380b38cf47ab97a36ec1bd690294aa6e44f1c48cda07375550410583832c7371

Analysis

max time kernel
898s
max time network
737s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 11:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Chat Session - a442b6b9-edff-44d1-a5b8-c9f629c (1) (1).html
Size 72KB
Sample260803-ngjdesgf57
SHA256 380b38cf47ab97a36ec1bd690294aa6e44f1c48cda07375550410583832c7371
MD5 a8f0bfb3885db441150395d294c64a4f
SHA1 075b1e8091ee60fbcbf2fc2a8d40805e512186ef
SHA512 3a5840b26c9b4c1736edc74430915af8b873dd2988574514f51a08a5cd6a0b1b47d47e46d0eb2ca1307640be7d54bbcf38a4b8658d81c452cadcd83cb0b2540e
SSDEEP 1536:kdMozIViKXWZdH47v2oZFWNQmU9WuTUrSybh:k2ozGiKXWLH47p4q97yN
TLSH
T1D173A6479329033D0E720A82691D17EF775CE0ECF35612E278DAE278211995247B7EEB
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2792	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302304184436407"	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3986082593-3624157295-3514260330-1000\{6BAD806E-A02B-4ED0-A2FD-B0E7E5A4CA01}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1252	msedge.exe
1252	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe
992	msedge.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 992 wrote to memory of 5756	992	msedge.exe	89
PID 992 wrote to memory of 2792	992	msedge.exe	91
PID 992 wrote to memory of 3092	992	msedge.exe	92
PID 992 wrote to memory of 3092	992	msedge.exe	92
PID 992 wrote to memory of 3092	992	msedge.exe	92
PID 992 wrote to memory of 2052	992	msedge.exe	93
PID 992 wrote to memory of 2052	992	msedge.exe	93
PID 992 wrote to memory of 1136	992	msedge.exe	94
PID 992 wrote to memory of 1136	992	msedge.exe	94
PID 992 wrote to memory of 1136	992	msedge.exe	94
PID 992 wrote to memory of 4856	992	msedge.exe	95
PID 992 wrote to memory of 4856	992	msedge.exe	95
PID 992 wrote to memory of 4856	992	msedge.exe	95
PID 992 wrote to memory of 3420	992	msedge.exe	96
PID 992 wrote to memory of 1164	992	msedge.exe	97
PID 992 wrote to memory of 3420	992	msedge.exe	96
PID 992 wrote to memory of 3420	992	msedge.exe	96
PID 992 wrote to memory of 1164	992	msedge.exe	97
PID 992 wrote to memory of 1164	992	msedge.exe	97
PID 992 wrote to memory of 4136	992	msedge.exe	99
PID 992 wrote to memory of 1708	992	msedge.exe	100
PID 992 wrote to memory of 4136	992	msedge.exe	99
PID 992 wrote to memory of 1708	992	msedge.exe	100
PID 992 wrote to memory of 4488	992	msedge.exe	102
PID 992 wrote to memory of 4164	992	msedge.exe	106
PID 992 wrote to memory of 4264	992	msedge.exe	107
PID 992 wrote to memory of 1320	992	msedge.exe	108
PID 992 wrote to memory of 2952	992	msedge.exe	109
PID 992 wrote to memory of 2952	992	msedge.exe	109
PID 992 wrote to memory of 1252	992	msedge.exe	111
PID 992 wrote to memory of 2516	992	msedge.exe	112
PID 992 wrote to memory of 2516	992	msedge.exe	112
PID 992 wrote to memory of 5796	992	msedge.exe	113
PID 992 wrote to memory of 5796	992	msedge.exe	113
PID 992 wrote to memory of 628	992	msedge.exe	114
PID 992 wrote to memory of 628	992	msedge.exe	114
PID 992 wrote to memory of 5324	992	msedge.exe	115
PID 992 wrote to memory of 5324	992	msedge.exe	115
PID 992 wrote to memory of 3820	992	msedge.exe	123
PID 992 wrote to memory of 3820	992	msedge.exe	123

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Chat Session - a442b6b9-edff-44d1-a5b8-c9f629c (1) (1).html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c8,0x7ff961c1c188,0x7ff961c1c194,0x7ff961c1c1a0
  2⤵
  PID:5756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1840,i,6103401164288938899,14266184951791154930,524288 --field-trial-handle=2708,i,17858406495689276064,6924750659758409772,262144 --variations-seed-version --mojo-platform-channel-handle=2760 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1580,i,16114529993865713296,2965900917171922480,262144 --field-trial-handle=2708,i,17858406495689276064,6924750659758409772,262144 --variations-seed-version --mojo-platform-channel-handle=2712 /prefetch:2
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2128,i,15073836313742601138,8366556746491960077,524288 --field-trial-handle=2708,i,17858406495689276064,6924750659758409772,262144 --variations-seed-version --mojo-platform-channel-handle=2956 /prefetch:13
  2⤵
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3572,i,14923223907030788718,9937343695240207020,2097152 --field-trial-handle=2708,i,17858406495689276064,6924750659758409772,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:1
  2⤵
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3576,i,4401727752894735864,303484625087117152,2097152 --field-trial-handle=2708,i,17858406495689276064,6924750659758409772,262144 --variations-seed-version --mojo-platform-channel-handle=3644 /prefetch:1
  2⤵
  PID:4856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4280,i,10754735081753042927,14843763414764150248,2097152 --field-trial-handle=2708,i,17858406495689276064,6924750659758409772,262144 --variations-seed-version --mojo-platform-channel-handle=4756 /prefetch:1
  2⤵
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4292,i,2352843337924889904,576257575010919889,2097152 --field-trial-handle=2708,i,17858406495689276064,6924750659758409772,262144 --variations-seed-version --mojo-platform-channel-handle=4760 /prefetch:9
  2⤵
  PID:1164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,4860204322430295377,10784526306476797541,524288 --field-trial-handle=2708,i,17858406495689276064,6924750659758409772,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:14
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3572,i,7049581271519976702,16570648354771190150,524288 --field-trial-handle=2708,i,17858406495689276064,6924750659758409772,262144 --variations-seed-version --mojo-platform-channel-handle=5416 /prefetch:14
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,3626725225100115233,5181224802372372068,524288 --field-trial-handle=2708,i,17858406495689276064,6924750659758409772,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:14
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6148,i,3626725225100115233,5181224802372372068,524288 --field-trial-handle=2708,i,17858406495689276064,6924750659758409772,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:14
  2⤵
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4820,i,13353455233650433834,16321320712974572869,524288 --field-trial-handle=2708,i,17858406495689276064,6924750659758409772,262144 --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:14
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4980,i,14307233319773666849,8746775932047872955,524288 --field-trial-handle=2708,i,17858406495689276064,6924750659758409772,262144 --variations-seed-version --mojo-platform-channel-handle=4972 /prefetch:14
  2⤵
  PID:4264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4984,i,10821997068692996468,8689976175703001930,524288 --field-trial-handle=2708,i,17858406495689276064,6924750659758409772,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:14
  2⤵
  PID:1320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2700,i,5070168959252677694,15768073718076356579,524288 --field-trial-handle=2708,i,17858406495689276064,6924750659758409772,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:14
  2⤵
  PID:2952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5760,i,9563727811167467217,6297911764085232718,262144 --field-trial-handle=2708,i,17858406495689276064,6924750659758409772,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5252,i,11138043551133277689,1650433747008033830,524288 --field-trial-handle=2708,i,17858406495689276064,6924750659758409772,262144 --variations-seed-version --mojo-platform-channel-handle=3184 /prefetch:14
  2⤵
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5440,i,9428436348633962196,11866394380665880088,524288 --field-trial-handle=2708,i,17858406495689276064,6924750659758409772,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:14
  2⤵
  PID:5796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5536,i,1137439462285469423,3643896207751222500,524288 --field-trial-handle=2708,i,17858406495689276064,6924750659758409772,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:14
  2⤵
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4384,i,3651390525218003445,14335967472693272249,524288 --field-trial-handle=2708,i,17858406495689276064,6924750659758409772,262144 --variations-seed-version --mojo-platform-channel-handle=3888 /prefetch:14
  2⤵
  PID:5324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,13845476453610089573,6794945874479589689,524288 --field-trial-handle=2708,i,17858406495689276064,6924750659758409772,262144 --variations-seed-version --mojo-platform-channel-handle=2488 /prefetch:14
  2⤵
  PID:3820

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3776

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5560

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4628

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:2892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 da739d58d61b2ac7b5d9bb7ad60982cb15b364d9c7c9297fd0c9719c271cd985
MD5 2d2e0ac0da9a175b4b6a8be7c9d51cce
SHA1 ff15c8a5ff11faefae3f7491c7968a2163702b81
SHA512 0ae78f15909f04e1a81109917b8eeb5b8062a49558d8a40f15c02076b087f36e82b88b329e9d984fc68c62cb15408123b9db7f705f2745bfefc30b5aa2e164e6
TLSH
T1EAD09B5A72455D4CD641343224E55217E3108821754546194253F0768DD668717ABD9E
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 18a644ba613d5b4137dabc346f57eca622b6888922eaec751025ab3c0a002fd5
MD5 5eddc74c05def624cfd47ea0a7e304a5
SHA1 b5f795fcc3846bb781e66e0373fce119975b2659
SHA512 1c777d774c154e89b80817ce7344495d83eecf133c36e0ad7c60dd14d76e628697535cc3fc379ca4eeb776f3bea5096f94d0fd76a2394ecd2e52f5ca8dc0053f
TLSH
T133D09B5672455C4CD641343224E55217E3008821654546194353F0768DD668717ABD9A
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 6f6da7685a392afd1b96402d3e233dc9869842b5c3ce8b0948be40ab2425d7b9
MD5 3a4abc4b6dded3f2ba0c197067ba7fab
SHA1 1d3feb0fb38fc30428fb08980f323e0686215d9e
SHA512 3fa15d55c9b7850625d62c4ebc41cfa9d3b0a4aa7ef2fa6a967913623e8b682e17c4618644ffab938601f203dc828017ee0756607878d3d928b1638d1424a009
TLSH
T1ECE0208855C4C6BF5561658FD199770C81C0360BFEC8E9495F00C4867182040E6C6DE0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 3d8e227d9c24cef566b2606e6a28ad39a78ade869f9c68e6fcf6531291806f3e
MD5 7e55455786e9d7e0a6d18d318fc73325
SHA1 2c4197bff50fd8234ca69e155ef4bcafc21b5d40
SHA512 f8d525ace640aaece7f5e84e08ea09cc6ccf6e54bc9970ed9c150d005d4766d2121e66a95fb490e7989a1df53cbe9beabf34cbf25160d6905ea3eee45d3fc5cd
TLSH
T173E0268855C8C2FEF64065C7927CA34C86C0370FAEC8E9CA1B1088957003464FEFAAA4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 375d273ead32e191b10909aa714f42e6b1be27e414a64c7bd1de5d466d2a54c1
MD5 c6f6538c78c43de7c8c47fd902c29324
SHA1 5b51b93c63e245d0d0d6f9c2368e016d040ffb98
SHA512 28f05ed58261a5c00c7d6561c83cefdefa2874ba53d945daf9710c446bb6a44a96cdc4ff1525d72d096a6ca870176ef804d3328455dcf287b166539a37e5493d
TLSH
T11AE0208455CBC2DD65416487A174534C83C43B4BAECCF9461B109C4671828506AB39E0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 3f2eefb87696b27b555bb7a66fc2e7f47156a2843cabf50e74d0dfc988f405b4
MD5 12d609d8300e88fd54ef197631fdfd70
SHA1 772281ea057399cc17b2967ee42a71847d2a7036
SHA512 a0501c1733326b358be6d88be37e29e16a7233d83494c952fab8a1283468424698c87f63d2d40b32696be96ddc9bac724384ff7c3cdbb8b381bc951e21d33f55
TLSH
T1346143501373D4E2EF29C4B151D1EADA39FCBCC5C2C75E2241806D746A26E28A7EDA13
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59194b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59194b.TMP
Size 3KB
SHA256 04ab82a1a17fb9678f719ab4bdcace2e906e92424ff3d258de135cdea91438ae
MD5 75ede6d16f97e53f0e72616ff45d85f8
SHA1 80f18a29fc907db0c351d0e984bf0beb732a13b9
SHA512 4c342ddcafd04f6448c65c2aef4024a055b56b3d832c988bd6e289ba38b2461c3ad9fb6ccdb23e2f49a5e7db57330ff3f619899255d0393a7e13787c644caf45
TLSH
T1136154501773D4E1EF29C4B151D1EADA39FCBCC5C2C75E2240405D746B26E28ABEDA13
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 5effac65e8024084fd08781447beec4c8cabe82275ad09e01c376e4528d7e9da
MD5 4ff9a50616afb07c475246ea58758afa
SHA1 ef10b5ba3539ae087366e206dae320dee2b44888
SHA512 990ade4931dbe26f25ce502f02fbd484c1beb241767b5e0991507791f51b7d1b88611735076a723408e21991e6af8e3f6ef93a7e50c7500dec7d31f73d7fd0ec
TLSH
T15641C0F7C7E4856D890156F0AB14AE1BCE1D0915831C3C5AC9E4EE1B93E3471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 c6fb3de37cf4a1437b4f1e2204f1deead162c0bcf3d8cbf78e66f00b3069e86b
MD5 44c917bb049b68e074ea3c71e73e6e0c
SHA1 f6751d7dbcf95fd1a6970b35d7bddcbe1650f1a6
SHA512 b5b9a5a5efff95aef36c0544fc4056413b4154b3cf979e00d60250a5be9770924f8d1e1c9a01d41d4e25263155e15383535408d363ccf8e324eb94f22ad4a3bf
TLSH
T15B41C1F7C7E4956EC90156F0AA14BE1BCE1D0915831C3C6AC5D4EE1B93E3471E141A9F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 866934fa603667f19d874cd12f93b73065df8199b536d3a28f634e83fb2ce74d
MD5 f830b90a017d475bbaf8065fd9d007b3
SHA1 79d03b66b6bdbea8423e623a3ecd04d67caff3bf
SHA512 55dde63b2756c03ef64a2f7705e93c26f49e9fae5b10fa4409830d5c1a5585ec32f4e63732a26c8bd44b7a1c590cb7fe4bd27c683e70eb918a520dc1308f2375
SSDEEP 192:sxR2R+bB/fAVsGgYCbaszoA8p4E/g6+WNIYEI37GHXIgDZJ:sxR2yB/fgsGgPop/5IwOX
TLSH
T1CC42D6156968A93B9CCBE21DBB65BF93E2F9503261901E58B7FC8B0C04E76CD620741F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 afa681407bcef01e23254a632c678e3b64969a739227d3ddc83e8aacb75bf665
MD5 47bbce0d43902b2d8c44751bf844c49a
SHA1 cb6c4d223986f25b550b09806b5af3b134796a43
SHA512 fe175bd978c31fd0214c77bf7b386c161e367a28dfb9a632f36783ea60817ad0456cdeb57e94d4b62ab3bb6bbce1a02b8dc70f2384484d5b4bcbb754602a4e42
SSDEEP 192:sxR2R+bB/fAVsGgYCbaszoA8p4E/g6+WNIYE937GHXIgDHJ:sxR2yB/fgsGgPop/5INON
TLSH
T16C32D6156A68A83B8CCBE31DBB65BF93D6F9503261901E58B6FC970C04E76CD620740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 397d4fd47ffed88f842844107616d978dad37569a6c099b1d29efad805a8859b
MD5 2ee6db6020bb8a16d60d2ce88c9c36cd
SHA1 b00b706f53a8ef5480729e627c6f098ca0f88bd3
SHA512 6e122a426f13de193816f6488e5cea391123e9b2c1515a44b173aea50c9d0904af13310728cbab022f7ade13e807ed4ab74ed29fc87c22eb03e2e0b2079338de
SSDEEP 192:sxR9R+bB/fAVsKgYCbaszoA8p4E/g6+WNIYE937GHXIgIJ:sxR9yB/fgsKgPop/5INOs
TLSH
T14332C6166A68A83B8CCBE31DBB65BF53D6F9503261902E58B6FC870C04E76DD620740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 9b6ca6f4201f4cf1742be8edc363418ff2fd3116983728e897bff20b52bd9471
MD5 ef0c1ad9010e43d9192d9c1a48e4b4ad
SHA1 a5ab191751346a9ce549d27a5f5b8811c945ebff
SHA512 5f232079703bdcd9141bcee4389d460d1997dc5236f71a8fe511f1349243c12b12889f30246490f0b0be3125f5e9f866a9c2f37f888fbc706cfe92736c33d137
SSDEEP 384:40DxK6DJQD810DrfCtgQ6DRFfIQDFKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OV2:40Dk6DJQD810DbWgQ6DjfIQDF8F1+Uor
TLSH
T150B2EB2F640DCB7F5F804A9DAC196FD76D9802C796988D8047FE990C02C77EE92194DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0c259ee3-ec75-49af-a8ff-a5f337b654d2\index-dir\the-real-index
Size 360B
SHA256 541585c430ae1c7e06295f356593a4773d33566f525c5854e4473d31fc036781
MD5 84e682b27b3ee8464070d007f49eb4dc
SHA1 f8dd41d8c9066793914401d17e12ce57104fc92c
SHA512 d5f955f4b99441231eba8fcf2650d3be996135fa7cf71ceb46e24aaaf45fb385ed3408d9f0f207cdcbe424c80a936d12e312d83e90b39024ec9e82f55c18de46
TLSH
T1DEE02B4A9C925D07CE337C760677543E333B06FD2505AE6650FD142E9655B3C4A46609
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d5892.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0c259ee3-ec75-49af-a8ff-a5f337b654d2\index-dir\the-real-index~RFe5d5892.TMP
Size 360B
SHA256 933fe6e86c3af0f52e93de34563a64511e392aefca19d99d255a19b92f7fb35a
MD5 41b0b9552d36f8a1ef375d808c42e109
SHA1 79a6c0e1ad043c74e728212163fd854fc16caa3b
SHA512 641384722d0fff12b695cc3e7f4e5e9cb90b64badcdfafbf76805a77bfcadbc0a40bba3e3eaf4c92dc255ccea49e2a365cbc9e482fcfce952e83220370d6cee6
TLSH
T167E095CF44F19D53DD2659351503512E333F0C382905EA2B10DE545F15217FCC94960A
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 df4b068fc941cc21512bead63bfa6ab504e759fe3012552ec98b797b7d635bc2
MD5 8820583c60d08524bb2c143c25717d72
SHA1 b116ffb708abbfe08d1e4f22a4aa2cffecd1021a
SHA512 f3bb3080be921aa279ec2ff54baa4bbcde155e7d92a91369c56584a3efc4ce3610695e1ea7f011e31f3c29e54582397db796d88f9270fd399fd5d60dfc26bf21
TLSH
T15FE0C0FB2CE71818EC7F83C225B1C67201517828D508EC4E111692C300B5369A88AC31
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

8884e9bc-0175-4f5e-8969-e38db318b3d1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\8884e9bc-0175-4f5e-8969-e38db318b3d1.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 482da1935e6220cd3debc973a68143b51a2d0ebd396ae7a07c9f7abf0df013f3
MD5 97072a34f484c97a6de91c2e3290342c
SHA1 18fc3e35fae3702fefae8404eea82f948c395960
SHA512 cef303693c0d37aa36bc2758444007b883c0244fc7d3aa988d4a0e414f8e69223aa0b3293fed35e8084ec7fb6824eeb2f94dc755d7c62cd5168ad3cd099b5409
SSDEEP 768:i336QDwwDTd+ZDrukMeX6+qTko0u229a4vsTodleHWhieF:i336Q4nzbvVTVKa4hdIHW0e
TLSH
T14AF2BF71EC615C3789EAD389B21732439EB51173D3C82B54A9FDBA0E054B66C570BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 0f4f28454af8885d52ee55763e9a7344e65cd747c2f31a509f91c6eec0988484
MD5 7fcc1fc63163741c7c97cf3839016a32
SHA1 cf336e2d690ea036259b26bea2c3f4d576592923
SHA512 432ebfbec1b991308437aa00d75d8156a0c351b85d43a4a8adb15c1335a99ed5ce6acd82db158980b41caf12041ec764ec33f386e68342f38f21a166662ec031
SSDEEP 768:iFQe3AwgZQDwwDTd+ZDruk0eX6+qTko0u229a4vsTodleHWhieF:5e3IQ4nzzvVTVKa4hdIHW0e
TLSH
T1D203B072DC948D7BCDFAD784B21B32438EB501B3D6D86A54AAEDBD0D014B26C570BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 2bb63faacb6bc8cdb7acff7d67ba114543d42673c94dba5d91e75b1e7c261969
MD5 2cd7e120e0c7aeecadad28f413ef4973
SHA1 c87e9b692796ed5a865e6813ca92706cdddeb7cd
SHA512 84870a2bb371477d61d6a504cff8f6f1471be0635dc4b026d4fd033cbbe7720323e447bfff24b7618aeb9eeda0e3f28feaa974bb2e7e45a17ac3b39fcb2e815c
SSDEEP 768:G33DQDUwDTd+ZDrukyeX6+qTko0u229a4vsTodleHWhieF:G33DQEnzhvVTVKa4hdIHW0e
TLSH
T1BCF2BF31EC614C7789EAD389B21732439EB55173D3C82B54A9EDBB0E054B66C570BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 4653980de780c5c72ea4090df3ff0cc51491e19867d9e06ffa46fdc244eb3194
MD5 f2158a8e898cc6e26330304f1ad7e09f
SHA1 79138edf7ee12d4201c2c075ac43953c0723e998
SHA512 c257b3493bbb287f04fe345d060ce8993c47c8e760c11adb68fb1ae99ef800f808a2748c18eebaae10df1f7f18f80cc8dfa9ef94f05ec34402cff0aef78290f9
SSDEEP 768:prv+4UNbdG3EB2DTd+ZDrseX6+qTko0u229a4vsDQeVH1SdW:pbsbU3kn7vVTVKa45EH1h
TLSH
T1EA03CF32E8A589778CF7D784724B75472EB92163C6C80B94D8ED6F4D028B5AC270BD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f803994c-f5dd-46ec-9564-2e8e5002a4d7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f803994c-f5dd-46ec-9564-2e8e5002a4d7.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download