84c9cc8393c8d0c816540e050358eef75aa8b68c2e20f3beeec7f278d016d885

Analysis

max time kernel
898s
max time network
733s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 13:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 2KB
Sample260804-qq6w7a1gpf
SHA256 84c9cc8393c8d0c816540e050358eef75aa8b68c2e20f3beeec7f278d016d885
MD5 aff45fe208694d8c04bc0aee523886fa
SHA1 ca63c452281bcf4f3fa7cb0bbc931ed964e65410
SHA512 407b8bc3ce258a92a74d9496ff20753f3ea95c7628e2e532a8deaedc08b487526032c16bc149962d2e897b77932191030c8193d1abfc955271a0c57d8439eb15
TLSH
T16B41611369B0C8160374413A58D6F0489A66C2C7C368ED64F2EDA08D0FC2BD8CAFB3D9
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3176	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303237533908891"	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2246396966-3025826688-3847171515-1000\{7D8B2646-D962-4D27-8229-A3CE7C9B7072}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2246396966-3025826688-3847171515-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1336	msedge.exe
1336	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe
4632	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 4632 wrote to memory of 5720	4632	msedge.exe	89
PID 4632 wrote to memory of 3176	4632	msedge.exe	90
PID 4632 wrote to memory of 1396	4632	msedge.exe	92
PID 4632 wrote to memory of 1396	4632	msedge.exe	92
PID 4632 wrote to memory of 1248	4632	msedge.exe	91
PID 4632 wrote to memory of 1248	4632	msedge.exe	91
PID 4632 wrote to memory of 1248	4632	msedge.exe	91
PID 4632 wrote to memory of 4924	4632	msedge.exe	94
PID 4632 wrote to memory of 4924	4632	msedge.exe	94
PID 4632 wrote to memory of 4924	4632	msedge.exe	94
PID 4632 wrote to memory of 1760	4632	msedge.exe	95
PID 4632 wrote to memory of 1760	4632	msedge.exe	95
PID 4632 wrote to memory of 1760	4632	msedge.exe	95
PID 4632 wrote to memory of 3372	4632	msedge.exe	96
PID 4632 wrote to memory of 264	4632	msedge.exe	97
PID 4632 wrote to memory of 3372	4632	msedge.exe	96
PID 4632 wrote to memory of 3372	4632	msedge.exe	96
PID 4632 wrote to memory of 264	4632	msedge.exe	97
PID 4632 wrote to memory of 264	4632	msedge.exe	97
PID 4632 wrote to memory of 2332	4632	msedge.exe	99
PID 4632 wrote to memory of 3012	4632	msedge.exe	100
PID 4632 wrote to memory of 2332	4632	msedge.exe	99
PID 4632 wrote to memory of 3012	4632	msedge.exe	100
PID 4632 wrote to memory of 4976	4632	msedge.exe	102
PID 4632 wrote to memory of 4208	4632	msedge.exe	106
PID 4632 wrote to memory of 3036	4632	msedge.exe	107
PID 4632 wrote to memory of 4412	4632	msedge.exe	108
PID 4632 wrote to memory of 1840	4632	msedge.exe	109
PID 4632 wrote to memory of 1840	4632	msedge.exe	109
PID 4632 wrote to memory of 436	4632	msedge.exe	111
PID 4632 wrote to memory of 436	4632	msedge.exe	111
PID 4632 wrote to memory of 1336	4632	msedge.exe	112
PID 4632 wrote to memory of 5140	4632	msedge.exe	113
PID 4632 wrote to memory of 5140	4632	msedge.exe	113
PID 4632 wrote to memory of 4192	4632	msedge.exe	114
PID 4632 wrote to memory of 4192	4632	msedge.exe	114
PID 4632 wrote to memory of 2504	4632	msedge.exe	115
PID 4632 wrote to memory of 2504	4632	msedge.exe	115
PID 4632 wrote to memory of 5492	4632	msedge.exe	116
PID 4632 wrote to memory of 5492	4632	msedge.exe	116
PID 4632 wrote to memory of 948	4632	msedge.exe	124
PID 4632 wrote to memory of 948	4632	msedge.exe	124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffea74fc188,0x7ffea74fc194,0x7ffea74fc1a0
  2⤵
  PID:5720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1836,i,3641579738625304686,11913915717186382274,524288 --field-trial-handle=2116,i,4758048571230317010,507026769630865739,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1524,i,18237633964524417193,13707631867518078712,262144 --field-trial-handle=2116,i,4758048571230317010,507026769630865739,262144 --variations-seed-version --mojo-platform-channel-handle=2120 /prefetch:2
  2⤵
  PID:1248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2332,i,8610179610793814755,5149535456591437590,524288 --field-trial-handle=2116,i,4758048571230317010,507026769630865739,262144 --variations-seed-version --mojo-platform-channel-handle=3008 /prefetch:13
  2⤵
  PID:1396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3604,i,14822487424875740331,1871850003459779889,2097152 --field-trial-handle=2116,i,4758048571230317010,507026769630865739,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3612,i,7760894788342973967,6378868180451579861,2097152 --field-trial-handle=2116,i,4758048571230317010,507026769630865739,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:1
  2⤵
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4268,i,6545590208711275210,923269542889721447,2097152 --field-trial-handle=2116,i,4758048571230317010,507026769630865739,262144 --variations-seed-version --mojo-platform-channel-handle=4932 /prefetch:9
  2⤵
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4252,i,11395253111047949706,16378739873072117553,2097152 --field-trial-handle=2116,i,4758048571230317010,507026769630865739,262144 --variations-seed-version --mojo-platform-channel-handle=4928 /prefetch:1
  2⤵
  PID:264
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5396,i,13195821255102461064,13285289051985325368,524288 --field-trial-handle=2116,i,4758048571230317010,507026769630865739,262144 --variations-seed-version --mojo-platform-channel-handle=5436 /prefetch:14
  2⤵
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5404,i,10248968424071424252,5492381687585184877,524288 --field-trial-handle=2116,i,4758048571230317010,507026769630865739,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:14
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6012,i,13092179310382467793,4577936869607135775,524288 --field-trial-handle=2116,i,4758048571230317010,507026769630865739,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:14
  2⤵
  PID:2628
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6012,i,13092179310382467793,4577936869607135775,524288 --field-trial-handle=2116,i,4758048571230317010,507026769630865739,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:14
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5092,i,14447167671518912098,9028094161203407529,524288 --field-trial-handle=2116,i,4758048571230317010,507026769630865739,262144 --variations-seed-version --mojo-platform-channel-handle=5064 /prefetch:14
  2⤵
  PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5076,i,1316061937159518971,13171467308658674053,524288 --field-trial-handle=2116,i,4758048571230317010,507026769630865739,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:14
  2⤵
  PID:3036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,8990552634409608706,17962500214824525712,524288 --field-trial-handle=2116,i,4758048571230317010,507026769630865739,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:14
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3912,i,13147959352193154277,12603353593085345455,524288 --field-trial-handle=2116,i,4758048571230317010,507026769630865739,262144 --variations-seed-version --mojo-platform-channel-handle=5640 /prefetch:14
  2⤵
  PID:1840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6032,i,3458687076003765999,5583901752734523450,524288 --field-trial-handle=2116,i,4758048571230317010,507026769630865739,262144 --variations-seed-version --mojo-platform-channel-handle=2672 /prefetch:14
  2⤵
  PID:436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3808,i,4091385485749474251,5923136848674501083,262144 --field-trial-handle=2116,i,4758048571230317010,507026769630865739,262144 --variations-seed-version --mojo-platform-channel-handle=816 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5980,i,1204260957793863909,2661634086579431946,524288 --field-trial-handle=2116,i,4758048571230317010,507026769630865739,262144 --variations-seed-version --mojo-platform-channel-handle=5988 /prefetch:14
  2⤵
  PID:5140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3424,i,13459357963767863308,1249254921176652577,524288 --field-trial-handle=2116,i,4758048571230317010,507026769630865739,262144 --variations-seed-version --mojo-platform-channel-handle=6512 /prefetch:14
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5580,i,15415607819987290038,2439940217930357153,524288 --field-trial-handle=2116,i,4758048571230317010,507026769630865739,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:14
  2⤵
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6544,i,1056877644201678555,2873794414526988703,524288 --field-trial-handle=2116,i,4758048571230317010,507026769630865739,262144 --variations-seed-version --mojo-platform-channel-handle=3224 /prefetch:14
  2⤵
  PID:5492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3408,i,10870958793882506599,14094103464740824806,524288 --field-trial-handle=2116,i,4758048571230317010,507026769630865739,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:14
  2⤵
  PID:948

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4360

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5732

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3640

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:2288

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 67b546fed422708faf33930b82ff4826bc323bc64f67af30b02bb9e565fa27ee
MD5 04925ec9b8ab191e010732cba0eeefe1
SHA1 a6847bd1b4e86ab3cf9f2a8e109e78b04f51204d
SHA512 25e65b33281d8c58aaf4bad265d912d01bcadd9284dc1ce818ccc1dcf59200f57de5e8d8f4ce5ef6da06c777b54dd4dbee7a3aad7a16da9542538e92104e9c68
TLSH
T1C7D0C0343948E288C9832172DCA033117320007074B147054031B41CCE2049323DF5CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 719f844e62c5a3916fba05dc2f32d02dadec54c424efb41ba161d1fca59227ae
MD5 e633a9ff8da83df3b4dca0ad6f30e5d9
SHA1 610df135117504b2857ee3cc03a5ac9797b10333
SHA512 56404607616c88e3d1268893aa0c748db1db04fe698a8f5d214c6a2a533823ff606c3f2a3f007d08bc16bd8838597597f9fdcfe0f631495c1928104ff11d002f
TLSH
T16BD0C0303948E188C9832172DCA033117310007020B147054031F42CCE2049323DF5CF
MD5 SHA1 SHA512 TLSH

Submit Download

949e83e3-45dd-4a67-8b34-d5af7166709a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\949e83e3-45dd-4a67-8b34-d5af7166709a.tmp
Size 27KB
SHA256 1f47322d248afa5ba5848876502b47291322633bc475cf88563ca31444ed5bd1
MD5 6c03989878d9d1e1f54d796ca4ea5b03
SHA1 46e30784282e05c06d36fb5818c50a78ba2eaa2b
SHA512 83b86715d5944bc22e21e3492d051b218d43e5c1b039d2e1dc536d94977c77ded85c2b74e68980fb0b4b0fc026a8e8bc38e9bbf77c9646d3365cb72afe0dcfab
SSDEEP 768:kfISEvWgd5fWb8F1+UoAYDCx9Tuqh0VfUC9xbog/OVMSV23roHh0wp+x:kfISEvWgd5fWbu1jaBU2kHh0wkx
TLSH
T159C20C2B640CC77F4F844E9CEC25AED6ADD801CB97988D5447EA890C03C77EB522A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 22534d7f4cac8f9afb04fb1040738b0b57b9c5bb1c68422e5fd041275ca5d576
MD5 6f322b4591fb9cc505f56e4c9859aec6
SHA1 25f415cbbde42a814dacbe35f0fe86184e0d5463
SHA512 7739e5c1df5beebe52d938916e38846ad7f74c68783d5f379bd8c9ec0bf412c9b008c2270755cb63712ff6658069be6fe724676b8f3faa820a01e074f4d437cc
TLSH
T135E020D416C5C63E790478875174930D83D5364FDFCCAAE51B00D4947546C4066C1964
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 61b2d143ca939f6709b6bd2d1f59783a71381354d11c5be7fe6ccfe18c4730a0
MD5 2ae7a9695a34176eda7b707fdcbcb282
SHA1 ced52203d64910b368d17b288fe6a59ce2be422d
SHA512 752fca571d52119e942f9d0ef7d4c328e7a997d18670cde7c94e1ffad993aec23123878fcb95d09cb911a1029996ee82fc1f01531ddef8ee48e1cee9c25d9ac8
TLSH
T12BE07DC404CACBBEA740A647526C630C82C1360FEFC8ED8AB704CC8474C3040BAC6ABD
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 ab92baab7386c29c853236a0af073e61dd77759b2a3fc71014acb60be6d77317
MD5 e2f8cf73cc86a7f01ea69b0964595bb3
SHA1 b5e2d140906adb7ad17767fb3ebf3ebcc897a1df
SHA512 5bb98c765c82a7f99804ca057d0d52230a2105624bd4c4e691912165bfc42a5a0c2f1c434f9d37ecd1522fffcbc72ee8bcdfe2850e81a6f650523b22c7e48723
TLSH
T164E026D504CAC27EA604665791A8530CC2C0360F9ECCED8E6F00CCD57843040A3C3AF8
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 c04c3e3e0219426af3b1bc84478ad0892998f7df2e6199b7c16a17025f8e7226
MD5 cf34b0a6cae0a020290d58848e15d40d
SHA1 75ca0af5f94859b72e3f31fdf2570b8b80b2a226
SHA512 3d6bf6259a99563e11c4ec04b47b3fcc025c4ad8aa73d96bf218ee412e13599190da20fe5c7ea59f21679663639347fed7f192a2799ac1e3a997116c5fd1a9b6
TLSH
T1B3E07DD906CAD27EA618744751B8538DC2C1360FEEC8ED9B1704C8C9B803140B3D2EA8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 e6ca4308e7a9477793df05080fffe9a35bd90baf859341f6c1721042775bebf4
MD5 add1ebab00e5249c12d3f90e29c3035f
SHA1 1864c2c46b14066efe9854f23b50b642f81f0cea
SHA512 da2f53fcdbd3d87bfa95184e1e1b71277bbc3ce68a0418effe62f043aa3b08776e78a12a5109ab11fb274a84f37c0601002d849f2dfdf40e6b7d342b8c218e3d
TLSH
T134615096133D0ED3DBA484BAE4E656F836F2849586273EC9D8706FF09C4630B5C34A30
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe592810.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe592810.TMP
Size 3KB
SHA256 f9acc41fafc5932d77da670ce6c4cc96c277b3c4e1f8216bd742c5c5850b7ec2
MD5 2be78d1793baf90d0229244c196b96da
SHA1 ebff8fd1e4c96de267902369e74fc641d8d9d1fc
SHA512 ba61d3082adc3ea0a4280e631090c233a3d7b9e346cf4636ea4f9f0d8acd588ad1a5f8eba075af7d31d260c94b5abffac3e934b51827e306202583a6b71bd779
TLSH
T1E26150A6133D0ED3DBA484BAE4E156F836F6849586673EC9D8702FF09C4630B6D74A30
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 0f5f9560677af7e41512fee301cd6705cec32341f7f2146a8d103d29968792d8
MD5 99b6afc7161d2b122836a5688dca85a5
SHA1 ab232c0c02452c19899504c927436cb5c3262712
SHA512 4d12b2997d43d1bd36e11712548ed162666ef3b8270c9c81fc1be8e55ffd259e96a4f9e048d5de1afc6a04e961e35c2d4fe0e71c41b411d8d8c14e130d45951d
TLSH
T15541ACF7C3E48A7E890156F0AB146E2BCE1C0915432C7D66C9E4AE1BA3F3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 93187d323cbd9d3863d226af17506cacdd0d383da01eb701a2794bb847f3b5f9
MD5 07845ebd2324ef4b84e5181a166e8d3f
SHA1 ab806ec5f04fd3373c6bcc9c239f4f8ec388019e
SHA512 e81affd36ecc4a4f6dd8454e29d01c7c50f33f600d5c615f19c27ca852a0796c8462b8ebc7c271b530fc0e916932fd88b9b4a7ddd115af791e56bed2ad0e68bd
TLSH
T1C8418EF7C7E4866E890156F0AB186E2BCE1C0915432C7D6AC9E4AE1BA3E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 48583fed7c197e669d5268ad487290293483afe73be0c24864247767c984b906
MD5 bce8f3ceda5b483aa0c7dfd93638f03d
SHA1 b0273ce18de1854ca302006bd3c6564407c9e794
SHA512 fbdfedaddee4a686aa7b6e3197ae6aa2e9fada73aaf18ad1fa063d9a9616c77a4f1667cee96f5d6bb02710af4bf5e29e893f160d08c609b097f31ae83ee43246
SSDEEP 192:sxR4RJyM/jK1Ml8UQ0bN/fLsJQ/9gzoA8per/g6+WNIYZ7P3szGsIgDxJ:sxR4fqyN/fLsJQVZ4/5IppP
TLSH
T18F62C715AA24597BDCDBD20DFA517F93D2F95572A1900E48AAFCDA0C00E7ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 7461b60af19e5a159b7bb257e42256994fc1e2c2e394bcb2515dec976a4b8fb8
MD5 a02fa6119259dfdc7830b2806fa09891
SHA1 f69dfddc57213740f12042ae470865186c376fbc
SHA512 bc7f8b9c11507da298c76266c28899972adc6171a46ef248b24227be7f49d4fe15a32256dfdef559f8453b860e4f50a02d913c3ad91085217137afd4df365396
SSDEEP 192:sxRXRJyM/jK1Ml8wbN/fLskc/9gzoA8p4r/g6+WNIYZ7PKszGsIgIJ:sxRXflN/fLskcVZa/5I6ps
TLSH
T14D52D8056A34597BCCDBD20DFA557F53D2F95563A1901E48AAFC9A0C00E7AED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 d45b654a552ecd12876bb8382fde7c27bb1013bca59e2fbfac72fb41f56484fa
MD5 115eb3a4c71e4700ca2ce5019ebfd0af
SHA1 ee50f5317e43d083de697a563a318922acad7353
SHA512 154b86dd8a92bbcf2d38bcd87a3d47f1c4884eba7681398a5b672785bdaab2164d94b9a7c65febdfee16deda67a5c7b6cad12e1178907cc281c0e06c58bb9fb4
SSDEEP 192:sxR4RJyM/jK1Ml8wbN/fLsJc/9gzoA8p4r/g6+WNIYZ7PKszGsIgDPJ:sxR4flN/fLsJcVZa/5I6pV
TLSH
T1A652E805AA34597BCCDBD20DFA557F53D2F95573A2901E48AAFC9A0C00E7ADD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\87ecc485-72c5-422f-af9a-65958309a3cb\index-dir\the-real-index
Size 696B
SHA256 6467e4f2037ac5358c36b3baeba57dc4dbb6d9e0bf5e7f7095196f2f1c77ad9a
MD5 6d31cd67cf7117088cc5e935ed7a0c89
SHA1 17ffde1ad72a634654d8a647bac092b4a03fabe1
SHA512 5c5978a35173614a39bdf9c9de5017a9ea94615cc475280fff1246c6fdc74dd3f0dd5ca25f2c2bd3f853dcef81904407e122c52e56733d8d217c51b97e8ad23c
TLSH
T1F80105A74CC62887DD21BAB5673A248D377F00FC1B469FAB005D8D399A876344D85345
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d6a55.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\87ecc485-72c5-422f-af9a-65958309a3cb\index-dir\the-real-index~RFe5d6a55.TMP
Size 696B
SHA256 85899f5a9afade09742717b0adf78377a7dda9f38dcd23593160a88dd18fb3ff
MD5 7abe281431a000623994aec7a0b92752
SHA1 27a42d39e6b0bf91dcb7abd4e3e2843dcc381dc0
SHA512 74ac68453103979774e5c6ca5427f2b4fa11be4b6c0dd4be86a55c8fc40dbd608e7b0d0dcf8ff69f1a317e8f3c8fdeab6baea70a09c2428997a39777d23f925f
TLSH
T1DE0154FB41D26CC3DD2271B8B6066149337E0420260ACA8B60DF39A64D936184A41252
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 d7ef29ab4836d6246086474f724dda832454ae839c52a966e9be900583b1957b
MD5 6ac23269d643ced02e525a43287b6b8a
SHA1 5b8373afdeea5af512126181a2e2dcc0f76fea74
SHA512 63aaeade3f48b1e11712c165faf9bc29d95882a49eea19727df85463c18cf44b30a550e5b8b5b14158642ef7a2de49bfbe92ab243f187f941401e2a8129943b2
TLSH
T159E0C0B72ED70814FD6FC3E7243580B00005BD448545DD4E7429428720F2715302BC66
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 4229d4dd4c7036951e73387f6592cfc07e50479a0583ae04ab8d2078a06630e9
MD5 4f9f3d22e2e0f757c3ccfeb517f7464f
SHA1 8a1154ffe96b92485f788b680425e389f5018ab3
SHA512 33398b35a1c48e41c446d0fc81a55818701ceffa68de8f67aaa5e8faeb7ce9cb3f130603394abe1e456c6d909f49f24162ab0feca2dbe6630ad54f6cef5a0cb0
SSDEEP 24:KSi2Ei+ifiLPiYSi5i1i01iZiYDi/I4izi0KXi3hPi1i01Ri7ikSriq5i7Jibipx:KQrI1KU8QTyt/I/RI5KyEkjyFpIBKSkl
TLSH
T1E591414675FA43943DBF24088069CA26D6837176761CE82B77E840B31FA6E040FFC8D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

70293d3c-18fb-4b41-9c7d-baabbe6e95c4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\70293d3c-18fb-4b41-9c7d-baabbe6e95c4.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 76a59005c29356b62e105bad235351f7f86f606ecb8cb3227b972256e81e67ff
MD5 c35cbf83943771778d78b902354fbd81
SHA1 b4116858b92fc357934d6f024bf5528d6fe4527d
SHA512 0ac8487fb63d418560d6c987ca38f28d7b0afa331b9cffbfd01ccdf506411e51a7c92353ee86c91de3f322b47a1c172306136eba9027e608f2eba338aa205162
SSDEEP 768:jrv+4UNbdZ3+0q4kAam6aQMGdjWca4Ghf9YPxUQ:jbsbf3RGmaME6pYx
TLSH
T1DCF2AE31A86899739CB79695F21B7643BEF451A389C80E90D9DD6A0D039B0DE330BD1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 8e1a0173fad6cd9af763826a95fb6b42ebd5490b34b78523d3a5a9ae980f213a
MD5 52018c72097418ca728e254cf23181f6
SHA1 7fd900b0d9766c6a90cf95fcd1c2e5f8036a60b0
SHA512 94688099c8a5cb2a018784f313a08f2af3ddb0e83357131f184e5bc09f3a9f82bc53e709b583c886d1fefcf6e9293d97209340e73c878ecdf4ea3d8677baf4b1
SSDEEP 384:xZcIW38NMjqlmiv78ip5d+dfYbkjg8BWmkA1QiZh6vPqQMQYeJfjWca4G2KCQ9Yb:ZW3C0q4kAam6aQMGdjWca4Ghf9Y3r
TLSH
T176E2AE715CB498779CA7A296F61B3643FEF0916385D84E80C9DD6B0E03A719E2307D1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 0dabde61b3a184fba1a001d99713949981f79b6c118290e7859fbcfc61fa5098
MD5 1762e748d2f7ac8b1680a4f63c039805
SHA1 ccc8f7ab0c150e2efe27b702055b319817360510
SHA512 483643f6aa62382126f19f243713f6df0d6d17fa900ae0f9996be370783f739c0d9e3d8536f2d4688259fdcdc926f9c7761071cda7863b0ecf94aa4a0cbb2a65
SSDEEP 768:5FQa3Xwgq0qoAam6aQMGdjWca4Ghf9Y3r:4a31maME6pYb
TLSH
T170E29E725CA4C97BACA79B95F61B3203EEF051A3C8D89E90D6DD6A0D02970DD2307D1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 75050ab9307a737bed54cde6a20eedaa1ea6beb23d96d3e9eea7ae3f28aa03c6
MD5 3ade359c7f3c3f34910a173b522c891c
SHA1 df26812849a938afa69841b07ebeb5f50643a057
SHA512 8609d7ccdb4d0cc807b2e8c6ff6d521b07407e617ae11bffbdde68cecdb54fe77cf454c401549401d095713784815b977984f67b5c91ee73bea08eda3de705b7
SSDEEP 768:/rv+4UNbdq3XIqMAAam6aQMGdjWca4GhfB4PeU/:/bsbc3SKmaME6pgH
TLSH
T178F2AE31A8789973DDB79A99F21B6747BEF021A385D40E84C9D96B0D43970CE330792B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VariationsRuntimeSeedV1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsRuntimeSeedV1
Size 484B
SHA256 9fd2b7fae87c2d863b486a425834283f19b1444749c84650d5a48c9eadb12e2b
MD5 e9289cc1f579fdfa9d46acfae9b38330
SHA1 7eac8e241d8c35d873280d6b9dbc1cca7a9b2231
SHA512 b1f37da50e387c8408a960ef5276a51336510286c1db7eaea4cde65af4efc343f8ac1d9de65df1fd0818513823a485733e5c155da615344bc044f46021ecf586
TLSH
T134F0543C33D821A4F08C46B23596ED8B88BF313247DC2631CA50F550315387701B5095
MD5 SHA1 SHA512 TLSH

Submit Download

VariationsSeedV1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsSeedV1
Size 2KB
SHA256 4bc2842486973f378f9f13e52207348cbaa496dbaeccc2bf7dc379952f10a6aa
MD5 7288e9fc2d24643116aeacc32b4cd64d
SHA1 1f8673b1789f3cde68f1048bd5ea20a40e07dfc8
SHA512 e8cbde7c9f883791ee17ede6995daea085eb8c597a95ae3556410455c1ec2c1d3655f0f40f302ad1676f66d4f90f2906edd09b8207ccfe3d50598ef6993cd383
TLSH
T18F515DC70AD412B6AA77A7F04F0185CDC33FB64EB299D8CF48A04C75662349365D10B8
MD5 SHA1 SHA512 TLSH

Submit Download

15f063ce-fd9c-4ee9-be7e-a75a83476b3b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\15f063ce-fd9c-4ee9-be7e-a75a83476b3b.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

memory/4976-163-0x0000024AD99E0000-0x0000024AD9D9B000-memory.dmp

Download

memory/4976-162-0x0000024AD99E0000-0x0000024AD9D9B000-memory.dmp

Download