7aec0c5124f1fcc82d2324329670d4bcfee97a2a6dc334032e2a9892399ea085

Analysis

user interaction
yes
max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 22:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 3KB
Sample260804-2gr78aztbs
SHA256 7aec0c5124f1fcc82d2324329670d4bcfee97a2a6dc334032e2a9892399ea085
MD5 75b15e237733364da2dbfc93f137705a
SHA1 f42024da61f902cb3556496ff7c4c936985b66ac
SHA512 fe4eafdfc9b7ee70e5351f0fba3f2f6ac597a91729ee6f232f57c5079aee077e4b9657935b549f1cb1c08cf756fc5923ddb40dbef1dd3b59f5b7a1cabdb61277
TLSH
T1E78176721AB5603A02E28C4825BBF71E7F51A103D5165100B3BCCAD90FA2EC3CCA7DAD
MD5 SHA1 SHA512 TLSH

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
54	discord.com
55	discord.com
57	discord.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1376	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303564231615394"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{9D559FC8-1B89-4D98-8AAD-9AC655B6D895}	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{7FF5532A-C841-448D-98CD-0A6197FE0DFC}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5784	msedge.exe
5784	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe
1156	msedge.exe

Suspicious use of WriteProcessMemory 62 IoCs

description	pid	Process	procid_target
PID 1156 wrote to memory of 2436	1156	msedge.exe	85
PID 1156 wrote to memory of 1376	1156	msedge.exe	86
PID 1156 wrote to memory of 4872	1156	msedge.exe	88
PID 1156 wrote to memory of 4872	1156	msedge.exe	88
PID 1156 wrote to memory of 4872	1156	msedge.exe	88
PID 1156 wrote to memory of 3828	1156	msedge.exe	89
PID 1156 wrote to memory of 3828	1156	msedge.exe	89
PID 1156 wrote to memory of 2432	1156	msedge.exe	90
PID 1156 wrote to memory of 2364	1156	msedge.exe	91
PID 1156 wrote to memory of 2432	1156	msedge.exe	90
PID 1156 wrote to memory of 2432	1156	msedge.exe	90
PID 1156 wrote to memory of 2364	1156	msedge.exe	91
PID 1156 wrote to memory of 2364	1156	msedge.exe	91
PID 1156 wrote to memory of 1712	1156	msedge.exe	92
PID 1156 wrote to memory of 1712	1156	msedge.exe	92
PID 1156 wrote to memory of 1712	1156	msedge.exe	92
PID 1156 wrote to memory of 4560	1156	msedge.exe	93
PID 1156 wrote to memory of 4560	1156	msedge.exe	93
PID 1156 wrote to memory of 4560	1156	msedge.exe	93
PID 1156 wrote to memory of 3936	1156	msedge.exe	97
PID 1156 wrote to memory of 2536	1156	msedge.exe	98
PID 1156 wrote to memory of 3936	1156	msedge.exe	97
PID 1156 wrote to memory of 2536	1156	msedge.exe	98
PID 1156 wrote to memory of 1832	1156	msedge.exe	100
PID 1156 wrote to memory of 4176	1156	msedge.exe	101
PID 1156 wrote to memory of 4176	1156	msedge.exe	101
PID 1156 wrote to memory of 3248	1156	msedge.exe	102
PID 1156 wrote to memory of 3248	1156	msedge.exe	102
PID 1156 wrote to memory of 3248	1156	msedge.exe	102
PID 1156 wrote to memory of 3444	1156	msedge.exe	103
PID 1156 wrote to memory of 3444	1156	msedge.exe	103
PID 1156 wrote to memory of 2776	1156	msedge.exe	104
PID 1156 wrote to memory of 2776	1156	msedge.exe	104
PID 1156 wrote to memory of 2776	1156	msedge.exe	104
PID 1156 wrote to memory of 4056	1156	msedge.exe	106
PID 1156 wrote to memory of 4056	1156	msedge.exe	106
PID 1156 wrote to memory of 4056	1156	msedge.exe	106
PID 1156 wrote to memory of 1064	1156	msedge.exe	108
PID 1156 wrote to memory of 1064	1156	msedge.exe	108
PID 1156 wrote to memory of 1064	1156	msedge.exe	108
PID 1156 wrote to memory of 2532	1156	msedge.exe	109
PID 1156 wrote to memory of 4196	1156	msedge.exe	110
PID 1156 wrote to memory of 4196	1156	msedge.exe	110
PID 1156 wrote to memory of 3780	1156	msedge.exe	111
PID 1156 wrote to memory of 3780	1156	msedge.exe	111
PID 1156 wrote to memory of 3780	1156	msedge.exe	111
PID 1156 wrote to memory of 4492	1156	msedge.exe	114
PID 1156 wrote to memory of 228	1156	msedge.exe	115
PID 1156 wrote to memory of 3796	1156	msedge.exe	116
PID 1156 wrote to memory of 632	1156	msedge.exe	117
PID 1156 wrote to memory of 632	1156	msedge.exe	117
PID 1156 wrote to memory of 228	1156	msedge.exe	118
PID 1156 wrote to memory of 228	1156	msedge.exe	118
PID 1156 wrote to memory of 3536	1156	msedge.exe	119
PID 1156 wrote to memory of 3536	1156	msedge.exe	119
PID 1156 wrote to memory of 3488	1156	msedge.exe	120
PID 1156 wrote to memory of 3488	1156	msedge.exe	120
PID 1156 wrote to memory of 6128	1156	msedge.exe	127
PID 1156 wrote to memory of 6128	1156	msedge.exe	127
PID 1156 wrote to memory of 5688	1156	msedge.exe	128
PID 1156 wrote to memory of 5688	1156	msedge.exe	128
PID 1156 wrote to memory of 5784	1156	msedge.exe	129

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7ffa5408c188,0x7ffa5408c194,0x7ffa5408c1a0
  2⤵
  PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1908,i,13173854186613446400,2645412646288027902,524288 --field-trial-handle=2260,i,142052373479328636,10748156535785009367,262144 --variations-seed-version --mojo-platform-channel-handle=2340 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1376
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,1642809899659993263,6588705681757944269,262144 --field-trial-handle=2260,i,142052373479328636,10748156535785009367,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:2
  2⤵
  PID:4872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2548,i,6310588809089476683,14486942941826726983,524288 --field-trial-handle=2260,i,142052373479328636,10748156535785009367,262144 --variations-seed-version --mojo-platform-channel-handle=2644 /prefetch:8
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3448,i,3762318687655011516,552320375940585227,2097152 --field-trial-handle=2260,i,142052373479328636,10748156535785009367,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,12181239299170237258,7640912203066702178,2097152 --field-trial-handle=2260,i,142052373479328636,10748156535785009367,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,7121081061550154928,16148705648612095145,2097152 --field-trial-handle=2260,i,142052373479328636,10748156535785009367,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:1
  2⤵
  PID:1712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4296,i,8244736075848723990,10345889551654997597,2097152 --field-trial-handle=2260,i,142052373479328636,10748156535785009367,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:2
  2⤵
  PID:4560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,4480001131533847143,2921260469774164761,524288 --field-trial-handle=2260,i,142052373479328636,10748156535785009367,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,6176724039773270578,16017058451518790111,524288 --field-trial-handle=2260,i,142052373479328636,10748156535785009367,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:2536
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5536,i,6686364807581154327,9587084585131694911,524288 --field-trial-handle=2260,i,142052373479328636,10748156535785009367,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:8
  2⤵
  PID:2584
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5536,i,6686364807581154327,9587084585131694911,524288 --field-trial-handle=2260,i,142052373479328636,10748156535785009367,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:8
  2⤵
  PID:1832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6224,i,9146569700391734516,5100279495795150758,524288 --field-trial-handle=2260,i,142052373479328636,10748156535785009367,262144 --variations-seed-version --mojo-platform-channel-handle=6204 /prefetch:8
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6440,i,16929021915258938543,14217494539384613518,2097152 --field-trial-handle=2260,i,142052373479328636,10748156535785009367,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:1
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6640,i,2632974461536748567,7683596985798526256,524288 --field-trial-handle=2260,i,142052373479328636,10748156535785009367,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:8
  2⤵
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6656,i,3587396297650823922,3458939082844712729,2097152 --field-trial-handle=2260,i,142052373479328636,10748156535785009367,262144 --variations-seed-version --mojo-platform-channel-handle=6784 /prefetch:1
  2⤵
  PID:2776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5536,i,1105887296160225252,3048380723066451885,2097152 --field-trial-handle=2260,i,142052373479328636,10748156535785009367,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:1
  2⤵
  PID:4056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6904,i,13603916024963108009,10144646329308765468,2097152 --field-trial-handle=2260,i,142052373479328636,10748156535785009367,262144 --variations-seed-version --mojo-platform-channel-handle=6984 /prefetch:1
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=video_capture.mojom.VideoCaptureService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6720,i,16964661931889626847,13297667156378527177,524288 --field-trial-handle=2260,i,142052373479328636,10748156535785009367,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:8
  2⤵
  - Modifies registry class
  PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6708,i,4903993950928557091,12077222166089430453,524288 --field-trial-handle=2260,i,142052373479328636,10748156535785009367,262144 --variations-seed-version --mojo-platform-channel-handle=6756 /prefetch:8
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=7220,i,2839302406835393345,11852985773257164269,2097152 --field-trial-handle=2260,i,142052373479328636,10748156535785009367,262144 --variations-seed-version --mojo-platform-channel-handle=7288 /prefetch:1
  2⤵
  PID:3780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3976,i,1570143575746311895,14039771734484848999,524288 --field-trial-handle=2260,i,142052373479328636,10748156535785009367,262144 --variations-seed-version --mojo-platform-channel-handle=7544 /prefetch:8
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7532,i,1068535877762719912,11529052967190396996,524288 --field-trial-handle=2260,i,142052373479328636,10748156535785009367,262144 --variations-seed-version --mojo-platform-channel-handle=7236 /prefetch:8
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4368,i,12190633014600142771,12005604654294885149,524288 --field-trial-handle=2260,i,142052373479328636,10748156535785009367,262144 --variations-seed-version --mojo-platform-channel-handle=7484 /prefetch:8
  2⤵
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4368,i,4851246898081596017,17746480689723963348,524288 --field-trial-handle=2260,i,142052373479328636,10748156535785009367,262144 --variations-seed-version --mojo-platform-channel-handle=7456 /prefetch:8
  2⤵
  PID:632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7416,i,10568036021040882654,4107252230451205263,524288 --field-trial-handle=2260,i,142052373479328636,10748156535785009367,262144 --variations-seed-version --mojo-platform-channel-handle=7596 /prefetch:8
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7428,i,8040721632673756550,6856005777012030171,524288 --field-trial-handle=2260,i,142052373479328636,10748156535785009367,262144 --variations-seed-version --mojo-platform-channel-handle=7412 /prefetch:8
  2⤵
  PID:3536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7744,i,13252421592470641793,7282770341650798156,524288 --field-trial-handle=2260,i,142052373479328636,10748156535785009367,262144 --variations-seed-version --mojo-platform-channel-handle=7808 /prefetch:8
  2⤵
  PID:3488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6348,i,11803915351602486456,4007177106335213005,524288 --field-trial-handle=2260,i,142052373479328636,10748156535785009367,262144 --variations-seed-version --mojo-platform-channel-handle=5428 /prefetch:8
  2⤵
  PID:6128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5236,i,9694295513104357639,5369606661153950971,524288 --field-trial-handle=2260,i,142052373479328636,10748156535785009367,262144 --variations-seed-version --mojo-platform-channel-handle=7916 /prefetch:8
  2⤵
  PID:5688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7828,i,13366898623773346412,316783154469284075,262144 --field-trial-handle=2260,i,142052373479328636,10748156535785009367,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5784

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3740

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 9a38114d99b6c05875ae9468596abb7e823cf9fd18f4fe2b6bc2180f73cdd21f
MD5 734ed32369a33092e5af169a5f1c6400
SHA1 0ab00a2f996579fe58c514dc8b219803cba9de47
SHA512 04030ded30cf60d41eb3764dfd5642f0188adcd4a84f6e384aea7e06d243aaac8ef80b76c3db8872468f568e5519ff4453a83b9566726f9db3ac7fbd22e36617
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7Y:fwUQC5VwBIiElEd2K57P7Y
TLSH
T1E4B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a612efa1a3f1d4ee262abb96d63f3b4a31c2ad6c544574be7246db0f52212e1d
MD5 e0045423d265fbb4204e2ccf9cf4e729
SHA1 5cd430c76a965b7d49eb6f686349a92180871674
SHA512 e0fe72d7795acfb0a22d0da2bf0fda4779e67429fc7f0868abc95950b557948a8b07360e9f45a7446cbe79ca28b10086e9e6f63cce1bc4e718efef8261f1e913
TLSH
T11BD09B55754D7415D31B01315411E360955A4462A172D2457120440DB97C81857E5257
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 7KB
SHA256 bd997a0330cd49c8e8087cb242fa712b9f370a11b333d06447c798fa008ba15b
MD5 f055651e980a0ec01fa0db0f7fdf5263
SHA1 e08271adf1302338e7142110df2e345f69472fd5
SHA512 3d992e9e0697b50fb4f75ba34cdce6eeeb69057ad0dacf47270280e9a659938bac6022d068d483f85661d2c3e5a90d64aca404207597552f96e245374da4f291
SSDEEP 192:lGSEV6LR5xQUFolRJ/qjcFxzyNEzGve0B:YSEeCxlqSdz90B
TLSH
T1DEF11DFD0FAB6851EB780138E8C220FD707E00788793EED5A150ADBC2A857C653F9959
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58df9d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58df9d.TMP
Size 3KB
SHA256 a480170a8461c5087cbc2043f7c4e18ad39dd4e6ab692acabe624ff592e09f7a
MD5 8837ac1b329d76935121f9b89ea4225b
SHA1 07fe45315519cdb715148fe347be15ea1d091af0
SHA512 0e42e5e1cf9c7f07e6bc93253bda7b68de629de13de7abb973e3ddc3f04d70e975b93227ead5ef24da5e0b96d3f739f0d874aa2da8d02bd585909efffce229c8
TLSH
T1CC714DF912AB34A1D7248230E4D306FDB47B40A5DB637E51C1009DBCAAC6BD997EEC18
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DevToolsPlugin.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\cgjgjfacjflmgphhhepmbhhbgjieaecn\135.0.3176.0_0\DevToolsPlugin.js
Size 8KB
SHA256 fe217348fd4d7ea4969f563ea9dbfc778e6591098a6fb26f231f859bbcef0128
MD5 7f32ca5d3f52675f538b041bd67c0444
SHA1 a8f6a8ff69ba0b3ead7a44d9b64fb009ab0e4e57
SHA512 ba763c633c8a959644535e9a2999e229db42c2fe61a57fa4e58136a05aa29d445f5e4278bcb5b529bc35e443534e516bad7cedc6d0ca2d408a5fe412f6e56df9
SSDEEP 192:95G3OvolW6gQWaxciQV23vrYbSrbS6tk63yidWJvy3BCd2nx3D8jyiQjElDXQqA4:95G3WoaaKDqxVIFB
TLSH
T13C02215EB8F62032F017B576197F8009B63540137418CE19FBED93A4AF92037A993ED9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DevToolsPlugin.js.map

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\cgjgjfacjflmgphhhepmbhhbgjieaecn\135.0.3176.0_0\DevToolsPlugin.js.map
Size 16KB
SHA256 1aa1227de1acd3b490b9fc09a2165788cb78afb9e0795a5d0a75f007206f907d
MD5 9eb2d561a925489b69a25fd78f7b47ab
SHA1 d989f19f74b1b436e0f84b29a1b6b99033e26603
SHA512 cfcdad655a516a610ee8b6d50d62868f42645e003696438668f8cc0aff0d9e9c569d878dac1cbacad7403b1816197618c8fb1ebe628dfd456fd54447cdfaf9f8
SSDEEP 192:fVuVl3E3tRsSjJ5FWQzgFMO4+wxVdGdFWdYixmrfReRc525y8uj5p6UJO1DsWy:fVuVlU9jFWQzVdGdFWuiYro5y8eQDg
TLSH
T13972881720BAD837B44767A718EB81A67E20545C7D98A70479CCD302F3D2F3BADB2865
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

NamedFunctionRange.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\cgjgjfacjflmgphhhepmbhhbgjieaecn\135.0.3176.0_0\NamedFunctionRange.js
Size 1023B
SHA256 aa5606bd8607fbff0998828a2285421f67bf46c986217a23bf54b8b9c62f9e96
MD5 fae98d8d75b2ddab58eb531d3c08a8f6
SHA1 1e197513c4ce482eb6aef6c436afba74c1c69e10
SHA512 fcb07e23e1e96f5d3141dcaa389b9e250c0aeeb94dc3dda9c9005e49b41f5c4b64b13cb68facabffc8c40154e5f25f5caacb1d41da4ce46e2b5050e74bd9cedc
TLSH
T1A3119B2B59EA1926AFBE2413BEDF33485631010B5CF688DCF42D93406F614678CB1F91
MD5 SHA1 SHA512 TLSH

Submit Download

NamedFunctionRange.js.map

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\cgjgjfacjflmgphhhepmbhhbgjieaecn\135.0.3176.0_0\NamedFunctionRange.js.map
Size 2KB
SHA256 a03e6965ec2315ae26572a646e4477fa341630038a50762149a19978a91a2389
MD5 b2816c88b5f892e2a6c0cd97af1b5896
SHA1 d422ddf8f1513981c623db31579adfed682bf54c
SHA512 5754bc51de04ad9e73849c1c0aaaf7702d0673b7f55b7f289a1f2c6f370f55a758f15bd7574097c5eb78aa236a2b47d58a7b7550150ed29aa557cce0b6166daf
TLSH
T11F415813441DAD333E1B225BBDDB16A52F31114D6CA82758B49DCB25B3A2F378971A42
MD5 SHA1 SHA512 TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\cgjgjfacjflmgphhhepmbhhbgjieaecn\135.0.3176.0_0\_metadata\verified_contents.json
Size 2KB
SHA256 5b1fc94e2b28caf5ccbea9574de0e42c860401620f0763c10cabe3a05a7154ad
MD5 70f58c8151600335b5ec548cade5b98b
SHA1 b916376a8c9e19541af0a787845f80535656478a
SHA512 e8fdf5e299909f96733d0b11c0617d3ca06a22283438f04d7395a4799c04672fdc5f7770e84b4cd0c66311b131e15c2e24924ce1f5e2417dcc9ed495b9685129
TLSH
T16451E730C470359C2D1A12304EBE1363DB51A3AF20817D1B38DDC89E2FB2B4754A7CA9
MD5 SHA1 SHA512 TLSH

Submit Download

typescript-tsconfig.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\cgjgjfacjflmgphhhepmbhhbgjieaecn\135.0.3176.0_0\third_party\typescript\typescript-tsconfig.json
Size 91B
SHA256 69500e16f1f9355aee311a80fe52f531ba348bb7f6d4667a2d33c3cd75113759
MD5 40d3e3fbfc100769071a2a27040e33f9
SHA1 e150fe3170a949d8a5d86e9135726cfdc5be6c59
SHA512 3ec8cab677386a19d82240628d27b0a1fcdf1aee56f59cfee994aaea96a1dfaf2b3eab73d0c1902503bac61bb2aef5ab281e73e4b0078994b1242104d9bb2830
TLSH
T13EB01220C5280C1006F975440F2D90018160594286565E2631CFC1384756634043F360
MD5 SHA1 SHA512 TLSH

Submit Download

typescript.d.ts

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\cgjgjfacjflmgphhhepmbhhbgjieaecn\135.0.3176.0_0\third_party\typescript\typescript.d.ts
Size 486KB
SHA256 2b06ea0beb73119a4294b56961eeb2337c6e706c8f0311de1bb49ca47c92abd5
MD5 9f7f369b169033ee919dba043b424a83
SHA1 ec2ec5846812d366045c969e5e03d037a6e1cbdb
SHA512 f84397b6219a1b07a1d5c1f9a470e1fbd9d3e7143c55c7ef345be147fb0a56b8609e97708cb0482711382f448da57b7fb0b1a55a9750b41d2083d9c86e74aeb0
SSDEEP 12288:HGeBiBCdVZ+dISrJXnMEEuIwmn0NtIRFqr0dhbPzPKUnrjM/MqV6VQ:BBiBCdVZ+dISrJXLEuIwmn7RFqr0dhbS
TLSH
T1E6B4C6A768D514B1091580E26AAE9041DF34E3A33719D0B5F5EC83BD0F1EEE917EB398
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typescript.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\cgjgjfacjflmgphhhepmbhhbgjieaecn\135.0.3176.0_0\third_party\typescript\typescript.js
Size 9.2MB
SHA256 eb27b35a442aab5e5963127d468c1c4ba0009fa67e18b2faf73f5e1bc1ddc6ac
MD5 fb1c951f849bca76b6aeec81fafb1ee4
SHA1 12a47c6376f82c9d529b0102d82214b8cea02e71
SHA512 bf05030b66e25e7ba27b0d999a670b582d602d639e84b1f6bef01894a95420e1f94c88cacfd841bf7ac4838754fd32e398cf0c5a4c362091ec48d8d572bb4dd1
SSDEEP 49152:8eg4L1W7tVtRPj3HydvhWw2e/L5/sW5iaVf7bnePoMM8AGdcBeEmkCPt2sr+nVsN:LW7t/RF5PB6kl
TLSH
T148A6F8BE39E230615A4B61766A2F9001B735D267320CD8D07ADCC3A95F1583462FBFE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typescript.js.map

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\cgjgjfacjflmgphhhepmbhhbgjieaecn\135.0.3176.0_0\third_party\typescript\typescript.js.map
Size 6.0MB
SHA256 5842f1041fc42ef727b2fee220a55f00bf38eff815920207d8ae560169aef766
MD5 bce05726f69c72ee12576c1ea1a3fba3
SHA1 575168a99c46fc263bb371e09be457d5c18f53be
SHA512 453cf0fc7ceeb1427ccd09bc16ee1354144fba1eb721b72c697eee4544a5fe9b641404d4de715e60dabf68a6ce1a6711353ed3161f442a1d5279a5fc666d865d
SSDEEP 6144:ITyuEDfQX2uiFwGOCqjXqW2N1ekQ4n5LeW:2PX6D
TLSH
T10F56A00201BBDD6BB45B16AB29CF81F2BE50849D7D98BA010988D715F4D2F3EBCE5472
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 7322d4dd3b9bce91d3385ad1f934a85792ce5932ea844e4ce65379ef892fd312
MD5 34e25120e41ad99decc6e546f564f151
SHA1 d6eb20fc38a5a8441137f0a59f56e14bedbe2eb7
SHA512 d81e337e7f9ac7e7842e391968eaf1523bf0ed2925a378b9fb52a1f4b123487c624b2239cb978ab516e4d463bc818598a21e884c8193add31e62c54241b74e63
TLSH
T140616BF3C7E8861DCA1156F0AA186E1FCE2D0954431C3C7EC9D5AE5B93E25B1F141A4E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 cefec4cd978a1fb0aba851ee0e236f93b229992870a3e32355205a55f06c75ac
MD5 644c02fdce0febfb1938dd1253e239a5
SHA1 2c2f53a2de746e74a253c6eca86d5cab89fc311f
SHA512 6e12e289b55d9147a11f2329a9b79cd77e94b7a7e0b7a750cb1b44b63a4d1630dda029cd74de05ca5318473be171913f81fc24befdd04f96d99ef2569c6cf8e7
TLSH
T1BE518CF387E8862ECA1156F0AA186E1BCE2D0955431C3C79C9D5AF1B93E25B1F141A4F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 48708fd6f97dfce1bc6de051eae3e8673040bdf4f21a1b6e0a1ff629c411580d
MD5 263b418f97864726c0974fffd8cef9ec
SHA1 334ba6c46d1e429e3645d22fbd5e5a592788cf73
SHA512 e1b6c2a4096fab0833d79572a154c30f92779546f19717eb7a4d1388fd1c3eca0c951f9e4004d29f8fd743552b70079e8faabfab86af6f6f0866a31ded676d1d
SSDEEP 384:sxZAH1t/fJZ9ZhZgZjZRUZyZeZOZj41xnOkuJzvkjwGfoB1svHFrqHbGj9:sYVt/f3jfW9RC8wAefoB6lGHbGZ
TLSH
T13992D6069924EA73CCD6A31EE6757F73D5F6462683802D286CFCC61C40A6AFC6117C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 53f571cdf033386b9271c6b1483814e8c518b55fcf5f8d2ba44c2762a5bb31b7
MD5 2bfd54517e93374eec26592d7ab4171d
SHA1 b69a6a2a2acd70d35fbf1f2a0985b982fdfe627e
SHA512 587a6c79fda5fc7dc4cba9b0abf8d96377103c87b958f69481a4fa1cd93f2e7c325025af10f323c9b5dff73e04fd1736e94f8d3a70ee17e0b0dabf6e86572e69
SSDEEP 384:sxZAHqVt/fJZ9ZhZgZjZRUZyZeZOZj41xnOkuJzvkjwGfoB1smH+r7HbG13:sYKVt/f3jfW9RC8wAefoB3efHbGp
TLSH
T1D192F706A924EA73CCD6A21EE6757F73D5F6456683802D286CFCC61C40A6AFC6117C2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 0eafce0395cf67410ca7ee6ffd12df8883d993970fe20c672987bfffe869c1ee
MD5 545620a0616a6e2033d9fc8fe8877787
SHA1 89c6c87f0c87311ea4b51fffd055e1c60cac8a26
SHA512 127904c5b63401f0d8183fa7cfea7b6a5cd234f2029ee86bffbff7a67f38155ce3cf5c8bcc191b60d5319bf403ad440e136db141ee562d30f2b3a1a81b9137ed
SSDEEP 768:b2UZYTMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4RhroVx0M:b2UZYTMWvg0Pou1ja7eLZmRagM
TLSH
T164D20A2B280CCB7E4F844E5DEC266F967ED801CB5A984D5447EA884C03CB7EF512B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 33KB
SHA256 0164af25b8be472b1034436a861970759ee6ae34fcbc65ad87304e18401dc2cf
MD5 776bdc6cdfeec60e7cd5044254e7f56f
SHA1 ce4e25beb491907f39bd079d6c3b925089649b61
SHA512 9ea7d199c92a80c0e7ba847cbff3468659477382c90fd6307d688544991333b9f69615f0bb3b3d71b77fd17035a0ef779af9da795529ad79519d9de2cfba2158
SSDEEP 768:byioUZYTMWvg09o8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjYeLlPZ4RhroVg0T:byioUZYTMWvg09ou1jacYeLZmRalT
TLSH
T1A3E21A3F284CCB7E4F844A5DEC26AF966DD802CBAA584D544BF6884C03C77EB112759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 233B
SHA256 21a6a1467e024951f077cb3151150af8392b96dff3ffe0bd747772dbafcb699b
MD5 7c9e731bc2f633edc96d5c72c5c34c63
SHA1 0db321fafbc1a3fc936e1385c8acd7a392b83342
SHA512 c25adc35279a89aa63c2dd6b4ec6484d9b17bdaea301bac6cace13226af5ff79d287e09251de08761c8300247d4d11074bd2e086914b81c71f3221f639509735
TLSH
T1A3D09797D0604891E73B5F402A32009B87203CCC08885018E80236292CB4B03E620F12
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt
Size 226B
SHA256 8b80f1c6090028c3657635b253a22c721978945a63347c8f1096b93fa2c77a83
MD5 315bb5a9d4752baf5f70f1e4f5f2bc28
SHA1 f9113eb7842e763f8d275fc70565be4c3fef4dfa
SHA512 741b064135c371c64701af428857b2369e9b4eb78b5f51e255f35d5c394622d34c014fe69b2c0e29af67ff33a11187e9e6961e973b00bd09d92d0d08dba9b596
TLSH
T1E9D0A7A7E0548AD2A67F9F502A22106B872139CC1489545CE80246255C95B53D611F56
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5875e7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\7d571773fef4871f82ca0457379cf2a39317562f\index.txt~RFe5875e7.TMP
Size 138B
SHA256 985587bdb72199948fbfa6e3902365226ec28fc0a790f004953c4a550fc3cb1a
MD5 bd1b6f113ee724f86b62246abdd800c1
SHA1 bb74c83f1062a3b5b8130be42a2d5c55af159907
SHA512 4ce45cc46dc6e3a809ebe7f63cc6e80d30e978199e9ce87f2bb0189d4b81c2dabce31a80283020ccc727315fe3a8bf3bc91fe8d3ab2d4933abb2e598727a3f67
TLSH
T171C02BE3E0940941872543500233004E87113DCC4C8B945C6413342430F4F636305FD5
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 58d15f0d185f379c59a4a5d41c079f28e7faab6785fea21be322a0070f7e4fb4
MD5 4b9e16800b884f3e5106360d2af3c0b0
SHA1 f2bcb43c9b3fbb8b03369a36d601330c6de2db49
SHA512 715d82fc7aa07f5379b36296c624cf8c9553ba025fdd0b2e81eaf4d4668443c3aef0cce205d0984c8ff06ad445e1af820166f0385bb0836194d18cda89465a5d
SSDEEP 96:KA1eK2Aoz2Ksom9WB9v3Hm1XoNX+TKvKX4Tz8UDS6wqUti+sOSb1iTqXmbKviXQL:E0BFly
TLSH
T139B1150232B712433C3D2908A399973A4F46F2937424A46B7FA944B25D66E741DFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aa78cefa-1fee-4fd6-a205-c56e98afb930.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\aa78cefa-1fee-4fd6-a205-c56e98afb930.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 a12972020bf2baffa4374715a79c0031a887ca1637367faf1f7a057b785594c3
MD5 53cd884517cb923efb5ad9b9267ad980
SHA1 84f9a4447594d60778e08812961dd10295c0a94c
SHA512 4d64b13dba64514abcdf50b726fea7d2252644a620930f11d2f7b83990273ee7976a90edba4b96f14cb56a953d5c6bd46216445e75668cc19eaf0174392511f6
SSDEEP 384:RZcIhsNILPgwUozX5od+KOrJUBeRs9JKgqijULXX:5hL4wOzOrJUTjKgqmULn
TLSH
T1DE926B325868A8769DE7E586F54A36134FF8A027DBC06FC491EC7B1C009A69C131BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8c5e2c5cffb306dcca973979352b2ee1ca5df96f66b73ea9a3be1cb828f947c9
MD5 b25abafc5e019f5597361358136d0723
SHA1 23d59e02a8267e0e77f3176dd8255518a973d368
SHA512 2f3c1976ca32ea63935dbda6649a7e4fe44fa79ea8007342c243c77a3681b98f26506f799282d147c7998975dcc6619373b6149c5492e2a88e4f0ffcf6d65b7f
SSDEEP 192:yONc61VWQmiUyWPgGX5Obd+juOFmI/a53s5U6:yONc6W/gGX5od+KO665U6
TLSH
T1F102E73569687C678EF2BE49F48B37135FA8207BEA506F84D6E81B2C00D765C2306C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 c4021e730aaf73f9c95daca7c29863b04c1b22a43d5720e506818c79c481e60f
MD5 7c1bb43e1019fd46c93b8344ea414187
SHA1 70fa774e82db8be7321ce5f6b693caca32928e83
SHA512 de5a79db8529289c3d4b9de64c3f46b65adfbf4283661ac3f1fc3f422fc4c850002bc949255059f30b703991e742fceb22d927ed662cb7ed5d7733cfb21f897b
SSDEEP 384:PmiFiZcINzsN48TUNTUlIlcPgw0UzX5od+KOr7UBeRs9JKgqijULXX:1FQ1xwgoIMOzOr7UTjKgqmULn
TLSH
T1E7D22AF208D79476D9AE9747A77D2E024EBCD067F5806A90B3D86A1CCC861BFD30AD11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 2ed6fd9b9ca85a23e52258ddfed9fea254d13d50d001605e462042b8a7dac9d1
MD5 ad7c649ee42ac034c494a339c0063be3
SHA1 a64b4896db716dfd5660b3b09b85c2b15907156f
SHA512 8a82cbc7628a11c6c8cb024b63585309b0d6375c28150dc10bbc484826599b9172b5cdcc8e2962786dd749072ca19c9cc62ce8345bffedde9cdf43fcb2f205d7
SSDEEP 384:vZcIhsNIcPgwaUzX5od+KOrJUBeRs9JKgqijULXX:nhK+MOzOrJUTjKgqmULn
TLSH
T1BB926B325868AC769DE7E586F58A36134FF8A027DBC46FC491EC7B1C019A69C131BD22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 752474a534f11ec155ce4ade4d352cc9a737d11a1fa4975df0e13e793a98c48e
MD5 4fca39fc77f343b23bab494cc87b106a
SHA1 315da84ae8fb7256ef9a7889f538b3b356c66eb2
SHA512 37828666b782c542ffa180252c946d11a3acdf204934c6c7666b309c5c97c97dde4bfe2b252e08042a078da8850f1633472aac51a7d8b7ff5bbb173a704c3772
SSDEEP 192:dON561zWQmiUyrPYGX5Obd+juOFm0beXjJlqj1U6:dON56gEYGX5od+KOrcUU6
TLSH
T18012F8326968BC678EE3E545F48731535FA96167EA856FC0D6EC3A2C01DB69C230BC13
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

47760f92-8669-4163-bd7c-ae1802c395f8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\47760f92-8669-4163-bd7c-ae1802c395f8.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 8fed55638283b074dcdb81131d9394a3083f3ace960ddc4bf9c0ab410b9342ce
MD5 12522af6a27b1c3dfe0e8a746056a461
SHA1 083cf29172e4e9e5a15f7188a9f2dc0d88e8001b
SHA512 70dbf35e80bd1b090c05669ecb62d1299c5b82373dd2c050989464090660f84a03f3b873eb8d1938a1381e19853638a4a60e0c63793b6d7b149dea4969bd54db
TLSH
T10641265CB6ED1108B3B36F1A9BF6B9AD847EB9372E06C49D10110E4F0A67A41D861737
MD5 SHA1 SHA512 TLSH

Submit Download

2c389654-0ab7-474b-85bc-49cc8d56495a.tmp

Path C:\Users\Admin\AppData\Local\Temp\2c389654-0ab7-474b-85bc-49cc8d56495a.tmp
Size 2.1MB
SHA256 efdad7555293ec2d14399c2c2fc9d07228de1f6e3746b27da621b76fe5ceea07
MD5 4cd67032e35fa92f5182df10df289906
SHA1 9210bfc66bd808ffcd7c6443e160dc8d6754c416
SHA512 f3d83f6e77e4568d2dae539c95acf0a886926a001b4d80f0ea602387530fc333f688ac031b3057e1c2b0375426cf47ae33315f7da9ffaec601102be0bb7221cd
SSDEEP 49152:ykR5Xz/3zNOm3NOHF4+n/UlfmCSJdm8IKXmiQeujzX:DVEkNOHJQOtICGb
TLSH
T166A533BB93AD6C15F3A88C67DCDD498641C2798E6161B7F619837C282ADC07CB47CE09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

91f6bc88-3aca-43a3-bbf5-d1a93edcd32f.tmp

Path C:\Users\Admin\AppData\Local\Temp\91f6bc88-3aca-43a3-bbf5-d1a93edcd32f.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

LICENSE.txt

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1156_1499332714\CRX_INSTALL\third_party\typescript\LICENSE.txt
Size 9KB
SHA256 43692cfafa6a5c09136cfa0138b9c78efeb56ee6b9174553dbf704b888771f6a
MD5 f632dfdde0adc0da86f701c6f2df38af
SHA1 5a7612b4d9977a7e79f60e88df556b09a90df828
SHA512 87722a2d675028d18ea276dcf18c24e891a0bad5f85f7387702310976d2fb8e1d0687321b0844b6c47947e6fbb489fe08bd1ffbe9772955ac7191ba4e274c8a5
SSDEEP 192:rwqW/NVo4UTo1YEHFNnFE6GhUGi2Re1CVThOCoHqxLJbzjwA:8ZhUk1Hf4Rg2HbLNB
TLSH
T19C12637F774903770AC30172B78BA4CBF32E903D3BA556644059D06823ABD6583BB69E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

DevToolsPlugin.html

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1156_637701373\CRX_INSTALL\DevToolsPlugin.html
Size 220B
SHA256 fd59488175e43bb4713fd621e785b618fc647a3521d305874722bd6b7fd1c649
MD5 0d09cc16eebaeae80fe58be258501fc8
SHA1 898cae597eb3039e94878df3eb5ab1c012bb5264
SHA512 f90c0ea0174598146450074c57344765b725ac0e44ca5c21f979b8f77370be94940aa53b684d9ef1e77c3090926e2004a931e6c0bfaa1f5bee3247a55799ff83
TLSH
T131D0974D08CC55A2432004636A26BC0C3F4CDA20813BC6A3E878C1582022EBC80D0880
MD5 SHA1 SHA512 TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1156_637701373\CRX_INSTALL\manifest.json
Size 766B
SHA256 072441aff81b94a2d6a4cb7e86c40fe27ae8a9701f7d466f76db124fd3d54330
MD5 c447a41c21cbb2bf5411029cb0936e13
SHA1 07acb13340be463e041ed22a2b26d5b567fd2023
SHA512 32fe5b340df5d7193bfe9bdaaccfadebc0e2c945f6cf61871f106e18daa4ed164aeb0d39f5552a09e3ed82104d69885288c8f4bc596a4e9291cdf627b57edd6d
TLSH
T14B01757D889FC8B782394B016893C48AF3354B5EA400A20C79B0C05C8871376E913629
MD5 SHA1 SHA512 TLSH

Submit Download

c76ffb9d-9f6c-40c1-ad6d-3afc29233dfe.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir1156_637701373\c76ffb9d-9f6c-40c1-ad6d-3afc29233dfe.tmp
Size 3.0MB
SHA256 2d69203739eca77886457d27c0df44eca47da02810061a7f5e15288c2e643f23
MD5 06f47f5ad37fb94be87982adc116d012
SHA1 4899ca7b1be75f8607b00b59b8469c8072f514ef
SHA512 b9ccbc3f2c45eaefcc4e157fb19eafd10eb54465f514ad16ada25e81390c3d577fa52aa6fc03461de6726694cdfda15ea96c5420609ac7a426e7b5afa43cab46
SSDEEP 49152:nqSGYpZHVTcorMCTt7OQvYilFbQ0NyNLvTAIPvWcfbcFlTfTGquf:n5pXTcoYCTYQAybMg7cfbcFPc
TLSH
T159E53395F69FF0F4D9A5F3317F8C765F16AAD387A30091D84283204A7BA9E210A5DF60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download