hxxps://ahn-partners[.]net/insights/workaround-signal[.]html?utm_source=brief

Analysis

user interaction
yes
max time kernel
898s
max time network
733s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 00:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://ahn-partners.net/insights/workaround-signal.html?utm_source=brief
Sample260804-ag36yasvbx

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4340	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302759291987017"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{FDAE9B4E-F9B8-4635-A6BD-8835E0C5CEA4}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4132	msedge.exe
4132	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe
1724	msedge.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 1724 wrote to memory of 3872	1724	msedge.exe	85
PID 1724 wrote to memory of 4340	1724	msedge.exe	86
PID 1724 wrote to memory of 4140	1724	msedge.exe	87
PID 1724 wrote to memory of 4140	1724	msedge.exe	87
PID 1724 wrote to memory of 4140	1724	msedge.exe	87
PID 1724 wrote to memory of 2272	1724	msedge.exe	89
PID 1724 wrote to memory of 2272	1724	msedge.exe	89
PID 1724 wrote to memory of 4288	1724	msedge.exe	90
PID 1724 wrote to memory of 4288	1724	msedge.exe	90
PID 1724 wrote to memory of 4288	1724	msedge.exe	90
PID 1724 wrote to memory of 436	1724	msedge.exe	91
PID 1724 wrote to memory of 436	1724	msedge.exe	91
PID 1724 wrote to memory of 436	1724	msedge.exe	91
PID 1724 wrote to memory of 2832	1724	msedge.exe	92
PID 1724 wrote to memory of 4556	1724	msedge.exe	93
PID 1724 wrote to memory of 2832	1724	msedge.exe	92
PID 1724 wrote to memory of 2832	1724	msedge.exe	92
PID 1724 wrote to memory of 4556	1724	msedge.exe	93
PID 1724 wrote to memory of 4556	1724	msedge.exe	93
PID 1724 wrote to memory of 1248	1724	msedge.exe	98
PID 1724 wrote to memory of 464	1724	msedge.exe	97
PID 1724 wrote to memory of 1248	1724	msedge.exe	98
PID 1724 wrote to memory of 464	1724	msedge.exe	97
PID 1724 wrote to memory of 4844	1724	msedge.exe	100
PID 1724 wrote to memory of 2436	1724	msedge.exe	104
PID 1724 wrote to memory of 1780	1724	msedge.exe	105
PID 1724 wrote to memory of 4632	1724	msedge.exe	106
PID 1724 wrote to memory of 3696	1724	msedge.exe	107
PID 1724 wrote to memory of 3696	1724	msedge.exe	107
PID 1724 wrote to memory of 3016	1724	msedge.exe	108
PID 1724 wrote to memory of 3016	1724	msedge.exe	108
PID 1724 wrote to memory of 4132	1724	msedge.exe	109
PID 1724 wrote to memory of 2208	1724	msedge.exe	110
PID 1724 wrote to memory of 2208	1724	msedge.exe	110
PID 1724 wrote to memory of 3392	1724	msedge.exe	111
PID 1724 wrote to memory of 3392	1724	msedge.exe	111
PID 1724 wrote to memory of 2108	1724	msedge.exe	112
PID 1724 wrote to memory of 2108	1724	msedge.exe	112
PID 1724 wrote to memory of 3784	1724	msedge.exe	120
PID 1724 wrote to memory of 3784	1724	msedge.exe	120
PID 1724 wrote to memory of 4088	1724	msedge.exe	121
PID 1724 wrote to memory of 4088	1724	msedge.exe	121
PID 1724 wrote to memory of 2608	1724	msedge.exe	124
PID 1724 wrote to memory of 2608	1724	msedge.exe	124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://ahn-partners.net/insights/workaround-signal.html?utm_source=brief
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffc3d9ec188,0x7ffc3d9ec194,0x7ffc3d9ec1a0
  2⤵
  PID:3872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1952,i,10913348905687366830,3095277036133233477,524288 --field-trial-handle=2224,i,11234568091153637193,1983636498921639020,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1824,i,2958920826454528580,11805292402764858130,262144 --field-trial-handle=2224,i,11234568091153637193,1983636498921639020,262144 --variations-seed-version --mojo-platform-channel-handle=2220 /prefetch:2
  2⤵
  PID:4140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2484,i,1527071585993451098,12430684532621056025,524288 --field-trial-handle=2224,i,11234568091153637193,1983636498921639020,262144 --variations-seed-version --mojo-platform-channel-handle=2560 /prefetch:8
  2⤵
  PID:2272
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3344,i,17622696906314279948,10042033937594229215,2097152 --field-trial-handle=2224,i,11234568091153637193,1983636498921639020,262144 --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:4288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3400,i,13063354521169731544,2174040219174881723,2097152 --field-trial-handle=2224,i,11234568091153637193,1983636498921639020,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4168,i,10789158286829008548,18098053804894590587,2097152 --field-trial-handle=2224,i,11234568091153637193,1983636498921639020,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:1
  2⤵
  PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4180,i,7144552109329464964,17533811046978452810,2097152 --field-trial-handle=2224,i,11234568091153637193,1983636498921639020,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:2
  2⤵
  PID:4556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5052,i,6115018635431298507,4415370906488183121,524288 --field-trial-handle=2224,i,11234568091153637193,1983636498921639020,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4988,i,5085978003920707407,15202943445118015991,524288 --field-trial-handle=2224,i,11234568091153637193,1983636498921639020,262144 --variations-seed-version --mojo-platform-channel-handle=5136 /prefetch:8
  2⤵
  PID:1248
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3592,i,4541672478131182926,9835054091313788220,524288 --field-trial-handle=2224,i,11234568091153637193,1983636498921639020,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:8
  2⤵
  PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3592,i,4541672478131182926,9835054091313788220,524288 --field-trial-handle=2224,i,11234568091153637193,1983636498921639020,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:8
  2⤵
  PID:4844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4180,i,7435741170704436849,2967246841581022980,524288 --field-trial-handle=2224,i,11234568091153637193,1983636498921639020,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:2436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4104,i,6530310418613393248,13419882661006459276,524288 --field-trial-handle=2224,i,11234568091153637193,1983636498921639020,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:8
  2⤵
  PID:1780
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=120,i,3128482916860193025,16532074465861889479,524288 --field-trial-handle=2224,i,11234568091153637193,1983636498921639020,262144 --variations-seed-version --mojo-platform-channel-handle=4476 /prefetch:8
  2⤵
  PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4196,i,17477148766976816592,3781802346592236235,524288 --field-trial-handle=2224,i,11234568091153637193,1983636498921639020,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:8
  2⤵
  PID:3696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=756,i,9142565393817848339,17622377951207606945,524288 --field-trial-handle=2224,i,11234568091153637193,1983636498921639020,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:8
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6172,i,12876333432499870910,4360618659209717962,262144 --field-trial-handle=2224,i,11234568091153637193,1983636498921639020,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1872,i,8430340002868440426,13976632280352397747,524288 --field-trial-handle=2224,i,11234568091153637193,1983636498921639020,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:8
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2896,i,5604142593659227259,8381009082801952256,524288 --field-trial-handle=2224,i,11234568091153637193,1983636498921639020,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:8
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6700,i,3739279518400373495,11017371254459319736,524288 --field-trial-handle=2224,i,11234568091153637193,1983636498921639020,262144 --variations-seed-version --mojo-platform-channel-handle=5456 /prefetch:8
  2⤵
  PID:2108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3944,i,14633362971899036396,372515971047215536,524288 --field-trial-handle=2224,i,11234568091153637193,1983636498921639020,262144 --variations-seed-version --mojo-platform-channel-handle=5460 /prefetch:8
  2⤵
  PID:3784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6840,i,2898380215354155700,6453576606946524071,524288 --field-trial-handle=2224,i,11234568091153637193,1983636498921639020,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:8
  2⤵
  PID:4088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4972,i,6813717996040876218,588300083070855575,524288 --field-trial-handle=2224,i,11234568091153637193,1983636498921639020,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:2608

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 8c605a069294252273e8780cd3583a8ae688781cd3bbfb104da743dbc8ec3349
MD5 a8e7775101a6fb7a72b1d795773346ce
SHA1 b9799ea7687f7095b06e80335d2c8a7bf7ff83c1
SHA512 e8db48802db3fbad8d233a135d79e6cfdbd9060a89d8c721205583699814479e9913260c391aba1592a96d4083787169edc78efabcd0d5d7fa9451747cc76d14
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7o:fwUQC5VwBIiElEd2K57P7o
TLSH
T1ADB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e2b315c59b1bfe8e547b0017a92548af7c81e08409e987a2628ad74667b4fec
MD5 7ab616f55807e9de5195a40c50f65e5b
SHA1 917a7797f800e5f30a1b9b8125127968246d7ce9
SHA512 da10f29803a072f42a2c102da0bee745cf1b1d47836e3d30e38b1e66beeb1abeaf2eb47b6c07b23682098f70fe2a4b29a0777eefa1380d0fff2509ff32d9b356
TLSH
T171D08023771D7182F35B41759053D7025A1680756463B701B325D41C9A740C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b976ac8901ffd41ec02a04aa583bc9d11350f0f9f714fb92d3341bb0bde4629f
MD5 504ce80b644a85a7e68d85bd24169289
SHA1 1f740a722dfa97fc8fb30626b0e3d6217e4a9864
SHA512 9406464a4f6becd85591c12af8a97fdecfa2208649138f347fb50d3e28f1583adec061050924fa0405e46eb75af7e299e6564c2ed039db9d82c50326da32a3c5
TLSH
T19ED08023371D7582F75B41759053D7025A1680756463F701B325D41C9A750C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 e1987955879e9215ecb975cca7119dd8b477b85a4e030215f320bb260719c70d
MD5 802419b546f3244acbac24b2d7185493
SHA1 cf49e8a5b9c6c96fbc28e6ea0b756c45e3833592
SHA512 b0cbe4c33611eebc03fea61bbbc392a127997cf85fdac2a037a84224514f7aea8dba34c275aa7b1eb27c10073cc3f7582099af439c42b62af1a69d3cfeb99f5e
TLSH
T1B8E0208505C6C21EE700744B9158630C61F03E5F9FC4EA892B20844D300D070E3B9974
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 719cf5782e81f5b35bb8c1c2ef34b2dccca02e76a2c04a3eb7c8ae65b064afa6
MD5 04612c338d13d4624b4bfddfea0ad017
SHA1 0c35beeef24d4dab26171a4877f37039933ef003
SHA512 c3d32578ecf4202d85cc1f2238dc893b7642f22b60cc42f9f78e051cc7509cd30ddfb8344702a2ad6c72de5834dcb8cdd60f3917bbc2eb302b5f488c98fd1352
TLSH
T1C1E020C544C5C21F9506E847619C674CC1C2361FAEC4A94D5F20CA5C710305063D7D7C
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 b6bcb495b7ce8de2cd4dad54b4705efacdd8864e730cab4bb1e0ea4d2807b68e
MD5 c53de968f01bba17a0b2962e50c2e863
SHA1 1ad11f4731053a80d863983b9f0f915eb56224d9
SHA512 fbe84ff62f67b55e87f553998a6454591b8702ba2bf759b5e4859cceabb975a3efe2c60fd63eb88104f782a5a2d7e5415d05780b65c419ffaa0906396722f684
TLSH
T12AE0809449C9C25F9904E8475254530CC2D0364FDFC5EF462B14898D75815A4B795B7C
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 02b0d436dd9a4cbc7156101c7141771b2e37f2b23aa89dc178fe33b44c0ad353
MD5 c8dc9fa8f70258a7895c48bbfd661158
SHA1 664928c9b8f8148c62d44eb0917ffdd3170cbed2
SHA512 caa4ce1cf6885dd6f66009c12532ab11249c3b5ea82d29a7fc1ce8cd2c94f91fa1039faabff17aff7e12dc5f0598ff215089a9362b1703675fcf63998ea28d4c
TLSH
T193E020C414CDC21DA54C74475158930ED2C0360F9FC5AA9B1B10CCCC700506073D9D74
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 6b679a14fdc48165a1399aa7fab9c0aa02004cdc51827bf57b53d0569210bb0a
MD5 aa0a409563880b73ab341265bda3b4aa
SHA1 d30f74534c3faf499e016b6383ffef856e2aaae9
SHA512 2ef394f96ef16fdbbcce6c723546c835c72daa698c5d739e99a5d9dae6c270ea92f353d2dd9b9a57725750ea98710751e41c491637a3d9503776ddfa2fa618d7
TLSH
T1E87182351286C8E1F3711131BCD9426EBB73A9D9F9E36EE151D0BC376508F92960715C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5870f5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5870f5.TMP
Size 3KB
SHA256 231df7649009738565c638b0c470ac5505fefb0145f1d0e82feb05e25890d1ed
MD5 22f077a034f9859d092facc8f7b24b0e
SHA1 15a0f8cfc0f3e3b45c9c92689cf2db32677e9d3e
SHA512 9ca78c75739c4c1d287799e7740e043bc6924b5b04f42c8cf0363579872494079e306525c9c05b4b85157302aaac410965015619c984679e5be566b0320bc9d6
TLSH
T1AE7170351286C8E1F3710032BCE9526EBB73B5C9F9A7AEE151D0BC372509F92964715C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 ef82d8f613316625f65c0c09a79d915f00e976d57b6c673fb631a9b12c8953e9
MD5 c2e5dd7ff0cc69bc2c56387873354bac
SHA1 ae632d9def4e5d61539021c7771b296670385e75
SHA512 0aee0ff0426c5879b91b21d33db9ae053f6783095728a1a2eef29260006416bae2c64a113fa2988bdb082e26d7462439aa069c4f79f17fab1e5fb0b9286acab7
TLSH
T12851BAB7C7D8896EC90212F4AB24BE2BCD1E0A1543383D2AC9E5EE5BD3E2475D10194F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 89c96dec557e6859c8efc58495174fb869cc2cb22d6ff52852cb37e6ec1261b6
MD5 ef0b1bd1a1f11a7e9a1f7d373aef7fd8
SHA1 127d71057d6a344b5d4d41bc38cd42c870d22fc2
SHA512 2173587c3650c77331638bac408474cf813cbfd29c357069e42b2388b04a837bdd07dce1d95371af462689e89402c389403528f4b8f007c8205ea42186b2480f
TLSH
T150518DB687A889AEDE0152F49724FE2BCE5E0915433C397A89D0EE5BD3E3071D141A4B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 a5719d84358243ecc1e1c58fee1f53e818c804971c447e94cbe094b1703efaf5
MD5 709d5bf169a0622c2307f4ae1fb02882
SHA1 7f720619edaf64e4cc24d9ab9244b8d51cb67d77
SHA512 92af0475271abe0d40a099bfca22f6e0cd401499b8bd753df5e85bf5f1716e705d0b4acc171857e971a0724a584b7b6d30968de38a121372cf2f854765bdaab5
SSDEEP 192:sxZmRdyM/jK1Ml8Mkp/fWXs4hrIdp5mHW6+WNOFa/YIx9p9IgrJ:sxZmbMp/fAs4h0sHbF/N9
TLSH
T19952F8116A34A9BBCDDBD209FA45BF63D6F50472A2900D44A9FCD91C05E6BED2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 57b49afb774f8b6b29fa5918e3444d271f8fc01885f01e8b77a99e214b4e5003
MD5 60203f9a42b69ad0fe39f76677cf8bf8
SHA1 5652dcb43266e3a6cb6e87fae8a68f0ed7e95530
SHA512 b6e3cb7e2f892c9703f7e8de49830196c1d22cee53db4e00ecddd6a303357b1e29293a8254c4bc81a6885fe6ad34ae1542c953a19229e07f00dcd16736f6ac96
SSDEEP 192:sxZmRdyM/jK1Ml8UQ1kp/fWXs+4rIdpXmHW6+WNOHndYIvMG9Ig5D8cJ:sxZmbq+p/fAs+402Hb6dj9h
TLSH
T1A252F8116A34A9BBCCDBD209F945BF53D6F50473A2900E44A9FCDA1C01E6BED620781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 e390e22f9ffe5d90ef27639ba3c1a6dbd0ea8b45c783a1b65f30323ed36162b0
MD5 70be1e1c229139b8b20f223fd43120f2
SHA1 ded1a4b6ff6ffa9768b7336af1be222e27030f7c
SHA512 53a11402abc4fe1b84b5eb4535cdc75734f8c2a7b2f5af0ba70708da2b16d3819ad27a84d283a4b936bce2a74f50ff6fb7fb1fedaea0c971f65e298383fc9abc
SSDEEP 768:EusqxXlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR9Yro+/sW:EusqxXlWvJD6Tu1ja54LAs9j+r
TLSH
T111D21B3B694CC77E4F840E5DEC266FD76ED801CBA6988D5447FA880C03CB2EA51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ee743e92-8f67-4188-9bcc-a865d9829eff\index-dir\temp-index
Size 2KB
SHA256 d510011243a2e6baebe4a63a876b43eb241c9c4b6e97464942eb1e38576bc507
MD5 5627255de78ca1628974857fcc1f35b5
SHA1 c7be1c5309e7e3c3566941af16155c3d3577be13
SHA512 09f180e7940fbfb4f32fcaed126c17126bc51ceefeee2b3e9406c1f421dfcb336c3ca0cb99b4706b3bd1b202fba2f05291c734ab116073cf6e2d6f043de6d230
TLSH
T16241B5CD4E418A6FD8A885B300B265A433B4A8CC7B5597175CBC2277B81336E294B2AC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ca34c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ee743e92-8f67-4188-9bcc-a865d9829eff\index-dir\the-real-index~RFe5ca34c.TMP
Size 2KB
SHA256 01ac05225458dcf2c2097a3ba49738b9e469a8cc5cbae34a679caf6059e58b35
MD5 e156e9bff026b1ee12b0e89e541531ad
SHA1 81d88ab4217f7d4bf45112443f3a6902c457f793
SHA512 01b50b877b06f966362d7f54ff772508a2e505d4b38446c15c9fd8bc423fd2e0d8933a2d01315429bd364c053a9bcd8e818be999b48955ab31b0df8039a63972
TLSH
T11041868A4E41861FD89080730A9274B43339994097167A4BA4FC573A78A17BD2E4E1D5
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 d9d24c5e22b5852e46ebd6fb5a505544137e8ee73bef31b39f1fa88841fb041e
MD5 92d5a2ed91872fc5edaa56368125b3c6
SHA1 921b699ff8614c9c49089736d5a1da8c908f4457
SHA512 fe19076ffd97198e57e7e09c548de97c21f179934c6a16794e03c96564991ea8ad0f88c0bf446d7125d95866201ff7fc3d2cecd668c206d391afb7b233819737
TLSH
T1CFE06FBA2AE71840A8ABC3EA087344A64514F828C891EC4F1029A28310623A02822C26
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 22d3abf5ab028542126e675647b81425804db5fafe79867473f6bdd6d5cdc349
MD5 dfa56e7c17fb6805e2857d8716081b8f
SHA1 d698337efc4fb83d837778bcaf3fca0083962516
SHA512 91f84726dada8e2b1fb7f90c90b276443a858ee233b2ed21e1b528de7c55e2aa9996ecb6ab63b11d1faade55541064420ac69c5cd4ef2d25d6c145d5a1f23841
SSDEEP 96:KYbaKYIK6G0K/ai2t6KWElUgKxmSONaK2A7:ExH3ZFDNK
TLSH
T146E1561B313A0662387E2948B2A6CA3B4F4231637518E57F7FB850A55E6EE110DFC8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 4de3ec2c0dcea8c00e56981949e1ee4507c9d27ea6db65d4db66ef7ebdcb40f7
MD5 a026e772ea443b81216ee006f8c02142
SHA1 f5507757d8d598e13246dd371a370634672f1fdc
SHA512 d10005ccbb5ed944f31ac3eaf7c2d0c662d37018870d52fbb84d20c965c02eb172cd91abfdd1c42611bdf0646e9becd213cf79179d62cf817d33b7e0e2de4895
SSDEEP 384:4ZcIhsNT1otPbN0HVRN5Oj9z9d+2fuchBeRs9JKgqijURUQD:GhBi1H5Oj9z9dlmchTjKgqmU9
TLSH
T17A929D315C346D769EF6B542F487321B4FB89027E6C52F94E0EDAF0D02DB99C131A92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 bced9cdb90571ac6625a0c9dc260d492e6680f7e6879880b5a60707161eb3bc3
MD5 673a6b7374a830195000eb5eaa9a150f
SHA1 a1552843d5f747362e40d350a6dc4b2ce4b42226
SHA512 e50415a06b6e523767306e5079ed63fdf232ead59ec57fc0622dd90e818ebd4194f230943284a0db774c286be5c72076888b4ca7b718642fd9bdc01363dc0a6d
SSDEEP 384:3ZcIhsNTYotPbN0HVRN5Oj9z9d+2fuchBeRs9JKgqijURUQD:/hci1H5Oj9z9dlmchTjKgqmU9
TLSH
T144928D315C346D769EF6A542F487321B4FF8902BE6C42F94E0EDAF0D02DB99C130A926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 07adbc80d68ef37a4d340b40eaeb8f2207778e3835e108e63246f6bd20bdfd1d
MD5 530195b1808bcf60774f3b3dbf3653c1
SHA1 7ca2ab9be5e3512881cf7f9e89eb426f65bccd3b
SHA512 317d323eada505a22a0c1d93d74abadfaeab9939a8b0fde8bdce4397d0792bdf07f4aeb6dbd161c069fbeaf16a9ac5c80feefe3d93c8a5f25dbc495906d60ba7
SSDEEP 384:EqZcIpzsNTYotPbNFHVRN5Oj9z9d+2fuNhBeRs9JKgqijURUQD:fJcr1H5Oj9z9dlmNhTjKgqmU9
TLSH
T1A8C25AF158E71876C9ED6703A77E2D074EBCC027B2841A40B3E86A0CCD869BFD30A915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 40312fe0c0bb02b3267504da84afef0bf4b3ef97017a07a18336f583be841305
MD5 389947a30ef229091cbae826ea24005b
SHA1 faa4b6b3bd0c0d35d9fe3c7922cae4adfbd0fd05
SHA512 824a6beb444a7d82d5e425af89f6b3a13e7c95e6e80f77865d42aed5f3cc3ce72de9c69b4305b2efc7c21d21ce6f27a91bb68dca70e219dced133fdf9e9295e4
SSDEEP 192:tONiD6JkRtQmiUyqXW+RN5Om5o92h3wRXU6:tONiD6UrNW+RN5Oj9+YU6
TLSH
T19702E935AD786CB79EF26E09B98737175FA4207BE9852F80D6E81B0C01D769C2347826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8ef7deff6dffd5fa3d62e0befb1c782fe63b4f442ebba594d9990012e14c80ad
MD5 b1e815ecc97133425b3f6fbca43919e8
SHA1 fb5d76f5feb7162f9a7791325046ab14cd7ee9b3
SHA512 a7331d7a19d923dc1e8e9152875645f3b5ae68d04f1c0a6ef5803756e91b437d843758e9efa4daf075489d3026ac4b55d9cb8057cb46295f5d01c764912dc8a5
SSDEEP 192:rONm6JkR0QmiUy1X1+RN5Om5o9nz9d+2fu0VciqGUU6:rONm6UEA1+RN5Oj9z9d+2fujhU6
TLSH
T1ED122B36AD785C775EE26541F48731174FA8512BEA897F90D1EC2F1C02EFA9C134B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

848d97f3-df17-4880-939a-39e3fdb50e18.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\848d97f3-df17-4880-939a-39e3fdb50e18.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 07576edff08214dd4f3283385439abb8b24d53e8e812d461ab88f397d47e5e61
MD5 83fed75c39cf328cee9152845f790dbb
SHA1 55a97bf6ceba5b06e1629ebcbdb812d9d859a6b0
SHA512 aba22ab417a5e4217447e5bd3e5e4b77d5f44a43765f7b53d14cc4d3a033dae5e7788e57833ee1dbc2a07d154eaec952e47dacf8b016879ff72245eef897ae9e
TLSH
T1BE41176CAAF91108B3B76F5AABF6686D487B7D772E06919E10150E4F0623A40C872737
MD5 SHA1 SHA512 TLSH

Submit Download