bd3ee49a5ab19d15ddc44b421b0bdefce587790786989ae77cf3ddf1e6a2ba8d

Analysis

max time kernel
898s
max time network
743s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 07:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LICENSES.chromium.html
Size 7.9MB
Sample260804-jlavmavaka
SHA256 bd3ee49a5ab19d15ddc44b421b0bdefce587790786989ae77cf3ddf1e6a2ba8d
MD5 0e3e4362f785aff0b9e1852b1064c0f1
SHA1 a42ccb51e72bdcb5bb905a62efaa28857def3a17
SHA512 193b57efc5f5971fbd9e4ea1a80b34aadcc2a814ff49c4c06afe972bf327e98ff0498217a8bdef984b10fdec6e7858a6fb88c0b14936e0c6b404387a426b87f2
SSDEEP 24576:dbTj6ck6f5kVWS6RqLsWN3Omfpe666A6f6X6TTHW9GqpaE:tEx/i
TLSH
T1A786942F7B48037706C60262AB8BA5CBF21F903F3B561654345CD1681F6BA2583FB6D9
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
896	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303035911475123"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{7BB21484-156E-4D68-916B-0C916EFB2CD6}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3308	msedge.exe
3308	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe
3312	msedge.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 3312 wrote to memory of 1672	3312	msedge.exe	82
PID 3312 wrote to memory of 896	3312	msedge.exe	84
PID 3312 wrote to memory of 4008	3312	msedge.exe	85
PID 3312 wrote to memory of 4008	3312	msedge.exe	85
PID 3312 wrote to memory of 4008	3312	msedge.exe	85
PID 3312 wrote to memory of 4952	3312	msedge.exe	86
PID 3312 wrote to memory of 4952	3312	msedge.exe	86
PID 3312 wrote to memory of 2156	3312	msedge.exe	88
PID 3312 wrote to memory of 4040	3312	msedge.exe	87
PID 3312 wrote to memory of 2156	3312	msedge.exe	88
PID 3312 wrote to memory of 2156	3312	msedge.exe	88
PID 3312 wrote to memory of 4040	3312	msedge.exe	87
PID 3312 wrote to memory of 4040	3312	msedge.exe	87
PID 3312 wrote to memory of 824	3312	msedge.exe	89
PID 3312 wrote to memory of 824	3312	msedge.exe	89
PID 3312 wrote to memory of 824	3312	msedge.exe	89
PID 3312 wrote to memory of 2364	3312	msedge.exe	90
PID 3312 wrote to memory of 2364	3312	msedge.exe	90
PID 3312 wrote to memory of 2364	3312	msedge.exe	90
PID 3312 wrote to memory of 1632	3312	msedge.exe	95
PID 3312 wrote to memory of 1784	3312	msedge.exe	96
PID 3312 wrote to memory of 1632	3312	msedge.exe	95
PID 3312 wrote to memory of 1784	3312	msedge.exe	96
PID 3312 wrote to memory of 2100	3312	msedge.exe	100
PID 3312 wrote to memory of 4076	3312	msedge.exe	109
PID 3312 wrote to memory of 2232	3312	msedge.exe	110
PID 3312 wrote to memory of 3584	3312	msedge.exe	111
PID 3312 wrote to memory of 4664	3312	msedge.exe	114
PID 3312 wrote to memory of 4664	3312	msedge.exe	114
PID 3312 wrote to memory of 4908	3312	msedge.exe	116
PID 3312 wrote to memory of 4908	3312	msedge.exe	116
PID 3312 wrote to memory of 3380	3312	msedge.exe	117
PID 3312 wrote to memory of 3380	3312	msedge.exe	117
PID 3312 wrote to memory of 3308	3312	msedge.exe	118
PID 3312 wrote to memory of 1208	3312	msedge.exe	119
PID 3312 wrote to memory of 1208	3312	msedge.exe	119
PID 3312 wrote to memory of 1924	3312	msedge.exe	120
PID 3312 wrote to memory of 1924	3312	msedge.exe	120
PID 3312 wrote to memory of 4332	3312	msedge.exe	121
PID 3312 wrote to memory of 4332	3312	msedge.exe	121
PID 3312 wrote to memory of 3904	3312	msedge.exe	122
PID 3312 wrote to memory of 3904	3312	msedge.exe	122
PID 3312 wrote to memory of 2232	3312	msedge.exe	123
PID 3312 wrote to memory of 2232	3312	msedge.exe	123

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\LICENSES.chromium.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ff86fe7c188,0x7ff86fe7c194,0x7ff86fe7c1a0
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1948,i,17978729451823534443,3988270632448148591,524288 --field-trial-handle=2312,i,2361084785856043826,12988383160884502105,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:3
  2⤵
  - System Time Discovery
  PID:896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1732,i,3885483726609578995,6198258884681228634,262144 --field-trial-handle=2312,i,2361084785856043826,12988383160884502105,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:2
  2⤵
  PID:4008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2336,i,3844539485000975353,6206659978391516548,524288 --field-trial-handle=2312,i,2361084785856043826,12988383160884502105,262144 --variations-seed-version --mojo-platform-channel-handle=2976 /prefetch:8
  2⤵
  PID:4952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,5504670569502955779,17757953590270475488,2097152 --field-trial-handle=2312,i,2361084785856043826,12988383160884502105,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,16463460867867619756,8684147989260309960,2097152 --field-trial-handle=2312,i,2361084785856043826,12988383160884502105,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4164,i,2180144769921875679,9968081690288355769,2097152 --field-trial-handle=2312,i,2361084785856043826,12988383160884502105,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:1
  2⤵
  PID:824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4192,i,15720512255225369571,3558454546606085349,2097152 --field-trial-handle=2312,i,2361084785856043826,12988383160884502105,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:2
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,8172639115052227727,8951811273608180327,524288 --field-trial-handle=2312,i,2361084785856043826,12988383160884502105,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4988,i,14547650160478032278,10934604887391560946,524288 --field-trial-handle=2312,i,2361084785856043826,12988383160884502105,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,13429110935461765158,1819999607702916798,524288 --field-trial-handle=2312,i,2361084785856043826,12988383160884502105,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,13429110935461765158,1819999607702916798,524288 --field-trial-handle=2312,i,2361084785856043826,12988383160884502105,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:2100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4288,i,15556703637359244898,7550208107088504799,524288 --field-trial-handle=2312,i,2361084785856043826,12988383160884502105,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4280,i,16270517542529307971,16846629726551204218,524288 --field-trial-handle=2312,i,2361084785856043826,12988383160884502105,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:8
  2⤵
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4364,i,17747607203427074699,4831577285284452536,524288 --field-trial-handle=2312,i,2361084785856043826,12988383160884502105,262144 --variations-seed-version --mojo-platform-channel-handle=6376 /prefetch:8
  2⤵
  PID:3584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4376,i,2542842378810349462,610268452762891786,524288 --field-trial-handle=2312,i,2361084785856043826,12988383160884502105,262144 --variations-seed-version --mojo-platform-channel-handle=2244 /prefetch:8
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,18400709291439607051,17352155296699397475,524288 --field-trial-handle=2312,i,2361084785856043826,12988383160884502105,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5168,i,17655133184397682317,11274168010470258641,524288 --field-trial-handle=2312,i,2361084785856043826,12988383160884502105,262144 --variations-seed-version --mojo-platform-channel-handle=1684 /prefetch:8
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6156,i,13214375342707062714,3770991812848569602,262144 --field-trial-handle=2312,i,2361084785856043826,12988383160884502105,262144 --variations-seed-version --mojo-platform-channel-handle=6160 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5052,i,6240528915415256824,17203512517703436357,524288 --field-trial-handle=2312,i,2361084785856043826,12988383160884502105,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5536,i,9355796411212984870,2180759687576945636,524288 --field-trial-handle=2312,i,2361084785856043826,12988383160884502105,262144 --variations-seed-version --mojo-platform-channel-handle=6284 /prefetch:8
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6008,i,12571576560873620044,16724581164742216041,524288 --field-trial-handle=2312,i,2361084785856043826,12988383160884502105,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:8
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3560,i,8179821786585078541,5240686137256005746,524288 --field-trial-handle=2312,i,2361084785856043826,12988383160884502105,262144 --variations-seed-version --mojo-platform-channel-handle=3988 /prefetch:8
  2⤵
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5056,i,2191450254631990349,10092943187324049657,524288 --field-trial-handle=2312,i,2361084785856043826,12988383160884502105,262144 --variations-seed-version --mojo-platform-channel-handle=3276 /prefetch:8
  2⤵
  PID:2232

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4744

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 92b83a0e542b7bb3ed324c35b5f2a40c47a6351981065b804e4d9d80ddd6d7ee
MD5 9ea20a12d0c030ae7f84014f382662b7
SHA1 7912569189cf07c1ce092a268e67e9f391b7c8c7
SHA512 39ca414f13163c8479fe7650ae0dd1607b267fe3f319c09aec7bd5f68448e9ac604351069bf6b166b3f897d3afb5d7f35e609b9fc72b9debbcb05bad8fad7d81
TLSH
T132D02B20FF04E002D1072172540047100E0848902093C140E030441CDCEC804D395307
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7d64d2777f444a09968d6c155732e22d743fcf7c319c222bc06f6bb97808e489
MD5 89bc5edb6bd922f1cf8ec5536b066fa6
SHA1 c50aaf0fe1444780bb68ee7ab6e1c7468c2f303e
SHA512 77a1265c1484940562f1514202a0072e343efb323e1dcdb979fc9b7a2c69d85b814c076828b260c0b86a19e482ebb0a2df850f9b7c130a327861a7c56e26cde8
TLSH
T15CD02B20BF04E402D1072172540047100E0848902093C241E030441CCCED844D395307
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 e1724f879750662cda17eb0682ed1ade48b4ec5e0b400ccee78bb84f541a8291
MD5 789ebc2c1bb749bc42e46af9eccdd455
SHA1 e72b1cd0882ac25d15dafbccbc345a3dc7c5071a
SHA512 8e0204f42b1e5742a767cf3a65b8cf7956adbfbfa25c56ba39b57c7e9e1059405204d2423eb13faac7bb49a3c1dac2d8bfb6af6ae8b2d63c60f86ae158529b72
TLSH
T1FDE07D8648CAC23EB71E744B91E8578D82C8361EDEC8AE8A770C85897C01840B2C3FE4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 2b33261a37ffe8b534c5f2dfd960e3a96a74b9357ab49aac9812700296f2238c
MD5 70639921dd30711105a47074c79f68f7
SHA1 fb1f80661075b2e1545d94c71490961c3825613a
SHA512 7a1facd2813c265093483b96777909da8907c10b7e8b4044516103bfd0425549a79bba8ea8d2b650dac081a5002e10c64ebb8ce9c09ae8581315a7ef065e933c
TLSH
T14BE07D8684C8C26EA64074475168C38CD2E1374FEFCCA98B1F088CC9B443C84B6E2AE4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 9624ad8daef5472358086352366f04583b952d9d4c4ac8cd020090c4d13fe67e
MD5 04240863e77eddc9c62e47e7620f7a6b
SHA1 d53f7914371441fc06f5cec44180b805c6e2a770
SHA512 5b0a46d9c7813518e2fa1c2d2d64b575704babdd995852a0a0b01f8a30a676569822607b55ef4f9a7c87c11020667fe07d7c7515ef66fd8a9fca07454d3d0094
TLSH
T185E026C74AC8C2BEA650745751BC470D82C2375E9EC8EB8A170CA8887C81C40A687BE8
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 de5611bed34e3abb899f03fb189429b098155fb369cf741b9f8f322421d717a6
MD5 19caa5adde7259845da9fd0b6f7e406c
SHA1 98263eb0fd6b8dd0cc236fe71d811b33f706fd2c
SHA512 ed13e30cadc0657a2c83bcd33cfeeddeb5ed3b7daa8ec08ccfba0f9657567639489c964401b4684b4a912799211b09739714132d1fd0a914b5806f9bc0279b64
TLSH
T18EE026C644C8C2BEA755744F626C470C82C03A0EEEC8ED8A170888887C81548F79AFEE
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 38e035ab9f9634102b96dc0d5c7315f2b116247350dc9926f04a4ad5d40c10e0
MD5 74dc62e1f056950cce019961771afa36
SHA1 59b2af32003490f69b08fc9b6a34dce3fe458e6f
SHA512 47f1a29a8a8b52723f0a870b4ca72e083f077b7603b9cced762ee636e5bb5c796c0825a9640305685a6976be44b4d5f922d924d2bd3260d293b55f10d85b7b22
TLSH
T18C615C73021238E4EB324273A7D22744747746D8FE6BDE6B7C90BBB81A4535EE01912E
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588a78.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe588a78.TMP
Size 3KB
SHA256 9d730d30c6c8489a3fd19a523c53d67c4e88eb4d66d17d0e9c2c4284ba8616ac
MD5 6a61d359d3caab79542db07c45b7ce10
SHA1 a490da152d47c084717873cbad2954c86c8ac47f
SHA512 d706402f220e854865cc65c007f800d73f88fd337942c37ac1969acf26ef108adcfca8f494367c48c11eb25eccf204a88e6ff111285de9917bb8e9391877da9a
TLSH
T161616C73021238E4EB324273A7D22744743746D8FE6BDD6B7C907BB81A4535DE01912E
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 966B
SHA256 2bab6c805227c38b7bbff3454f4e0aa052b0313e4b5cbf2bd20694fe461dc73d
MD5 06d322a4ef41c234819206a69aa4c9a2
SHA1 d1590a505f0807675ad2e43cce170b07ccf5aae4
SHA512 956092ae138e4fe866b32db10c7ab979f69b79bca4e7cb015e0bd47fd3ccbbb0d25911319ea189ae9beff15c479a6de1bf87e213e15a6f76212a7c452e2cff58
TLSH
T14E115BF387E5859EC91116F05A28EE2BDE2D0506421C7D6985D4EF67D3E3075E002A9B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 5aef493167a58fd3f855de3661f4749b41e84b83979b18d649f4608da030b87a
MD5 e352a4a6329c288ac5a819fef8d576e0
SHA1 eca9ef954282c46ec54ca3b3e15c4c69b3b09990
SHA512 0e9a0b6b0b42253a4fcff293214431305884f6bfcfa1976ee9db9560279d0a9efa9ea2f7e1c321771f7337d9d08637df6f75a92fce71fb43f5793e49602219c0
TLSH
T1D3117DB3C3D5956E890116F05A24AE2BCE2D0505431C7D29D9D4FF2BD3E3475D10265F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 c766049b19c37ea31a1d6aa9fd7c6a48538cf06e51a4a719a531311b45b68b35
MD5 67a749c7f2eda4ac3c04955a6aab5e67
SHA1 e9fc3ab1393b1f729efeddbd6146ccfb3d340299
SHA512 25c9c9c2b6a3401e838249b30c071254240879812859596845fb8a0b0318bd79296ec4974a8c342f4db595d202819db8235d8c35b790317732c6580b4d7c5fa6
SSDEEP 192:sxZgREyM/jK1Ml8Mkw/frso0GTV2Idpd+HW6+WNGYvrQjqIIgrJ:sxZguMw/frstGtEHbG9L9
TLSH
T10C42D9116A34997BCCCBD30DFA51BF53D6FA147292900E54AAFCDA1C04E6AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 528db1cdf6506c30765c2f25648a453734804040ca999c2b6df9443f90a29ffc
MD5 f9487d688ceccf109a86358882061371
SHA1 6cfdd42f4949fdb68c99115d767a4b587e5f9ef4
SHA512 44d99233dda6b1e60277792c9f8688faba12c1d536f95328f01cc6c4c7d88824c6e17eb50cacb976d2ed3ca3dd0f95790a07dc1226a69125306131bb91c9bc3e
SSDEEP 192:sxZgREyM/jK1Ml8UQdkw/frsC0bTV2IdpH+HW6+WNGYv0HjqIIg5EJ:sxZguq2w/frs/bteHbGLLq
TLSH
T1F652E7116A349977CCDBD20DFA51BF93D6FA147292900E44AAFCDA1C04E7AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 573422947906a692800c22f76273744a682fb7055ae9fb6c4a6c753f61f0b367
MD5 6cf72b2ffab353e8038c5ddc38ed040a
SHA1 404d197d689247451a9fc2b570dffd308d4fa245
SHA512 475e33a11ebae41866063651d656b52b80fee68b016fe161b543361d0896aaa7c03dffd52824ac46f040d50843278b65eb44bd9ebcc255df28ea2b91c1f4f79d
SSDEEP 768:qAseJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0ppTrofC:qAseJ3xWvhfynu1jaVcL88pgq
TLSH
T17BD20B2B280CCB7E4F844E6DEC266F966EE801CB57984D5487FA884C02C77EB51275DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c41e8016-acfe-4596-96f4-a749f543712c\index-dir\the-real-index
Size 1KB
SHA256 a061f62877adf90abc1aa8451cd6142f399d368ed172518388aec67772fd7612
MD5 b566033a0d0594ce3f06d5cd27961115
SHA1 bc8f6202278dd2374cd9ff9e20092a7000c49ed4
SHA512 cdeb2c6a7e2241068c0e667bb2dfe13a6b2bbb3c687d6218031ad0b96dd7d49e4cd571be5b368b0f5c7ad638b9221631b149c15cf67210bcab345391e91df9e5
TLSH
T1DB21144D4E92955FD9B888B6107764E433F0CEDC571163635D7C663A1C2679D2D071C8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5cd885.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c41e8016-acfe-4596-96f4-a749f543712c\index-dir\the-real-index~RFe5cd885.TMP
Size 1KB
SHA256 2a1c4f28b4a42864b99f299738a2b870e3d1b4039966799cc5d1d8a462525679
MD5 8eda0a8ff4f4dfc1f1a8ff6639f9a984
SHA1 7a34f45f099a57f37f9bea12ce5c8663c42d414e
SHA512 901669fb67ba061b188258da5dc74595b3fcd3dcdb86358a137b57ee5136647f7fdd20a9c9a2d3f6371d1fb100ed8b1e7917a07ea3afaa97e1f0fb3371c0f50c
TLSH
T1592163CA86A24A0FEDD445B60143B4F47374CD00A322B383993D363E5C3479D1D4B0C5
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 3e4cbd591a6033cf41b79c4bfc497fc081bed9a3c7dfab0b277f6c3bb0d7dc3e
MD5 efd54d7c2b6314ddd62a77d7da9e6384
SHA1 12002f5ed5ff42ce32149f0e77de30a406ecb41d
SHA512 c9d5424b31790c6446f1d230c4c90eb5b47d454a63802f1bc632676ed9c525cc878c69e91e5a887afb3e05e412a04d71d50b9c2967d3df768dddff00da2deb47
TLSH
T12BE0C0762DD72450BEAFC3D164308090060A749DE941FC0E541FF6C310B231530D7C35
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 e6f3d2f913c019a634869f0c8acc3abe08d674807de4363d493ce9e048f8b25a
MD5 e990707f3349e1bfb33212f82822bbe0
SHA1 06bd264721ec4d62d635bf65e4c5a7b82af770fd
SHA512 01de2e58dfc543d6937a8d8eea50d94f64239e32cae4de5ec4ca271852d158f72864c0d73e1cd6ea30b7a5b087571adeb38168a0739bb3c0fa152db75ba9b5b0
SSDEEP 96:KYH+KggmArM/LRZJ2TZy9JL2KhTJV2ljrKFrnLW3S24gg+2wJloW+KALoE+8+WhG:49zTLW3S24gg9wJGWWLoE5+Wh0mf6
TLSH
T1B7914012317E02033CBF264DA295A6364F4635A379A8786FBBF804564DA7E111DFC8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5924f3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5924f3.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 94f0287eb0e7586c27be3fbdf3a486eff1c5304e07371ddf98fef5b2062d9c5d
MD5 aef310160a8e08b2d3861223b6aff42e
SHA1 11ff49aaebbfbbb684bc8551dfbabb9fdaf1e928
SHA512 5116cdc45aa1875f94cd8f63759d97ce847422e1cfb1a8eafe6781ced0d7ee350a3b5b669c17e23887e5e3341a0790e8ce2ebded74617972cb82c07c448ff187
SSDEEP 192:uBm+xasuheOwQxMGsN2PQhPJk3M7pB+QmiU1arr4MTxQClqyNc8z1rqzg2q7Yy:rZcIhsN2P+2c736W0Ilvd6g2qZ
TLSH
T15E626C72AC789D3A9AB7F241F88A33035EF99027A2C45F50E5EC7F1D05DA198030792B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 67176c06312dd12483d0078a4fe1c2102b7d9a36c92d445a24906c15dbe6a9dd
MD5 edffeb1289e00ef2be88f7de7356b24f
SHA1 013f7cdb5b4edeee5cbfdcded350f0e74c933512
SHA512 55026623ec49a2e7bc66d99fab3ee9493ebf37938bbab1eeb74ea0780a8bd00f9ecd48884f43031f5dadc4b95c47399b1994340c7b4cd679acfc44ec8c7f62cb
SSDEEP 384:fiFiZcIizsN28TUNTUlIlG+2c736W0Ilvj6g2qZ:qFQqDwgvhf3ZP2qZ
TLSH
T1AE823A739CA48D7BAEB7AA81F98A32039EF55077D5C4AA60E6EC7E1D00971980307D17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 86e540eb7fff071be079a82e9613db6b8dd2caedbb0ab693d128ee638236f22b
MD5 a0c06d035c765fd9b3d9f101167590f3
SHA1 2bca20f9808e141cc67c020eb3b6b21c22c626bb
SHA512 3e98735c5e9c55797beb0b0fb46d2bee819323d3d14b7a1b94278c10d2e77f5c7019aa706e1a3248cd07c5a756a331effd5a1cb9199b29027ea169d624aa9240
SSDEEP 96:eqONkPQsjpflMoUZre5ih/cIPURHl8h4otop5GODABjPYvlCr5pgz6qNGemL5Xud:lONP6vMtPQmiUy3kThTxQClT847OLU/u
TLSH
T14902E835AC786CBBEAA7AD45F48A23172FF4606BA5D05B50EAE83F1C00D765C1307927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 5ca6862c7a94c55343a291fda485c3ec6e43f61c13d94d60212cfdcd39675e32
MD5 fc14b6403d602c740678e3836a5e48cf
SHA1 162942c016909ed1ec0dde84d464326e496a0932
SHA512 2e6288aa8802cfe53e96a42343865fe2a70b44078bff942b2d9fa96ec6aa2f4e18695d8f5b6d19406e7f3c0aff11d39afd7e39bd9a9223e8c95eb29e5502c522
SSDEEP 192:uKm+xasuheOwQxMGsN2GQhPJk3M7pB+QmiU1arr4MTxQClqyNc8z1rqzg2q7Yy:wZcIhsN2G+2c736W0Ilvd6g2qZ
TLSH
T1CA626C72AC749D3A9AA7F241F88A33035EF99027A2C45F50E5EC7F1D05DA598030792B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 44e085979db949476fa0f037fc8e733900004ca77b2a80555b62e73312ede2c9
MD5 cac155d11fb13ec74617abd8cf78432f
SHA1 60435efe179f5ab2cb35643c9291d8bbdb6269f6
SHA512 be474d601b3591071b74f1bfcff8ec86bf63f75370dd1c13a3d92b77d57734dba697e841e00894b019de0594ae5da0a5c18b35d68d3c38efcbf79259d9931418
SSDEEP 192:2ON36vMfPQmiUyFkUhTxQClqyNQ80Irqzg2U/u:2ON36UfRBUblvV6g2U/u
TLSH
T13C120A72ACB49C6BAE93B581F48A32035EB5916BE5C49F50EAEC3F1C01DB55C1307927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b09fffdd-18e6-49de-a3f5-22e352fcc527.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b09fffdd-18e6-49de-a3f5-22e352fcc527.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 9bebdb8e2dbd95d58325cbcc7e65671cf13403c1d1fac37126d36994031f0d3d
MD5 d466731002e6307d80666d7db98be300
SHA1 ac1fb508a05beeca6f71682ea2661c71ab01de68
SHA512 04ff8b377d557e494ebe3c579b8f8c5214a5ad149ef108fb91dd50ecf99a848a81bf1ba80e70a12a932945ebf8f8251b5792713fdd777fd61626e0fd52380ac2
TLSH
T1EF41165CB6E91148B3B77F079BF6B8AE447B79372E46849E10110E8E0A62A40C861737
MD5 SHA1 SHA512 TLSH

Submit Download