380b38cf47ab97a36ec1bd690294aa6e44f1c48cda07375550410583832c7371

Analysis

max time kernel
899s
max time network
737s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/08/2026, 11:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Chat Session - a442b6b9-edff-44d1-a5b8-c9f629c (1) (1).html
Size 72KB
Sample260803-ngjdesgf57
SHA256 380b38cf47ab97a36ec1bd690294aa6e44f1c48cda07375550410583832c7371
MD5 a8f0bfb3885db441150395d294c64a4f
SHA1 075b1e8091ee60fbcbf2fc2a8d40805e512186ef
SHA512 3a5840b26c9b4c1736edc74430915af8b873dd2988574514f51a08a5cd6a0b1b47d47e46d0eb2ca1307640be7d54bbcf38a4b8658d81c452cadcd83cb0b2540e
SSDEEP 1536:kdMozIViKXWZdH47v2oZFWNQmU9WuTUrSybh:k2ozGiKXWLH47p4q97yN
TLSH
T1D173A6479329033D0E720A82691D17EF775CE0ECF35612E278DAE278211995247B7EEB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4576	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302304138417798"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{989CD615-6060-4C79-9707-986F3C3C1FAB}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
224	msedge.exe
224	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe
3168	msedge.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 3168 wrote to memory of 724	3168	msedge.exe	85
PID 3168 wrote to memory of 4576	3168	msedge.exe	86
PID 3168 wrote to memory of 4880	3168	msedge.exe	87
PID 3168 wrote to memory of 4880	3168	msedge.exe	87
PID 3168 wrote to memory of 4880	3168	msedge.exe	87
PID 3168 wrote to memory of 1156	3168	msedge.exe	88
PID 3168 wrote to memory of 1156	3168	msedge.exe	88
PID 3168 wrote to memory of 1532	3168	msedge.exe	90
PID 3168 wrote to memory of 1532	3168	msedge.exe	90
PID 3168 wrote to memory of 1296	3168	msedge.exe	91
PID 3168 wrote to memory of 1532	3168	msedge.exe	90
PID 3168 wrote to memory of 1296	3168	msedge.exe	91
PID 3168 wrote to memory of 1296	3168	msedge.exe	91
PID 3168 wrote to memory of 3424	3168	msedge.exe	92
PID 3168 wrote to memory of 3424	3168	msedge.exe	92
PID 3168 wrote to memory of 3424	3168	msedge.exe	92
PID 3168 wrote to memory of 4392	3168	msedge.exe	93
PID 3168 wrote to memory of 4392	3168	msedge.exe	93
PID 3168 wrote to memory of 4392	3168	msedge.exe	93
PID 3168 wrote to memory of 4624	3168	msedge.exe	96
PID 3168 wrote to memory of 3728	3168	msedge.exe	97
PID 3168 wrote to memory of 4624	3168	msedge.exe	96
PID 3168 wrote to memory of 3728	3168	msedge.exe	97
PID 3168 wrote to memory of 2444	3168	msedge.exe	99
PID 3168 wrote to memory of 4956	3168	msedge.exe	107
PID 3168 wrote to memory of 4400	3168	msedge.exe	108
PID 3168 wrote to memory of 5060	3168	msedge.exe	109
PID 3168 wrote to memory of 640	3168	msedge.exe	115
PID 3168 wrote to memory of 640	3168	msedge.exe	115
PID 3168 wrote to memory of 224	3168	msedge.exe	116
PID 3168 wrote to memory of 3112	3168	msedge.exe	117
PID 3168 wrote to memory of 4332	3168	msedge.exe	118
PID 3168 wrote to memory of 3112	3168	msedge.exe	117
PID 3168 wrote to memory of 4332	3168	msedge.exe	118
PID 3168 wrote to memory of 1000	3168	msedge.exe	119
PID 3168 wrote to memory of 1000	3168	msedge.exe	119
PID 3168 wrote to memory of 4796	3168	msedge.exe	121
PID 3168 wrote to memory of 4796	3168	msedge.exe	121
PID 3168 wrote to memory of 3976	3168	msedge.exe	122
PID 3168 wrote to memory of 3976	3168	msedge.exe	122

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Chat Session - a442b6b9-edff-44d1-a5b8-c9f629c (1) (1).html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2a8,0x7ffbd8d7c188,0x7ffbd8d7c194,0x7ffbd8d7c1a0
  2⤵
  PID:724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1996,i,11476745933007085285,9213269996828487355,524288 --field-trial-handle=2256,i,3509206953766878533,2975011305731819517,262144 --variations-seed-version --mojo-platform-channel-handle=2284 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1684,i,18211249974205658111,8484966279391946256,262144 --field-trial-handle=2256,i,3509206953766878533,2975011305731819517,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:2
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2540,i,2321869232715223999,14979592317319223816,524288 --field-trial-handle=2256,i,3509206953766878533,2975011305731819517,262144 --variations-seed-version --mojo-platform-channel-handle=2556 /prefetch:8
  2⤵
  PID:1156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,1125794898842014767,4296776014549390601,2097152 --field-trial-handle=2256,i,3509206953766878533,2975011305731819517,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:1532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,13422818302386072830,12860665893856673110,2097152 --field-trial-handle=2256,i,3509206953766878533,2975011305731819517,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:1
  2⤵
  PID:1296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4252,i,10195684208609743374,17119125923361071182,2097152 --field-trial-handle=2256,i,3509206953766878533,2975011305731819517,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:1
  2⤵
  PID:3424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,849550518661925728,14298686147213433047,2097152 --field-trial-handle=2256,i,3509206953766878533,2975011305731819517,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:2
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,9378816867771552758,17556316029787473138,524288 --field-trial-handle=2256,i,3509206953766878533,2975011305731819517,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:4624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,4783613361154371666,7766736867683142232,524288 --field-trial-handle=2256,i,3509206953766878533,2975011305731819517,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:3728
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,17298625125623987870,17438598100168662512,524288 --field-trial-handle=2256,i,3509206953766878533,2975011305731819517,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:8
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,17298625125623987870,17438598100168662512,524288 --field-trial-handle=2256,i,3509206953766878533,2975011305731819517,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:8
  2⤵
  PID:2444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4988,i,15383741577897839996,13180638196490017176,524288 --field-trial-handle=2256,i,3509206953766878533,2975011305731819517,262144 --variations-seed-version --mojo-platform-channel-handle=4900 /prefetch:8
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4972,i,9853980545950078444,7514534242859261872,524288 --field-trial-handle=2256,i,3509206953766878533,2975011305731819517,262144 --variations-seed-version --mojo-platform-channel-handle=4952 /prefetch:8
  2⤵
  PID:4400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4976,i,16347187685598957692,8695890822884090560,524288 --field-trial-handle=2256,i,3509206953766878533,2975011305731819517,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:8
  2⤵
  PID:5060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5208,i,5292628916132274979,10566661575858052803,524288 --field-trial-handle=2256,i,3509206953766878533,2975011305731819517,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:8
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5796,i,8280097531157287918,11525731039827142675,262144 --field-trial-handle=2256,i,3509206953766878533,2975011305731819517,262144 --variations-seed-version --mojo-platform-channel-handle=2116 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5992,i,342606757734132811,13165481339530112212,524288 --field-trial-handle=2256,i,3509206953766878533,2975011305731819517,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3392,i,10003671380100043367,4059307726478700747,524288 --field-trial-handle=2256,i,3509206953766878533,2975011305731819517,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:8
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,13334787172824980693,18408100020961500233,524288 --field-trial-handle=2256,i,3509206953766878533,2975011305731819517,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:8
  2⤵
  PID:1000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5184,i,6274684833422419415,12032618708203738384,524288 --field-trial-handle=2256,i,3509206953766878533,2975011305731819517,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:8
  2⤵
  PID:4796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6384,i,7657007147506479186,14791779502426970750,524288 --field-trial-handle=2256,i,3509206953766878533,2975011305731819517,262144 --variations-seed-version --mojo-platform-channel-handle=1484 /prefetch:8
  2⤵
  PID:3976

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 96314074c0644b161c0f4fb4ea533f45dd02f7d31f1617a76971c4857b7a94e4
MD5 70b74c763835fa1f3501b8f8798129eb
SHA1 ece06071ad0b57d41824af2c9cff26e3de058444
SHA512 1747b25fb0245720e35de118d5dfc9de483be1daab32af55f50b09f8e93e676a9ab33e4c1dceed322711a762d031ffb81d43074df577f6261ff5a1a8565398a8
TLSH
T168E020C455CCC25D77C1754FD299670C91C0370BBFC4E94557008446B04209066C19E0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 7d452b9988b3c17de77b2e4a84de0b7859f8de7d566022e2069c8d7a2ffe8c7e
MD5 d7322d6b8263dd76e69def70a68b585c
SHA1 6bb930fee98346b03c072924775b24f5fefc6650
SHA512 51d4d3f3594d97334af566f83d80a8fd0e61878b220fa6df30bc97693ab9f2d57f710deaaf3199edf6bee9c456410781366cb3a322710b00a10e95f14bc0028b
TLSH
T18DE07D8C54CCC2BEF7407687E36C538C82C1364AEEC8E98A77108C857185050F2E2EA4
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 33d3b341693523f9ecad4f75a72a4ff5dae4a5d8362ad0d0631f851b67d57037
MD5 49b416923c5305d14e36e6334243de41
SHA1 98bde9f2cca6fdce985e01d4818533887ffedde8
SHA512 835421485a8ffd33a03dc0abc75a4679f0a55597c1fb814a47089d0ce27190a0b6d03b8e3c32cb0219f716fbec007ac7ff19ee7668eefee6bbefd12d48228598
TLSH
T1A341E7F002A35B41DF3016B190F11B40367683DDF9737E19869299BE3A3AF63852647C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 733B
SHA256 b30ac6a5c19c08b42f6760e7ac0407928455a1a9c64e804691745ccff513aeb3
MD5 3a0293025b8484b2600e8d79de4696e8
SHA1 79909c99dfc71eaddf72665590344fe7ef99cf3b
SHA512 e6dd13cf77b2ffc8f16f104433f3eac3a0041346f80a52d4754093fa000e5407d0c7ec170b6907dd005f3d2a679b4e9d64b66a3a552f66a8fb4196929a0f64f3
TLSH
T134014CF3C3E4956E8A0156F0AA28AE1BCE6D0546431C7C6AC5D4FE2B93F3475D50189B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 928B
SHA256 4fc0a748432ab16a73791c63c81920a38fb758d493e67bb7eec02fa51d73f3e0
MD5 8cf13c86306b702c03eab408f6d9931e
SHA1 189e2c46c88f85be7ac4cef3d6879e9337c4f25c
SHA512 6987330230171140805d9efa703935b748c2135f7732d9c66f0127eb31c4d5985a09ddf2d726368cea7ab365207a919dc75f545357ecf87f1335b5bef24ca2bb
TLSH
T14A119CF3C7D5956E890112F0AA28AE1BCE6D0946821C3D5AC5D4FF2B93F3475E10199F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 a97959d6bd541d2459dfdb9bfab1643488a86cf510af0771b6386ef381fd81fb
MD5 e2b6d79317ba6a7ce92aa0f2c89a665a
SHA1 56e29dfb82e66995cd1f4072706cac3a07645046
SHA512 a3a5bcc0a5fd883e93c299414fc21f05ffaa65df2cae3599d3a68f973ffcbfef566dcd2c8b026b8162c35f5041032821d97da0ae7d2b224cb43a23affdebfb7c
SSDEEP 192:sxZaRbk8/fmsG08R+2IdpdTHW6+WNGY9IKbcSxoIgrJ:sxZa68/fmsGzShHbGSc9
TLSH
T1E822D8126E38A83B4CCBD209BB29BF43E6F9503291941E58E6FC961C04E7ADD620740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 2a51660192f07f51cc08835c87e9283da4683d654d9e2aa5d16501e0847b3c86
MD5 69b3fec504e84f8e14d34ef257e5d6a3
SHA1 71751df6683179c4d8cc1b84c3aead332a0de6c8
SHA512 12240a5e7351b645f42e18e58fe59e900b6322099b550d0417b9b6892d083ba8ed5059dd0ab3464747a76efd1af5e19bdd1c5eeefa881a7489636a3dfd4f092d
SSDEEP 192:sxZaRbk8/fms708R+2IdpdTHW6+WNGY9IKbcSxoIg5PJ:sxZa68/fms7zShHbGScL
TLSH
T1A622D9126E38687B8CCBD209BB69BF43E6F9503291901E58E6FC961C04E7ADD620740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 c3a5470c0e217f75ec87b2549dc43dd037627418be58f155b25ef06fb37732c8
MD5 7082ee49b3627f1abc796bdd6bd0b566
SHA1 f78d0451ac18ba8b70cb2d090f3851dcfac5944e
SHA512 d9f7b0573088b366c2410456f847440aa70a99abf98ee1c8a9bb7510bfb863eccad632db3cfb3a9f843821185eb29d43d86d0f0ba77164dffd717fea95b6ca17
SSDEEP 192:sxZaRbk8/fms709R+2IdpdTHW6+WNGY9ILbISxoIg5tJ:sxZa68/fms7iShHbGv4N
TLSH
T16822E9126E3869778CCBE209BB69BF43E6F9503291901E58A6FC961C05E7BCD620740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 365fa7f750e18f9d45b3952f139446c90ce31da78d58dbee20c78601fb0f8a5d
MD5 69c26bb27361dbdbbb576ea3a0e927de
SHA1 cff095f021a66d94d647e455dd21adc757878589
SHA512 b60b3bfbac6685f67abe804b65514bed481021326652e30fbdb57d34034e54744c7e50fecfa37bb4239d55d5cec938a9e683cf89903e7e8b15c89f03d6b40b8b
SSDEEP 768:TlyvIZwWvu+Q+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVDFLlwmW74rolbqxW:TlyvIZwWvu+Q+u1jamFLeR7Dl1
TLSH
T102C2F92B240CCB7E5F801A9DDD5A6F9B3EA802CB67588D4047FD994C02C77EA512A4DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\6539c260-5404-4f2d-80ed-ee2bdb57a400\index-dir\the-real-index
Size 360B
SHA256 8d02614a1f279640d9c8ed3f54be9b98fe05b396a4b78c2f3709debd63212aa6
MD5 a8b5eac17eb497e12301902d8e8dd1d1
SHA1 ca01a894b8e0a48f0099c7d06dfe6965605dbcde
SHA512 f88f4bad1cecc1683461562dcdcd9c4b7e0b6a282fb4692be87f07e033db0f0d2928fefc83628c1592cae5d7b9ab859239e7021133192c39ed38e8235d604bf6
TLSH
T1E3E02B148E810936D964073628B649A463B04DFDA624D507543D457A2C5525C651B2DC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ce334.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\6539c260-5404-4f2d-80ed-ee2bdb57a400\index-dir\the-real-index~RFe5ce334.TMP
Size 360B
SHA256 74a8cdab9d0a36d5d696ca3f411167c930b58697d882125403b026e22ce51a16
MD5 345b2e9a4fdf9da3885df147f379ae3c
SHA1 4deef69f812cfb72e11f16d22a34c582b6c09ed3
SHA512 d6e7b1fa15807d7ab6300eb4a43151f907f3f66fa3e97d87535d6f09dcfc91d92a44b040b8f7195f525b06f407ce2a16e7b1cc2dce93df629db63dbbd20f2287
TLSH
T1B9E095C4C7824D31D564057B2C2348DDF2718450B514FB03353C943D2C25ACC9B470CC
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 abb3090552177dabff697aeee62f5ef4595c13d5ab3c7dc8060148d72420b9ad
MD5 7683091353177029ab9dcf13b5951bb5
SHA1 b25674783d5a1b7df7f042194490205a7cf28dab
SHA512 5867cddee88bd9936cf5730948ae46928a1550c2fd2638f6b0fc4bd4231c6546cf203021f0c76710e6c26d586c9dd1d66a9a9c198f0b1da37630b35547d61ccd
TLSH
T119E0D8BA2EE71D20FD5FE3D9293144E900157C888D48FD4E642A6A8B64F02502426C73
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 c1ff517af321dc4235c975738c207d18469aec2cca7a6e20d5e6b000e17111ae
MD5 128d83b0749f6487249ffb3f2ba011a2
SHA1 830e118fad18beb41d42b6f75aee2b435395e107
SHA512 108e257e0671e771e89db1fdd33a1d75cef3d339e6f8e2f802d548b679765a583d3d36eaae87ba10dd50a3c8c77e50acfbeb7d440b8f49e355d57a6d1cefc35a
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDaAYKhy+iVoZFf7Xkn76P59kKBB53ktlFaX:mTXjiVoZFf7Xe76B9hB53ulFaf/
TLSH
T11291F106B13A02D239BF695DA3A699378E4131637A14E96F7FB800528B27E111DFC8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c72a7d37-73e4-431f-80ec-fc20cbb0a76f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\c72a7d37-73e4-431f-80ec-fc20cbb0a76f.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 5bb88d5ef8f622be5deb369f14d0ecc5cd61f2328583f674e251baab0a82638f
MD5 ca956119e728d492812d4a05f9be1a6c
SHA1 396f3256d1ea0f7866ff2496cc156d5b3a6fdda1
SHA512 ea4797399d87b2f8288239a5b3ddddaa005c8cdcb61cf92f46390e06e0206de49e277550f32ac8c2cb2985fa84fdb5bc59d4ed842aa7e7560042ef93b02560f4
SSDEEP 384:eZcIhsNAKlSbP4IzicYMEse+CndHeReuo6HlytEDq1QRKDR:chGy4UaMIfERooy6Dq0m
TLSH
T1E9929E3199741D379AB7B551F48739134EF88023EBD93FC8A1FDAF1D01DA6A8130A426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 5b86c064ba4d963591a542e4d08e76f8b75497f7e4a1cc1761929ba076fe1400
MD5 c73a596f1f11c8d61779949b8bf44842
SHA1 47f7425e1c5ec2c9e738cbb705851134755c0c36
SHA512 bb531959affbe9cc32d2b3bdb45e35f4ce35942b25f932a94e6ec92f3771dbea40bf4102663cd8ed84664e684a00a3b24926c43a2b768567385b197dd2026832
SSDEEP 384:WiFiZcIYzsNA8TUNTUlIlnlSbP4IzicYMEse+CndHeReLo6HlytEDq1QRKDR:9FQk9wg1y4UaMIfEeooy6Dq0m
TLSH
T1BFA28E3258A4593BAEB7AB41F48A35138EF48073DAD57FD4B2EC9F1C019B5EC130A925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 87a8459ad2b1a7974e367b4b61e8a6c9dadd3eb856ccdc9102efe55125e9a090
MD5 45be03ec69690e5f98ca7eb166a6067a
SHA1 c2572230cfa7ae6938a0395b02bc1f0ee413ec91
SHA512 5175a149b28ff8634e5f993c785c112d4deba0e237c5fb1f6b25764031c869feb9f19f1357654cdbd216f5c8c6459ba33ae4da98480b94adf1f755cfbbc2dbba
SSDEEP 192:JONii6v+YLNQmiUy7LaZh+CGp+Fdes9odus9PU6:JONii6vz/+aZh+CndHe9BU6
TLSH
T18502E9356D382C6B9FF2AE45F5873A235FA82177E9922F84D9E81F1C01D765C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 413f1f3b0596e255cc9be37a68a84e1cf92c392eeb48abb51dcd13abd30084a5
MD5 72dff7d3b3af7d53b68312f52e3afdc3
SHA1 c60040f774af19a0849caa13cf21c473dd982f53
SHA512 cd570d36e372e6be5693a4820ca273246408fc7320732ef7f838545e2fce79fe834adcbfd27595c98efa6b11bc9c0eee7576697b0bf921a0ccb6d353471966f9
SSDEEP 384:5ZcIhsNAnlSbP4IzicYMEse+CndHeReuo6HlytEDq1QRKDR:Rhry4UaMIfERooy6Dq0m
TLSH
T177929E3058741D379AB7B551F48739135EF88023EBD92FC4A1FCAF1D01DA6A8230A426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e00b85b65ed5c9e81522052455809b5b7b24fa8a7952d1179c186321dc9d8d91
MD5 eb0f2d0d09d518d78035d8e35beb55c1
SHA1 11b11cb02f4776ad030b1311b2fe196cd36549c0
SHA512 69e69022405d658de44e63557509e0e8121be622822b1ae78985221c60896bb0b9155a977867d08dc2270102f223d35c9703c05215e420eaa80b959003389fc6
SSDEEP 192:P3OND16v+YLZAQmiUyyLaE8h+CGp+Fdes9omOQNFCHuqcU6:vONp6vzaVaE8h+CndHeReSoU6
TLSH
T17C121B35A8786C6B9FE26541F48735135EA89277EE863F80E5FC6F0C01DF6AC2306426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 6030dc903e5dac5587776307bf38f75e8161f0d48070e93b939a0e378f3dada6
MD5 4624742f4e44e9b4a745868bb06f9255
SHA1 2d81dfb12ae9190088054eb5f467990ddd1ea118
SHA512 5d7d22e6ef2394b38b52f0ec460cec9350ec05876ce3572a23d00ab791fe5bdd4ab6add2cbc3e6a0e64e14cdd668808e570103c1d2a0408e953af06419fde6b8
SSDEEP 192:v1LsN/IKAQ09x4CfJ+YLeiGSQmiU1mLMED4e+CGp+Fdes9omOQNhJiuqc7XBX:hsNAKAbP4IzicYMEse+CndHeReuoB
TLSH
T15B424B36A8781C3B9EF26242F14735139EB89463DAC53FC495FCAF0C01DB6AC2316926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 c41b462ac82d3d58f271dce4b94c6a2116bf488a01e8b504fe41b8308c624417
MD5 a48ff64c8f24c2cb47342000138c08ed
SHA1 db4d66ddb007eb3d3964a79cd89873e6215113a7
SHA512 e69d026522c15be3b57e9d1b38caccbad023bcd445ddc3af21d1d37756e967d6284ecd22bca07ef6a3f997a84fc391c323d59d799561d22683329bbf04fb9eca
SSDEEP 384:1ZcIhsNAnlSbP4IzicYMEse+CndHeReuo6HlytEDq1QRKDR:Nhry4UaMIfERooy6Dq0m
TLSH
T161929E3158741D379AF7B551F48739134EF89023EBD92FC8A1FDAF1D01DA6A8130A426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ac14f476-9a23-42c5-ab2b-599e3eb80e74.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ac14f476-9a23-42c5-ab2b-599e3eb80e74.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 9857ff46ec4b2619bab8f7c6bf9bd1ad13d97c874fe992ff4ec5f4865fab74e9
MD5 e6f6324552f2d79c05b8fd244583b8f6
SHA1 375dd0541240b2681d6a5350580d2186463dfb63
SHA512 27716cf953745cbd620fdc60a2a81f15f9e8998fb3aaf143395583c9bcc6072f60f96c16a75140286c8d686bdf6df3d946e424cf762c71a0615f807270a0066f
TLSH
T19341D659BAFA1148B3B76F16ABF2A96E487F7C373E06945D10110E4F0A66A40C961B33
MD5 SHA1 SHA512 TLSH

Submit Download