daeceb1efe5e48ebb75afb1bf19035c77433f6d03e2d30014d1d1d9c5130d5044999382823a25a3e21eab4554eb266acbbca0dd3603c5e4f2e692cbef521403
SSDEEP 192:sxZYRtyM/jK1Ml8UQSkg/fKszvEyC7IdpfeHW6+WN7pnZYIdA9y8Ig5EJ:sxZYjqRg/fKsTEyCk2HbpZyy
TLSH
T15652F711AA34A977CCCBD20EF985BF53D6F504B292900E54A9FCDA0C00E2BED620781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 8133d78668b74eb8619c86b93f5c46a12cdcd4c4c36aa59d5e3e8e45a7ddff0e
MD5 e2db4e0402d347bdb10f5e335c6d89c2
SHA1 461dce089d330c8f36466e093f76aabb683bbaba
SHA512 dd9c47c387dbb5e3d587378e99af3e7eaea29f99113f501f66ee4d85c206e8ccd548b16681dc2a8346f90492b10fedfb48feaef24e1e81a38df8f03e937b0357
SSDEEP 192:sxZYRtyM/jK1Ml8Mkg/fKszvEyCJIdpl/sHW6+WN7//zg/YIP7nvy8Ig5EJ:sxZYjMg/fKsTEyCC9sHbjLg/dty
TLSH
T15D520911AA34AA77CCCBD209F944BF53D6F4557392900E54AAFCDA0C00E2BED620781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 c6da6d37f736b9f141d0f88645b910429aad626f7306f877388d95df4c47f0e2
MD5 98e9fb60cafb2727dbef8a96a71a574c
SHA1 1efa6686da4e6829288a09d564aff3ec3d94713c
SHA512 6af8d24fc6cd0f588a1ae0b97eacecfa954a374478ec0683e2cb79bb5dea7b9ebac1da1ba22b7cc7977c1306a4a00a5e9e6d3eba3128f5e461cfbb3a373df3bb
SSDEEP 768:oqsqxXlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR9nro2dv:oqsqxXlWvJD6Tu1ja54LAs902R
TLSH
T104D21C3B694CC77E4F840E9DEC266FD76ED801CBA6988D5447FA880C03CB2EA51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 7KB
SHA256 8c1367ca17d08dcb3d9377720b64376f71a28b085efa4cceac996dca95015cfe
MD5 04c30a36e3263f3515c93c7c7b994640
SHA1 8d048e14f00e9b2f35dca44b4b51f5e59246174d
SHA512 d9cf77bedefef6a6bbd82551807a5ad76c830d504ce202443311bb5148f82f2c872fd77ec537f42d7fc27ab73bb7e9be06f7abad7a745eb76491844f4b47b91f
SSDEEP 96:KYbaKYIKScgKVWeS8AKhumJqKaoyKWoK3q4u:ExbPz4h3y
TLSH
T102E1C616713E061239FE298CB2A685374F423163705CA86F7FB950650A6BE225CFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

38090a1f-9463-412a-8191-50e084f394cb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\38090a1f-9463-412a-8191-50e084f394cb.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 733d01bbe2e97add82b18a0ae13ec0f830cb0a6ea2beaae0eb624308e53c4950
MD5 22ea462e8532041830017db4c5bec42b
SHA1 80deeeaa1e2d923b2be251f34f8e7248d8b83964
SHA512 24bb7df0b5065ee7e30c405e1d7e3bbe818573f702437d3f5799b2fc85456e4a28140eef5f31607bb0d31bfc7bce9d2c2be85369640b41e842f4bd0a1ee72386
SSDEEP 384:+ZcIhsNY+i/bxArVRNaEq66HlytEDq1kKDk:8h+pHab6oy6DqeP
TLSH
T1A5928E3198785C3749BBB841F48B39135FF89067BBD82F8095ED5F1D01DE5A9130B92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 fc5cc24833a9e8c196ffadf71c523eaada515800f8b9886d09befa4b6271e8c8
MD5 34fada474fe6d3b7d7e9a7559ea4a59f
SHA1 7981c115fd46e20866b0ac4e4736aec4fdee31a2
SHA512 5bc76bfd36eeb76349e049033095e85c1764ae42b57c38c0eb0331420f3fe35696e35a769dc2d9b5a541530ba155d43227b6a7f2fbdd3e0fe1745a66df8a4022
SSDEEP 192:tONC6JkRtQmiUymaW+RNfCk7Omth3jRwU6:tONC6UrkW+RNaETCU6
TLSH
T1CA020B356C382C7B8EF2AD05B48B37175FA4216BFA952F80DAD81B1C00D769C234793A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 5bd26387d4a0aaee84c5455ce08daa03f1788b1762c49152a0d4b4ecbd59f32f
MD5 1db576bf9a311ca293ee8829f1a9d373
SHA1 51d3fc82f3afc4e3dd40d8ea95b6265cbea808e2
SHA512 a8af957492979bb4f9987ae5354b0ca467347f3fd043f647447a69c9dcbf9e729570e6c2c038de6260853f6105d6c7b709fe10a87ff2022b535a4e6f2336f4a1
SSDEEP 384:hZcIh0sNYbi/bpArVRNaEq66HlytEDq1kKDk:ph0JpHab6oy6DqeP
TLSH
T117929D3198785C3B49BBB841F48B39135FF49067BBD82F9091EE5F1D01DA999130B92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 9940bf99fa791d9a2c6bc89f90200cbeda19aedcaf4344f1f255149510604683
MD5 26696eede19af28db55aca154a8044d1
SHA1 22b3d0289a8417e196d0e9048220764785466eb8
SHA512 d4ce1daf86c6fcac9fc1a299ee83d8be52187aa74d07b8c8800c7d509d8471486e938185c08af9f85727bdda14301c15ff1e2c84fe86c778096feed5a0ef3502
SSDEEP 384:+ZcIh0sNYbi/bpArVRNaEq66HlytEDq1kKDk:8h0JpHab6oy6DqeP
TLSH
T157929D3198781C3749BBB841F48B39135FF49067BBD82F9091ED5F1D01DA999130B92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 ad6206a99998ab8307b689f89431cd43fa1c248bd40fdf48792584ea6356ba7e
MD5 a1bb89320c847c21e5a3c039884be7f8
SHA1 2c38e42b1ced9b65cb47195d873d0b163fc5d08a
SHA512 06760c5e0f3afbfa7f36347a862a04467fe33336285311e82b31c87fa692a1cea988e01b61330646ede321e54c9ed6cda47b084aaf7a7cd3a910c4f650cead0d
SSDEEP 384:TiFiZcIaX0sNI8TUNTUlIlbi/bpfrVRNaEP66HlytEDq1kKDk:+FQG0dwgcpHak6oy6DqeP
TLSH
T12CD239F248E7483AD9AE5B43A77E3D034EBCC063B5946A50B3D95A1CCC960BFD30A915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 101da120317839e266669d96b77d50b9c0bafb89462dedd68864c9e7673e0aa9
MD5 be0340b103f7c162721fdb185a14c509
SHA1 90af3a7de5296b48238a3bd27f63d93f923f3c9f
SHA512 25afaf3da70fd41a4c6f33baae342555af551671affd5852331355087223eb25a15b7a2ae4c050f3233928e27fba1e2a4ca8938de2e21ce9a07880f1ed1efb59
SSDEEP 192:FONR6JkRiQmiUyTap+RNfCk7OmqZZLVcvqc6U6:FONR6Uejp+RNaET6U6
TLSH
T157120932AC786C7B4DE2A841B4CB36135FB55167EA897F40D5DD1E1C01EF99C230B92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 73f1447d6c27746b78f019c07d9db3ad22a92a2544d86f09654da734b8663766
MD5 c970a9e93344d44fdd0621a457368848
SHA1 f55f7f31c8d493b826dbbcbab8cf03ac39ee61d3
SHA512 afdbceab817b1dd63df38041dcd10d427ac28d27262020ef3df4e3282894e81b010c57434fcd33b6690dd0f7ab49e679950381a726448692f3a3948615ee9101
TLSH
T184412B98B6FA1118B377AF56ABF7686D447BB8772F0AC45D00120D4E0A76B40C871737
MD5 SHA1 SHA512 TLSH

Submit Download