f2dbb14ad1634f38e70bb56535ce591440da1e14d93f7e9c81e1a711b37f43a6

Analysis

user interaction
yes
max time kernel
149s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 04:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
file.html
Size 327KB
Sample260804-exjjpacg75
SHA256 f2dbb14ad1634f38e70bb56535ce591440da1e14d93f7e9c81e1a711b37f43a6
MD5 175af27ee7695eea3521c34d6d11a2a3
SHA1 96e4fd78e556f0fa3e634cee2bfe32537fcc5609
SHA512 2350857e132027baf5e7c3e6d2ef3b78d625f9c4439868738c1d1269f3de6215d429ef77ab4a023037a5df6a788b568106ec0eef448668333bf16cc568632a2f
SSDEEP 3072:GYngAkHnjzxQ6KSAiTAHA88aW+LN7uxRLlzglKlf2WLl:JgAkHnjzxQBSA9g88CN78Blf2WLl
TLSH
T184643C25E5D2607F682B8033F27F3318B73FA483A101C925BA1CC5E5AFD19866177B99
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery persistence ransomware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
7112	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134302908256832756"	msedge.exe

Modifies registry class 4 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1014449518-1831897916-4205727055-1000\{0D6C4EA7-8F17-45ED-8617-ED4715D47DD2}	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{088e3905-0323-4b02-9826-5d99428e115f}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{B4BFCC3A-DB2C-424C-B029-7FE99A87C641}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1014449518-1831897916-4205727055-1000_Classes\Local Settings	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1484	msedge.exe
1484	msedge.exe

Suspicious behavior: LoadsDriver 10 IoCs

pid
4
4
4
4
4
4
4
4
4
4

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe

Suspicious use of FindShellTrayWindow 64 IoCs

pid	Process
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe
5364	msedge.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 5364 wrote to memory of 2896	5364	msedge.exe	90
PID 5364 wrote to memory of 2460	5364	msedge.exe	91
PID 5364 wrote to memory of 7112	5364	msedge.exe	92
PID 5364 wrote to memory of 2460	5364	msedge.exe	91
PID 5364 wrote to memory of 2460	5364	msedge.exe	91
PID 5364 wrote to memory of 4440	5364	msedge.exe	93
PID 5364 wrote to memory of 4440	5364	msedge.exe	93
PID 5364 wrote to memory of 2252	5364	msedge.exe	95
PID 5364 wrote to memory of 2252	5364	msedge.exe	95
PID 5364 wrote to memory of 2252	5364	msedge.exe	95
PID 5364 wrote to memory of 4524	5364	msedge.exe	96
PID 5364 wrote to memory of 4524	5364	msedge.exe	96
PID 5364 wrote to memory of 4524	5364	msedge.exe	96
PID 5364 wrote to memory of 4296	5364	msedge.exe	97
PID 5364 wrote to memory of 4296	5364	msedge.exe	97
PID 5364 wrote to memory of 4296	5364	msedge.exe	97
PID 5364 wrote to memory of 6848	5364	msedge.exe	98
PID 5364 wrote to memory of 6848	5364	msedge.exe	98
PID 5364 wrote to memory of 6848	5364	msedge.exe	98
PID 5364 wrote to memory of 5972	5364	msedge.exe	99
PID 5364 wrote to memory of 3928	5364	msedge.exe	100
PID 5364 wrote to memory of 5972	5364	msedge.exe	99
PID 5364 wrote to memory of 5972	5364	msedge.exe	99
PID 5364 wrote to memory of 3928	5364	msedge.exe	100
PID 5364 wrote to memory of 3928	5364	msedge.exe	100
PID 5364 wrote to memory of 2576	5364	msedge.exe	102
PID 5364 wrote to memory of 2576	5364	msedge.exe	102
PID 5364 wrote to memory of 2576	5364	msedge.exe	102
PID 5364 wrote to memory of 3636	5364	msedge.exe	103
PID 5364 wrote to memory of 7128	5364	msedge.exe	104
PID 5364 wrote to memory of 5568	5364	msedge.exe	105
PID 5364 wrote to memory of 2124	5364	msedge.exe	106
PID 5364 wrote to memory of 2124	5364	msedge.exe	106
PID 5364 wrote to memory of 2124	5364	msedge.exe	106
PID 5364 wrote to memory of 4752	5364	msedge.exe	107
PID 5364 wrote to memory of 4752	5364	msedge.exe	107
PID 5364 wrote to memory of 4752	5364	msedge.exe	107
PID 5364 wrote to memory of 5012	5364	msedge.exe	108
PID 5364 wrote to memory of 7088	5364	msedge.exe	109
PID 5364 wrote to memory of 5012	5364	msedge.exe	108
PID 5364 wrote to memory of 7088	5364	msedge.exe	109
PID 5364 wrote to memory of 3820	5364	msedge.exe	111
PID 5364 wrote to memory of 568	5364	msedge.exe	114
PID 5364 wrote to memory of 5800	5364	msedge.exe	115
PID 5364 wrote to memory of 568	5364	msedge.exe	114
PID 5364 wrote to memory of 568	5364	msedge.exe	114
PID 5364 wrote to memory of 5800	5364	msedge.exe	115
PID 5364 wrote to memory of 5800	5364	msedge.exe	115
PID 5364 wrote to memory of 6756	5364	msedge.exe	116
PID 5364 wrote to memory of 6756	5364	msedge.exe	116
PID 5364 wrote to memory of 6756	5364	msedge.exe	116
PID 5364 wrote to memory of 3268	5364	msedge.exe	117
PID 5364 wrote to memory of 3268	5364	msedge.exe	117
PID 5364 wrote to memory of 3268	5364	msedge.exe	117
PID 5364 wrote to memory of 4596	5364	msedge.exe	118
PID 5364 wrote to memory of 4596	5364	msedge.exe	118
PID 5364 wrote to memory of 3636	5364	msedge.exe	119
PID 5364 wrote to memory of 3636	5364	msedge.exe	119
PID 5364 wrote to memory of 5380	5364	msedge.exe	120
PID 5364 wrote to memory of 1484	5364	msedge.exe	124

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\file.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x238,0x2e4,0x7ff8b5bfc188,0x7ff8b5bfc194,0x7ff8b5bfc1a0
  2⤵
  PID:2896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1524,i,6593361742365185849,8521703814591158113,262144 --field-trial-handle=2156,i,15843604929889896203,12171673787918437611,262144 --variations-seed-version --mojo-platform-channel-handle=2152 /prefetch:2
  2⤵
  PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1940,i,2230053433704792556,6131344593654229457,524288 --field-trial-handle=2156,i,15843604929889896203,12171673787918437611,262144 --variations-seed-version --mojo-platform-channel-handle=2428 /prefetch:11
  2⤵
  - System Time Discovery
  PID:7112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2284,i,15350366781657859059,973135419157608929,524288 --field-trial-handle=2156,i,15843604929889896203,12171673787918437611,262144 --variations-seed-version --mojo-platform-channel-handle=1904 /prefetch:13
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3528,i,8732094247122658675,13816516357640768885,2097152 --field-trial-handle=2156,i,15843604929889896203,12171673787918437611,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3532,i,14375752078998077588,17027178263398023282,2097152 --field-trial-handle=2156,i,15843604929889896203,12171673787918437611,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5016,i,707210736084629012,13907226585008288404,2097152 --field-trial-handle=2156,i,15843604929889896203,12171673787918437611,262144 --variations-seed-version --mojo-platform-channel-handle=5048 /prefetch:1
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=5216,i,128710807922716708,2664135867851806966,2097152 --field-trial-handle=2156,i,15843604929889896203,12171673787918437611,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:1
  2⤵
  PID:6848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5920,i,10451140188466186991,13771481030110772160,2097152 --field-trial-handle=2156,i,15843604929889896203,12171673787918437611,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:1
  2⤵
  PID:5972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=5912,i,14855411427613064609,7300254576670273021,2097152 --field-trial-handle=2156,i,15843604929889896203,12171673787918437611,262144 --variations-seed-version --mojo-platform-channel-handle=5748 /prefetch:1
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=6260,i,7798658894056701575,13405764357451157554,2097152 --field-trial-handle=2156,i,15843604929889896203,12171673787918437611,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:1
  2⤵
  PID:2576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6384,i,3255084217235280674,16027978789197067658,524288 --field-trial-handle=2156,i,15843604929889896203,12171673787918437611,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:14
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6380,i,10394531107659218082,8788671189995318026,524288 --field-trial-handle=2156,i,15843604929889896203,12171673787918437611,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:14
  2⤵
  PID:7128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6416,i,18070756049526634568,15677185335060165,524288 --field-trial-handle=2156,i,15843604929889896203,12171673787918437611,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:14
  2⤵
  PID:5568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5064,i,18170009950691495442,615429223235132003,2097152 --field-trial-handle=2156,i,15843604929889896203,12171673787918437611,262144 --variations-seed-version --mojo-platform-channel-handle=3660 /prefetch:1
  2⤵
  PID:2124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5832,i,3000907678432688425,2830553445840058742,2097152 --field-trial-handle=2156,i,15843604929889896203,12171673787918437611,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:1
  2⤵
  PID:4752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6200,i,1169687651851877667,10038716193551269801,524288 --field-trial-handle=2156,i,15843604929889896203,12171673787918437611,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:14
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,5755470651533079699,14820286466722898533,524288 --field-trial-handle=2156,i,15843604929889896203,12171673787918437611,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:14
  2⤵
  PID:7088
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6568,i,18432638399702835748,16857410265173303767,524288 --field-trial-handle=2156,i,15843604929889896203,12171673787918437611,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:14
  2⤵
  PID:920
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6568,i,18432638399702835748,16857410265173303767,524288 --field-trial-handle=2156,i,15843604929889896203,12171673787918437611,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:14
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6224,i,16350374154989000295,13471836685164550758,2097152 --field-trial-handle=2156,i,15843604929889896203,12171673787918437611,262144 --variations-seed-version --mojo-platform-channel-handle=7128 /prefetch:1
  2⤵
  PID:568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=5912,i,8689091868306940373,11544618509962181442,2097152 --field-trial-handle=2156,i,15843604929889896203,12171673787918437611,262144 --variations-seed-version --mojo-platform-channel-handle=7124 /prefetch:1
  2⤵
  PID:5800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5624,i,8732519255842174733,7156188201947907527,2097152 --field-trial-handle=2156,i,15843604929889896203,12171673787918437611,262144 --variations-seed-version --mojo-platform-channel-handle=5600 /prefetch:1
  2⤵
  PID:6756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7296,i,9634552774467511365,198606847394372808,2097152 --field-trial-handle=2156,i,15843604929889896203,12171673787918437611,262144 --variations-seed-version --mojo-platform-channel-handle=7364 /prefetch:1
  2⤵
  PID:3268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7172,i,12376651614691697253,10337576736477163003,524288 --field-trial-handle=2156,i,15843604929889896203,12171673787918437611,262144 --variations-seed-version --mojo-platform-channel-handle=7316 /prefetch:14
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3756,i,12406675587755855493,3591397783010568200,524288 --field-trial-handle=2156,i,15843604929889896203,12171673787918437611,262144 --variations-seed-version --mojo-platform-channel-handle=1264 /prefetch:14
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7860,i,14504704211815795264,2582239780414462666,524288 --field-trial-handle=2156,i,15843604929889896203,12171673787918437611,262144 --variations-seed-version --mojo-platform-channel-handle=7864 /prefetch:14
  2⤵
  PID:5380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6288,i,15752437439951411230,505086556198457091,262144 --field-trial-handle=2156,i,15843604929889896203,12171673787918437611,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1484

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4080

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1964

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:6300

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f157f7329f2eba924aa0ca39485e6cde2fd8278825380c8456e9bec4022d2733
MD5 59bfb83bc4725eca05ff848ac3c2a4a2
SHA1 4d2623d00f7e4642df9afa30ce06597a532c5453
SHA512 e4c15acf75ae26b73ccdaa3290247d924d3a7f8025a4ef63ad06120f7648380481a6c1a9768e22ffc9e30b047079c9ae0efec32c522718f8316b4789f8905471
TLSH
T199D02321BB387CD7E5281571D031CB007A1A157362B792026650C40C5C7A9E266C76D5
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ba1406dd0117e6bb02a18e1f0ca40a20fdf33f68d611dcf6b59a242ae289374a
MD5 8a26ea5cde92773cb558eb116e113216
SHA1 2f807e9fd5e13c4ff550fceca7d90f11683ae33e
SHA512 dca9db1a71d0ad99193f78ee9f9221519b875eb1beb13ebfbd9d64a1b449eb8a027a5b2ceadf9158001b4548f036b26ed4f2c36ce3e8b981af5a54590c0e94a5
TLSH
T1B8D0C030B7286803D5141931D022CB007A17002321BBD1025160C00C2C3BCB163CA141
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 649B
SHA256 ae716c001ebea92582f902b79df130cf393cbb0d6226e7c1fdbf9f41019f5035
MD5 0a48129dbbe6f8b6ed284078b86b14f5
SHA1 e5974a07623b4e06b162adb39781ff41f6ca1cae
SHA512 44abe3973ec775e15ed6e3bbd204d32f9e807da00886fbf49c900e232827a259d66d34047898170c3c8bf78397566b1b23851959acd57b50c01ac2dcb38f60c9
TLSH
T1B1F02DB6D921BC3729FC1B2970A44B4BF750135B3B41985B3B3C921C4FB463B964691C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000089

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000089
Size 331KB
SHA256 db4ffbf0ec662620013dc14bc1268bdad6256d19d7d511ec7eff8446887e6900
MD5 05ef8155cf66131654d3bb9c9cba5853
SHA1 e79d53fcb604921222dd1dbc2f1c10c631ff6075
SHA512 ee38793245d91683ddb1f847e5b56a09864fd32ec059055459b3ebe101abed79683ee59c80f30b8f6249d2bbd83fbf7bca83dafb4ef2b634ceff6969c80fed23
SSDEEP 6144:FljUD58FLTW53eaLkNv+Ps0dj1fpqaGjYf0NIcB3bM1rJZ24:FDm5uaLcv+PFj7ajJNImbM1rD
TLSH
T1247423A9B50E3C8AC94F9473827EAFD2A4356FF38D47BAA3634241F401874342E4676D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

389228b7d24dc93b_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\389228b7d24dc93b_0
Size 298B
SHA256 76909f8a27e10e8ba503e38d6772cbf00470c637eca98e1ab585480abff0a33d
MD5 c7a7c759d8439790b6b4712e0b7651db
SHA1 dd2fa0c3f4ed050d6b627e94be9c52574c8a3082
SHA512 ea57e579ac0a23c0e7e9fae045e4c9c9f2356728c71da409531edab209e9e238d53e19204ada63230b9035fd257c28331b1cb2552bae866fd02db975950a271f
TLSH
T16FE02BF386E5818ECDB641F0C9FAB1EA43229CD4685CC28619C2C1675921672A4E1A1D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 0b2d5716c5fd423c5ca2260ad992966b8a629b10ae7095e8cd322ad55dcd39ca
MD5 992e8e2a670e489d52c703cfd1667e69
SHA1 5148bf3598dcf27c5d671599dce2d3f463f86ba9
SHA512 0f80f9901dbbc2f5e8b976a8cd0f247d6cc27ebc5aa12ab6539c97b399d97e32c6d780d3c6baf027599e1a369b6330771acbfde4a833bf6f093e2d38107031ea
SSDEEP 96:MSM4GpqXoolAw0kEtknrH+6Bc7nKluIts79sh:1W2lAwBAknreZK
TLSH
T1CFA15FA073922595DB389A7E96E1DC557FFA8885840F1EA790407DBEFC4BF8D04E0863
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5a4d56.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5a4d56.TMP
Size 3KB
SHA256 5fc538c5dd6d3dc96c8949a6292e3006aae2da12309fd179439a58d9e7f6b9a3
MD5 7c23fbb1c8be5fdf9b0e18062c2b463b
SHA1 87c3a1ccd9a69f6c4da70b2bd015a7c01c552e53
SHA512 0ec5fec270a9ba99d3a92a508a8fc8a75e5b914b12fb45510dec4c7c6a920506922940efea35fe414cfd3f5876bef0fc34fabc0b9d187597c07e8272802eb0ab
TLSH
T1C661F99273210AD2D7358DBE22E1D899AFFD9D96050F6E1A51807D7EFC0AF4214E1C23
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 21KB
SHA256 411022d88cd5b6a90b9696070d772a950bb55a476924fa75a625ac580ac711c0
MD5 c1ad91f6a239135ecf12c4f0783bae90
SHA1 1348c056053f01809fe039e0570872775573b2a5
SHA512 defb7712636d1bd4ad5372dbb39d5f8cab4390bd339b452ccb4adca6a1d09e460e63da259a44a2970a4732ff6a04c63fccedee6fabea3928d33a7255cb2d9295
SSDEEP 384:D1h9EOgG7OeNM5jLPttRDXxyAJeYmH6dEPsGvXebaVcaiGVZJm1ZmCshQqRZUAFN:1DWDIdtnjwdYbPv
TLSH
T115A2DAF7C7D4C62E881157F49614AE1BCE1D165A832C3C26C8E5EE4BE3E2432D15A64F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 e48c86ff2f459f1a121626579972b6f8e29ccb4c59175d7e1d81937275943970
MD5 e146efa2031a927249c7cf29aa3eeab0
SHA1 947249cc4c9bf091de44cb482d0b4f6b6a7435ae
SHA512 15b4242ed458ec562542c87e86856f4c8450dab2326f3ee48e18fc9b6b84e1e3e9557265add050292c413931e9bfb2d9133e95712d26d4105dca86341b780780
SSDEEP 192:sxRqRRyMqZjK1Ml8wb8/f9sioNRZ6EzoD8pe2S/g6+WNIYcC4ClsGQIGkIgjXJ:sxRqul8/f9sioN/6stS/5IW4gsGQ8j5
TLSH
T1B562D915AA749D3BCCCBD209FA957F93D6F91133A1905E44AAFC9E0C04E66ED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 d672fe7c7b78c91c6947e8ba9f943eced73a9d7140d24d32d91294ef5eaedaf7
MD5 ed65488596d006cd246f25e76114fe31
SHA1 74379c7a65e0ab94a689273499ff00a93381f84c
SHA512 75cf5589ed53150ed90ffe938eb7a13f22f084646b3c64f487885490cd9832eb270bcc3f6a22772f4bd941373a38b85fbac1c7957adfcc1173defd444ea730ce
SSDEEP 192:sxRqRRyMqZjK1Ml8wX8/f9smJNRZZEzoD8pA42AVy2/g6+WNqEyCYcC40lsGQIGz:sxRquJ8/f9smJN/Zsac/5HW4GsGQ885
TLSH
T1A372D916AA745D7B8CDBD219FA85BF53D2F91133A1905E54AAFC8E1C00D6BDD220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 569b091687eaef9378dbfdafaea9cf5e94d4d491295ae5eff22de105fb67ff6d
MD5 630afbaf811b65a89e843c3e814f22c4
SHA1 ae199532d0cf1d8a3997415090b641cafda233a1
SHA512 aee202fc37c7f7dce9dd56a6c9792a0bf0caee2ad5ace2f30ade04ca937140bfff8b3fccb813204a21e0ecba3a222603ae4ee2d676c4c51cca3c5703151e777d
SSDEEP 192:sxRqRRyMqZjK1Ml8wG8/f9smJNRZuEzoD8pA42AXoy2/g6+WNqEyanF/YcCR0isP:sxRqW48/f9smJN/usaP/5//WRHsGQ8e5
TLSH
T19372F916A9745D7B8DDBD209FA85BF93D2F91133A1905E54AAFC8E0C00D6BED620381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 91629ea3b8a0372f97507e19d23f8e5aaf3362274e630e2ca3db8d44a6264932
MD5 291ee6e6754a6de91d461b97380754f2
SHA1 73ca9890275d1bbeee60df33e3be07e19bf11c1d
SHA512 078f757d77e5e9b7c8a2a573beba0db1f1bb1d9c158baed629fe6ed702920a5ebe7c50c4e2915480d28f7b8ff814cdb06613143d020f17a68863d5c9a33e958f
SSDEEP 192:sxRqRRyMqZjK1Ml8wL8/f9smJNRZuEzoD8pA42AXoy2/g6+WNqEyanF/YcCRsisP:sxRqWR8/f9smJN/usaP/5//WRvsGQ8e5
TLSH
T17772E816A9745D7B8DDBD209FA85BF93D2F91133A1905E54AAFC8E0C00D6BED620381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 7d3fe53f40356f13bf5f80b8a59c2accd5b6f7496072b581951a504e1d84eac1
MD5 01d8c6aa475d35adbb364a9f9eab01ed
SHA1 386ed4aff50bc2425e328ba7b99d305f2a287e07
SHA512 a594fb03e8544b8db122c7738d4d4f9180db3fc8d1c86e970f5ca6ad2d9800dd2b92dd3fd1dbb5edef7ce4352d94dcc96d41580935fb31f83870b6478a0a79fb
SSDEEP 384:sxRqWqW8/f9smJN/usaP/5//WRvsGQ8e5:sW5W8/flLG/5nWRvsGQB
TLSH
T1B172E816A9745D7B8DDBD219FA85BF93D2F91133A1901E54AAFC8E0C00D6BED620381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 a4d4b6d728dfc7c536d3d6bcb19fad00638687f76418bbc84d9bf210e4905258
MD5 6f39294cf14ca60e275cfa7cc5358dd1
SHA1 20656405029fa7fa9cb6192130afd97c5fbdfec0
SHA512 c22d3054358983bd8c5a7a39c9e261ba1ef2eb198577010a99472ce441058e643759d9b93918b82c166c1c587eb5437c044cca436c27dbfc7511dad19230e500
SSDEEP 768:Ob4YATWg1NfwB8F1+UoAYDCx9Tuqh0VfUC9xbog/OVBbDwzroT4z:Ob4YATWg1NfwBu1jasHwAUz
TLSH
T142C2EB2B244CCB7E4F844A9DAC29AED76DD801CB9B984D5447EB890C03C67FB521A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 23KB
SHA256 25a16e7286714b483198efa95257bf4b4fb0bc9c9406b658a3e90242a1da0a9c
MD5 0cbf72db9f3d466c3cbb35e7fc744761
SHA1 497198abc7eb259e10b679f3abe09cd3f094a970
SHA512 0983dec572c152e8d9c5bbc3c147d4d5b6e8dc3b7dbc47bb70e0242662d23225de036c2d369dbd3aa08e90e5609641202d30f9373447e866c103efd437191d35
SSDEEP 384:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRPbIhJ9JVH:yv+Rp0nYrnhZZuJCXHnbB1S/HqlcDDRy
TLSH
T198B26B11713F4280387EA90C91B9D81E86C2B4637519E53F7BA802A65F67E139DFE8C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 b2f63a77e1e1c61eb4a2dc3f7d3928ec27de726855d5e14d2046f85bfe8d380b
MD5 edcd19833819364f7da94130a17063c7
SHA1 cfb726164d9a8f716d0bf1ab66d8cf67b1c9958f
SHA512 3d9f86069dc96d16fbbb7c11a3e34d5ad8f57ac1c694b81f288acd0a86fbb36db6a7e86be6b119eef308669e1494c65a8444e39cd268d3e2b4c926a7ca4f601f
SSDEEP 384:nIiFiZcIB8NLS8TUNTUlIR1PvuTiKReeff+GGnR9nnFLAz5mBeRs9JKgqijUNq88:TFQBQSwg3uHxGRw5mTjKgqmUN2
TLSH
T1BDD25B32DCA4DABBECE68EC5B6897646DEF04263D58CAAD4E5DC5D0D00971DE030BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 3b02742311ede279a1d7ecf95a79e0ba50b18656544a9f413248d2082e3c95d3
MD5 b7c4705f569964ba2303621bb10bcd71
SHA1 0b9e8e29d6cb5cd69f781ea2b5311de94a08d428
SHA512 7ad7575fdd52317fb796207ba77fd2d49c350d43999cfe1f28eb6f3c3c1dddbb450c7b388d05c4735bf48cbc96a34da08987cd2598713c1a468a56cccd546261
SSDEEP 384:nOiF1tNn/s3n9Sn8NLS8TUNTUlIRJPvuTvARgeff+GGnR9nnFLAC5mF8LEEIzNX:lF1j+9SQSwgvuMHGRF5mB
TLSH
T154B22A32DC95DEBBECE64BD5B64A3646DEE04263858D6AD4D9DD2D0D00CB2DE030BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 115afa4c1e1fc490bfb71c6ec6c2427c69b91e2cec05cd3126476b68c2445d76
MD5 19402356426d1516a4b0c56295cc3c80
SHA1 301bd0e6e16bb23b2ff27717e75921ebd48f746c
SHA512 1e6e3ced5bf4a9d87027559b4456b49035640eba49b4a6d1b9d65ba90a13d11cebbaa60c3430ccb9bd7f6894b0dcc306345e0abfd632ea138ab1469add051a53
SSDEEP 384:nIiF1tNn/s3n9Sn8NLS8TUNTUlIRJPvuTiKReeff+GGnR9nnFLAz5mF8LEEIzNX:TF1j+96QSwgvuHxGRw5mB
TLSH
T169B23A32DC95DEBBECE64BD5B64A3646DEE04263858D6AD4D9DD2D4C00CB2DE030BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 eeae74b6caa4bec8144df785167f81ee77de308c75cfa6e79f55aa9176a0804c
MD5 22dc4d243cf3e37b4e04fe60f0a4a865
SHA1 99ed16dcbcb45425ac8e66ff64bce1bea1b62a25
SHA512 1895e463439c799e274d3b59b67d0f36dd60c0b29f2fa8fb3e02cd5b31d2e5325bb497abda5380014f8c229d6b583ec48e7ec911dc0afc89d272ced68bb93cc8
SSDEEP 384:n4iF1tNn/s3n9Sn8NgO8TUNTUlIRiPvuTurReff+GGnR9nn/LWOObjI9G6w7uW8O:DF1j+9SXOwgUu6mGRRW29Mj
TLSH
T161C24A36DC95CEB7EDE74F98B64A7A4AEEE012A7859C69C4DAD81D0D00C71ED0307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ec77ecc8-3b0a-4e80-a50c-4b10da955e3b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\ec77ecc8-3b0a-4e80-a50c-4b10da955e3b.tmp
Size 28KB
SHA256 da843d7b08ff65b29c59b45a558e6d97159a9c80308e3a74e51b63b8e97474b7
MD5 0bf9aec212ca146c2835e6eaddcf6730
SHA1 48715c7b43fddac3c81e864dd2acc63a3d2e3fd9
SHA512 53c1f695dc238a20dd32bad5d7a7d46fd68d002857156f79954cc7ddf88bc62969dc0282572b924de9615e603923379f29818793052ca9a368a79eabd882ff1f
SSDEEP 384:n2iF6ZcIz8NLS8TUNTUlIRhPvuT2KReeff+GGnR9nnFLsn5mBeRs9JKgqijUNq88:dF4zQSwg3ubxGRc5mTjKgqmUN2
TLSH
T1B8D25B32DCA4DABBECE68AC5B6897646DEF04263D58C9AD4E5DC6D0D00875DE030BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download