hxxps://teams[.]microsoft[.]com/meet/329927087611624?p=znWCFrHL2zC4lSLkEK

Analysis

max time kernel
149s
max time network
146s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/08/2026, 14:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://teams.microsoft.com/meet/329927087611624?p=znWCFrHL2zC4lSLkEK
Sample260803-sa7vnatvbx

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4236	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302425932871132"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{B7B25C2B-D026-4105-88D0-C6B3713A658D}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3376	msedge.exe
3376	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe
4916	msedge.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 4916 wrote to memory of 2488	4916	msedge.exe	85
PID 4916 wrote to memory of 4236	4916	msedge.exe	86
PID 4916 wrote to memory of 1872	4916	msedge.exe	87
PID 4916 wrote to memory of 3864	4916	msedge.exe	88
PID 4916 wrote to memory of 1872	4916	msedge.exe	87
PID 4916 wrote to memory of 1872	4916	msedge.exe	87
PID 4916 wrote to memory of 3864	4916	msedge.exe	88
PID 4916 wrote to memory of 572	4916	msedge.exe	89
PID 4916 wrote to memory of 3076	4916	msedge.exe	90
PID 4916 wrote to memory of 572	4916	msedge.exe	89
PID 4916 wrote to memory of 572	4916	msedge.exe	89
PID 4916 wrote to memory of 3076	4916	msedge.exe	90
PID 4916 wrote to memory of 3076	4916	msedge.exe	90
PID 4916 wrote to memory of 924	4916	msedge.exe	92
PID 4916 wrote to memory of 924	4916	msedge.exe	92
PID 4916 wrote to memory of 924	4916	msedge.exe	92
PID 4916 wrote to memory of 2788	4916	msedge.exe	93
PID 4916 wrote to memory of 2788	4916	msedge.exe	93
PID 4916 wrote to memory of 2788	4916	msedge.exe	93
PID 4916 wrote to memory of 1324	4916	msedge.exe	95
PID 4916 wrote to memory of 1324	4916	msedge.exe	95
PID 4916 wrote to memory of 1324	4916	msedge.exe	95
PID 4916 wrote to memory of 4064	4916	msedge.exe	96
PID 4916 wrote to memory of 4064	4916	msedge.exe	96
PID 4916 wrote to memory of 4064	4916	msedge.exe	96
PID 4916 wrote to memory of 4444	4916	msedge.exe	98
PID 4916 wrote to memory of 3448	4916	msedge.exe	99
PID 4916 wrote to memory of 4444	4916	msedge.exe	98
PID 4916 wrote to memory of 3448	4916	msedge.exe	99
PID 4916 wrote to memory of 1500	4916	msedge.exe	100
PID 4916 wrote to memory of 1500	4916	msedge.exe	100
PID 4916 wrote to memory of 1500	4916	msedge.exe	100
PID 4916 wrote to memory of 3824	4916	msedge.exe	102
PID 4916 wrote to memory of 3136	4916	msedge.exe	107
PID 4916 wrote to memory of 924	4916	msedge.exe	108
PID 4916 wrote to memory of 1724	4916	msedge.exe	109
PID 4916 wrote to memory of 1900	4916	msedge.exe	110
PID 4916 wrote to memory of 1900	4916	msedge.exe	110
PID 4916 wrote to memory of 3748	4916	msedge.exe	117
PID 4916 wrote to memory of 3748	4916	msedge.exe	117
PID 4916 wrote to memory of 4052	4916	msedge.exe	119
PID 4916 wrote to memory of 4052	4916	msedge.exe	119
PID 4916 wrote to memory of 3292	4916	msedge.exe	120
PID 4916 wrote to memory of 3292	4916	msedge.exe	120
PID 4916 wrote to memory of 3376	4916	msedge.exe	123

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://teams.microsoft.com/meet/329927087611624?p=znWCFrHL2zC4lSLkEK
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffab253c188,0x7ffab253c194,0x7ffab253c1a0
  2⤵
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1968,i,16333614046736094190,9903890543757214453,524288 --field-trial-handle=2888,i,4057068129331981421,10288377590429961840,262144 --variations-seed-version --mojo-platform-channel-handle=2916 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1812,i,17735295382209716567,6992059866103240470,262144 --field-trial-handle=2888,i,4057068129331981421,10288377590429961840,262144 --variations-seed-version --mojo-platform-channel-handle=2884 /prefetch:2
  2⤵
  PID:1872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=784,i,12140403631532651707,7628906721702814458,524288 --field-trial-handle=2888,i,4057068129331981421,10288377590429961840,262144 --variations-seed-version --mojo-platform-channel-handle=2924 /prefetch:8
  2⤵
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,15546008051763295323,15865115536191202549,2097152 --field-trial-handle=2888,i,4057068129331981421,10288377590429961840,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,6246963919635969338,12389273017943720822,2097152 --field-trial-handle=2888,i,4057068129331981421,10288377590429961840,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4172,i,4417628286330690950,16498977244949645376,2097152 --field-trial-handle=2888,i,4057068129331981421,10288377590429961840,262144 --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:1
  2⤵
  PID:924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4232,i,10460749307079688427,2706768859492474548,2097152 --field-trial-handle=2888,i,4057068129331981421,10288377590429961840,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:2
  2⤵
  PID:2788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5080,i,16962298945396504100,5818944097232502801,2097152 --field-trial-handle=2888,i,4057068129331981421,10288377590429961840,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:1324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5224,i,10687901793831747352,8706142688698764456,2097152 --field-trial-handle=2888,i,4057068129331981421,10288377590429961840,262144 --variations-seed-version --mojo-platform-channel-handle=5232 /prefetch:1
  2⤵
  PID:4064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5480,i,11113472375420765581,2998487487055950912,524288 --field-trial-handle=2888,i,4057068129331981421,10288377590429961840,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:8
  2⤵
  PID:4444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5492,i,13231714187752383999,4670241703695551907,524288 --field-trial-handle=2888,i,4057068129331981421,10288377590429961840,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:3448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=5924,i,13866812751706247201,13404292105156843842,2097152 --field-trial-handle=2888,i,4057068129331981421,10288377590429961840,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:1
  2⤵
  PID:1500
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6216,i,15663343521148085345,17701802578020423321,524288 --field-trial-handle=2888,i,4057068129331981421,10288377590429961840,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:8
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6216,i,15663343521148085345,17701802578020423321,524288 --field-trial-handle=2888,i,4057068129331981421,10288377590429961840,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:8
  2⤵
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3628,i,12225263994653800563,11183368431762671211,524288 --field-trial-handle=2888,i,4057068129331981421,10288377590429961840,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:8
  2⤵
  PID:3136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4456,i,15611831638718680494,18382894397025550141,524288 --field-trial-handle=2888,i,4057068129331981421,10288377590429961840,262144 --variations-seed-version --mojo-platform-channel-handle=4204 /prefetch:8
  2⤵
  PID:924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4196,i,4749352383478814142,6839376356183161909,524288 --field-trial-handle=2888,i,4057068129331981421,10288377590429961840,262144 --variations-seed-version --mojo-platform-channel-handle=4760 /prefetch:8
  2⤵
  PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2128,i,6026642260914706456,8881522005166142898,524288 --field-trial-handle=2888,i,4057068129331981421,10288377590429961840,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:8
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5656,i,5664327039724581717,12517284772692958182,524288 --field-trial-handle=2888,i,4057068129331981421,10288377590429961840,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:8
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,12018726572803939369,5052525173908864654,524288 --field-trial-handle=2888,i,4057068129331981421,10288377590429961840,262144 --variations-seed-version --mojo-platform-channel-handle=5560 /prefetch:8
  2⤵
  PID:4052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5688,i,17015729208905221717,17312907473119005292,524288 --field-trial-handle=2888,i,4057068129331981421,10288377590429961840,262144 --variations-seed-version --mojo-platform-channel-handle=756 /prefetch:8
  2⤵
  PID:3292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6496,i,5518374302436696523,9252106944545148385,262144 --field-trial-handle=2888,i,4057068129331981421,10288377590429961840,262144 --variations-seed-version --mojo-platform-channel-handle=5012 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3376

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3204

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 4ef4e0e1bbcee0e96be8a679acc069777f85e225ffc19f0f22c02542837af679
MD5 9e22390221f7e7b478f218ddd3d38e74
SHA1 b204dc37d34241348e59a7f7faa05490987ea939
SHA512 d5daaf7ded3ab7eeeee3fdd9f77c0d0d24757b64ed687db8d18ee721766f1465113e31b359c28d3c92089f6fe6534b2c5055d83857fccd70298b60306c7d6f1f
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7X:fwUQC5VwBIiElEd2K57P7X
TLSH
T19FB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 26df42adc7db9bd2e7a6ae38f4a196e4487a21d39591ba38be1885e5b93106f5
MD5 cc61737c091661b506131f07130ae3ac
SHA1 3cf1ece21594fd244b5141368af9ffd30a9f0e25
SHA512 20fc153dabedb8bcc2adf86bbb641544740d144a70089a62515d4a6af0a20fa99f51c21dcd3461e3a0f16a902125b984a03675a66d186a585bb871541cd89e64
TLSH
T164E0268457CCC2AE9701BC875374F34CC2E03F2AEBC8A98E1B50849631026C0B6D6DA9
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 e84c2ffe785302b4604e779b46b99d48e87978328c4c6a7fd9eb79b22fc3e868
MD5 915d826efcdc5f62a2c8cbdde6a14064
SHA1 a359b4fb5090741d9a572fa8d917088ca409998c
SHA512 dd9c5d964c11794c0a50112e2783b5574cb909068f5148bf1bb36191d68350ad4f35f4481aac3418a912bea52a5e913e237b7156d7d69774ff70e950a3e2d034
TLSH
T1ECE0264673C4C5E60B02DA87B059731982F0BC2BFE8CCC5EB3546487A89211242E9CA6
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 3162af488c283bbdb6565f4200727821b4e60ce0c47948b8d5b3655271a2625a
MD5 7b9f1e9c5ca7be7a0fd051116a616b72
SHA1 8a88b30a2e0c8a2c94e5512f0a5bb56573a6d8b9
SHA512 2c13705b178f640305a8b7685e6b6a7e49374c53b0713e7e54da2205c3c290a3f79ad3280c111728c5383ffc23941c73a23b34049e67b876aa1915e6e2992364
TLSH
T183C08058798C845DC280187FA726F400177155115817962705A1FCD031406A01F2D124
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 4de09ad63b0ccaaa127c8538422569ecc16b486b152b9e95c1ef5cab574cdf51
MD5 63ccfba247acd7ce4f9b11ef7d965080
SHA1 b2a4dff63656e757dc0a5d31101efe7c5eab1e83
SHA512 10b028e472b0c2c1d45389eb136bd037a2be7e44b98bad1e5a9402fd70230f734d9831b91cacf5f6c51959f56e18cf7211285bc633fa342e8e06a1a93106af50
TLSH
T1C9612CE405128993EF2D8DB0D0B61662B4B0B7B28ACB5FCD01501BBFE69A7268D57718
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58bbc9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58bbc9.TMP
Size 3KB
SHA256 b6e70b64a5a6883cdbbd80a22c7fa10d0877ff82188f59b20d4170ad7bfb42c6
MD5 d648bad8b8e1c1a1f95edf24cfb6a7fd
SHA1 37d2432eccdc23a92dd49e8df08a894ab98d5c87
SHA512 e01df92f6e8afacc5b7bfd519d0ba73d0655a934a8a45065ffeac417b604498310adbee3ad159c944c71c32124342765e704f0c1064a11cc1b2ba4ba4cd508ca
TLSH
T16E613BE405028993EF2D8DB0D0B11272B4B1B7B38AC70FCD01501BBFE69A7264D57718
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 c40aae1baeb507c522088f7b7cee5aa0020afb5569d04e351fe674c68e49840e
MD5 d8733060ac16059d884fae8b884a85b0
SHA1 a94ec004742f6baa1f06a6af6827e67a8657f451
SHA512 cb07589f9f8fc7276950f8a92940e81e7cffdc7db910918999c6547dafce359d7fa3cdc0a97a3478fcd1efd2ae4e475ff64425f291beafed86290ee5b32f4a35
TLSH
T17C318DF7C3E4856ED90566F05618EE2BDE2D0616422C3C258AD4FE27D3F3072E00255B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 0fea6931c9facc9e729550e2561e6a92956334e6a105cfb36782a1dcec66be83
MD5 e258a384e4cf675107e46c9a9e46d4f7
SHA1 879c9f75bdf916e2e9cac22a3faacd468ae79dff
SHA512 27f706f572c30194ad3f515cb92aca8ecb4a40b93c27f402dcaa796aa6afb82cbc80582380c6c399c02672c3e2488fa7875059c3178ab2ce8e761513a9c63343
SSDEEP 192:sxZtRxyM/jK1Ml8MkG/fxstXrIdpwxHW6+WNvMD/YL5B6gRIgrJ:sxZtfMG/fxstX0cHb8/m99
TLSH
T1D252F7116A34A977CCDBD309F915BF53D6F90433A2950E44AAFCDA1C00E6AED620782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 7bee64e1cc1ef26e22b9ebf49bed3f5ed645a1dcc39584791399d968f2e6593f
MD5 adfe2606a0c324146808124414b5f76b
SHA1 88f674619af6a93453b8cd8a6650b8ca4601abeb
SHA512 17f9825e897ce7fae2aea1dc9b757d3354e779b47effc4339c0f8e79754fd57972896967277fee1060162e9318e3a4e2a1fa6b990b1f42bcd91674cd1a37c9a2
SSDEEP 192:sxZtRxyM/jK1Ml8UQb+kG/fxsI3rIdp6xHW6+WNvMD/YLrBJyRIg5GJ:sxZtfqbVG/fxsI30iHb8/cIk
TLSH
T1D852F711AA346977CCDBD20DB945BF53E6F4047392950E44AAFCDA1C00E6AED621782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 192f4b3572613e219a129e61fe0e2d623fb0cf260bb15cb70f3f3822db7ef9d3
MD5 c7ce694e5cca10bb876eb02327958414
SHA1 29b110b31ae40a10d5082c6eabed2ac5d9d5be78
SHA512 833fb9e5d475a791f055d38d3ce6928298177f798f56f3912b3a32e31b14977c1d8df50eedc0af68a45722051aada8f3264e003a03864e2c3186d576da5a2f1b
SSDEEP 768:bHs6pD1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJNoroF8l:bHs6pD1WvxzWju1jahILIsNTF8l
TLSH
T188D2FA3B680CCB7E4F841E5CEC2AAF967DD801CBAB98895447FA444C03C77EA512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\bb65a3fb-8e3a-4005-a615-ecf59c78e4b2\index-dir\the-real-index
Size 168B
SHA256 3b4655da612ea2de3abd8d1404902466a158ebb4f528b0e0519db351ac296610
MD5 34fa3d4b4147b19d6f3c7a851fa7aa28
SHA1 318077b3fee579a45140f08182883734ff70d74b
SHA512 d5219642fc2c650188716ac38c0fb0640f599ac5e5052a8a0a5a87eb8ba8aa4b68ca1161cdb39c9a7ffef5bd683383e9bf6859abe7635bee42d324ca0aa4c182
TLSH
T1BCC09B5455985454F41E8231575A105437281C571165D71134BC71A5EE3E8744195505
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a8dd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\bb65a3fb-8e3a-4005-a615-ecf59c78e4b2\index-dir\the-real-index~RFe58a8dd.TMP
Size 48B
SHA256 92d05019ec876a6f7a4366f6c121ee6ffbe08eee26517f4ccc7197a2a4cf0c37
MD5 e1f441c74f150d3e6305451205ab0982
SHA1 69cbc35a8e2267717325f5f6e34962c4efef0915
SHA512 ef279570790f27c8ce00c838b769b77e14bcd2f4c987b1cd14808cc31607aa02ad1c19d4c8325ee80ef47cac6a72e8d8b6861583e2f337bda5ddceff3b085ff1
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\index.txt
Size 155B
SHA256 1c2f80284e31c369f1281bcf5c1c37ebe82925ec4ad900110a8c71675896a5df
MD5 2dace87faef49b1ef0f60d206329b359
SHA1 0feb0ca2968e52344a9b859940c4832cb247d801
SHA512 25457c9066abb73ed87c2f4e937cc42b1f342fc92e34ea49da083355019fee36cfce3ba80b62f79b7a6dd7c133b3ebfca497d13051e96d794acdccc2bf89e5d9
TLSH
T132C08C6E8290040ACE8883A200A8D42B944AA25F8050A8E812A4C011283E796F542DB4
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\2b5c392d2730c0910fd56433cc5e73e510d0f2b4\index.txt
Size 160B
SHA256 23bb8c6dc2451aea58784b7644809066364a2ab348a99a04c5c2d8587643e486
MD5 afd25e2fa0546e1cbca25e734c894af9
SHA1 98ef6dd1f9c0dff82611a30a69ef383f5e92f4bd
SHA512 14cda0ade284c576b6c8c039c2c3a7b16a345bf1c25c8a8a86e9b558ce21b95f148d384cd0b9d84b8f7748295d56137ee6f47d742ae62ff253fd027335462211
TLSH
T18FC08C2E82E0050ACF8C43A300A8E45B941A6E5F8400A4E81290E011283D796F646DB4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 817114813d9cb7c87158a790f20a1bafb62b0a93f708fd085881d83a31f4310c
MD5 8d9ab370629a51a29faca690c2b270b8
SHA1 40bf498f83f76760c926a36cd4c76ddcebf7b679
SHA512 a1e6a89130af4b726986eb15a9fb508d47bc1c37869b08cd8130f962cab12d6e9023c0c587c654405b242dac6544543795d5fbef213303554444499e0e15ba70
TLSH
T1B0A00215619AD081C0C50374F04241963B18CC2C03027B2B40A440D4CC745404952055
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a870.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58a870.TMP
Size 48B
SHA256 bcc8ddaf462a6d343317bc0e39c5234147ffd307c6acdf2d82a7e704eab4de2f
MD5 8abe66ff14e6e4e06352a88656536824
SHA1 05bfd006817c27dd88d30879041c340b562acf0c
SHA512 ff83b5bcbb3e799d72e9ccde02e047bed4d60edee4dde86a6c3f67b7cb4a584843a3773c58fdf7b11cddaa3f66d6a252b8ace51adb1e525d2e89906a232a12a1
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 58ca0ba0a34efa7ad1a3e746d12b2f508132e4a3c64b1d6ee228291c3ecca09a
MD5 8bbb8609812b9b098c6ce0ab36ee01c6
SHA1 d3175bea03440f2e066c8028d2ea27df78bd50a4
SHA512 636121374b7dbb351b10aa236cdb95392724ca3dd490f3f1b76512c68eb3f00b22614d0051d1268e824518448d439a5b15c267b267516a29756225948820c887
SSDEEP 96:KUAAKtePW7iKEM+qCZ67g86wQx5cpszExKL4zaxviqREQSKkwKZil:iihRJ67g86wQvcpgE24zaBiqREQSni
TLSH
T10FD1F31672BA12023D7E2E4893D497678AC272537014A42B3BAD04B6CD67E21CEFD9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 3beb3bd957854056d8cc8a2bcb30601b0d24ce152767d4896f61aa28819f8b9b
MD5 d85bcfcc8af6eb2247d766f7d3f7e646
SHA1 77fc516fbc5851f1c0421ec03e94a82c50acd6cc
SHA512 4abdd17a875279b7ac8d6aa6f3a83be339e89c960c7946b195289050945786d848825c8be725f527675ad19b2130190e78a50c7cf0334adddc80d22a1acec332
SSDEEP 384:pZcIhsNgEsRgQEhADgUa9xO7glzJrpg6HlytEDq11KD2:hhyh9DO7g9hpgoy6Dq7p
TLSH
T1B0928D3158785C765AF7B145F88B35178FFC4033EADA2E94A1EDAF1C01DB5A8130B826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 b5d6bf4166ba2ab92c9982505250f09f8a11adfa10017dbc29c2e49bf35bb3d5
MD5 28eb2f15fd7aa7b233f05295771b6b5f
SHA1 a48445d1236ce79a5f5aee7f6dfb85db190b5cf2
SHA512 b0d0cad55d8944ca5004b9d36a025c24ca6d003792bddc0e5c6cf669474cb60b8b41ae8b5a594932708b89ee916d17f98536e460c80a556a7c900ed210d14fd3
SSDEEP 384:EZcI3zsNg1ARgQEhADeUa9xO7glzJrqg6HlytEDq11KD2:ij579DO7g9hqgoy6Dq7p
TLSH
T12CC23AF058E75832D9AEA307E77E2D074EBCC023B6991A90B3E95A1CCC9A57FD306415
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ebf35b8c59ea3da9e2cccd0e0488a7b9a3a938dc2f67c4afd244d16bd904330f
MD5 7007ff9ef325ac963ba549655d403172
SHA1 46f324b9e9624329dba5042ba858b2db0b528650
SHA512 1bd452574d726766cd631546d311b2700f9a15565aadcb3fb5042579f49e09a6d391f800bf3b4d1c43f32ac5029f171f896e9e8e3e026bc3bf1f51cca5315458
SSDEEP 192:qONx6O7+3hQmiUy6OGttb0gO2VoIgG3mU6:qONx61MGt9xO7+WU6
TLSH
T1DE02E8356D6C6CB75EF29E46F98B37239FA8103BE9962F40D6E85E0C00D765C2343826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 55aabef67ad8e7f3bea3ef703d46f592f72dbac26c0b51db3de162aae276ee98
MD5 3ac973fc416bbbaf81815b5dab5b76b2
SHA1 eb9fa03df609ed3bb8751ff3365120cf02be78f2
SHA512 e507d8626e07e3260cb4b9e1ff306737dba630ebfe69f971b2b4fb466658ab0380f4b8b01f77d0011045ffeabfebe5146b1b9a740bfeb1d4b21f5cbfb46ab013
SSDEEP 384:xZcIhsNg1ARgQEhADgUa9xO7glzJrpg6HlytEDq11KD2:Zh5h9DO7g9hpgoy6Dq7p
TLSH
T194928D3058785C765AF7B145F88B39178FF84037EADA2E90A1EDAF1C01DB5A8130B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f13c85c9e72c531f6fabdcd850af3526a10cfdaa77df5ab7d4e6c1c514fcfaef
MD5 c4d844e84c16a3d7ee55510950e2331a
SHA1 5a12e99b5f3da16a86645196de715ad6621c60d9
SHA512 3159cacda6688c399ef9bd2985c2f0005c869b239fbc199386e0f48a9cc09cb86cfe50ee16f7eb42e02d44ffc6412c6f951fa85746ce2952ce4871d445a9784d
SSDEEP 192:KONh6O7+3OQmiUyGO0ttb0gO2VogHF0SJrNscN7qltU6:KONh6k+0t9xO7glzJrvgU6
TLSH
T1A5121B3578689C775EE2A545F98B35178FA94137EE8A7F80D1EC2E0C01EFA6C2346C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

d144e3f0-6a82-494f-84a4-99cca64fbdfa.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\d144e3f0-6a82-494f-84a4-99cca64fbdfa.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 5793497e73b5447e7ab0b8b75ffe93582cc58cda54d3a798a86b6bdf84f53075
MD5 6f29aa976b8bf10b9d0c31e1c920e15f
SHA1 9e0a38ed4112b2e2827da2948accc8503ed5784b
SHA512 075be3b7142af45f1e24f2e2c6d17a1fcd0d6ff453bf3a11394c36aeb35f28332741b0f44773276579fc754955cce9fe1d5301d43a35eb26c6c267e87cc7df75
TLSH
T14F410758BAEA1158B3776E579BF6A86E587BBC772E0AD05E00110E4E0933B04C861B37
MD5 SHA1 SHA512 TLSH

Submit Download