hxxp://www[.]mannuccidiesel[.]pe/

Resubmissions

04/08/2026, 15:01

260804-sd8alagr6w3

04/08/2026, 14:54

260804-r98qkace953

04/08/2026, 14:37

260804-ry6f3aztex3

Analysis

user interaction
yes
max time kernel
299s
max time network
256s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 14:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://www.mannuccidiesel.pe/
Sample260804-ry6f3aztex

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4536	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303278433183725"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{39218291-0178-4782-9D22-29F8BCD77795}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
728	msedge.exe
728	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe
1680	msedge.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 1680 wrote to memory of 4580	1680	msedge.exe	85
PID 1680 wrote to memory of 4536	1680	msedge.exe	86
PID 1680 wrote to memory of 4500	1680	msedge.exe	87
PID 1680 wrote to memory of 4500	1680	msedge.exe	87
PID 1680 wrote to memory of 4500	1680	msedge.exe	87
PID 1680 wrote to memory of 312	1680	msedge.exe	88
PID 1680 wrote to memory of 312	1680	msedge.exe	88
PID 1680 wrote to memory of 2196	1680	msedge.exe	89
PID 1680 wrote to memory of 2196	1680	msedge.exe	89
PID 1680 wrote to memory of 2196	1680	msedge.exe	89
PID 1680 wrote to memory of 1816	1680	msedge.exe	90
PID 1680 wrote to memory of 1816	1680	msedge.exe	90
PID 1680 wrote to memory of 1816	1680	msedge.exe	90
PID 1680 wrote to memory of 1428	1680	msedge.exe	92
PID 1680 wrote to memory of 4320	1680	msedge.exe	93
PID 1680 wrote to memory of 1428	1680	msedge.exe	92
PID 1680 wrote to memory of 1428	1680	msedge.exe	92
PID 1680 wrote to memory of 4320	1680	msedge.exe	93
PID 1680 wrote to memory of 4320	1680	msedge.exe	93
PID 1680 wrote to memory of 5112	1680	msedge.exe	97
PID 1680 wrote to memory of 5112	1680	msedge.exe	97
PID 1680 wrote to memory of 5112	1680	msedge.exe	97
PID 1680 wrote to memory of 744	1680	msedge.exe	100
PID 1680 wrote to memory of 3820	1680	msedge.exe	101
PID 1680 wrote to memory of 744	1680	msedge.exe	100
PID 1680 wrote to memory of 3820	1680	msedge.exe	101
PID 1680 wrote to memory of 4452	1680	msedge.exe	104
PID 1680 wrote to memory of 3924	1680	msedge.exe	106
PID 1680 wrote to memory of 3924	1680	msedge.exe	106
PID 1680 wrote to memory of 2076	1680	msedge.exe	117
PID 1680 wrote to memory of 5024	1680	msedge.exe	118
PID 1680 wrote to memory of 1640	1680	msedge.exe	119
PID 1680 wrote to memory of 3832	1680	msedge.exe	122
PID 1680 wrote to memory of 3832	1680	msedge.exe	122
PID 1680 wrote to memory of 4728	1680	msedge.exe	124
PID 1680 wrote to memory of 4728	1680	msedge.exe	124
PID 1680 wrote to memory of 728	1680	msedge.exe	129
PID 1680 wrote to memory of 1372	1680	msedge.exe	130
PID 1680 wrote to memory of 4148	1680	msedge.exe	131
PID 1680 wrote to memory of 1372	1680	msedge.exe	130
PID 1680 wrote to memory of 4148	1680	msedge.exe	131
PID 1680 wrote to memory of 260	1680	msedge.exe	132
PID 1680 wrote to memory of 260	1680	msedge.exe	132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://www.mannuccidiesel.pe/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x254,0x7ffd8cfdc188,0x7ffd8cfdc194,0x7ffd8cfdc1a0
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1856,i,1406345257520192063,12519213395889595273,524288 --field-trial-handle=2260,i,6254032466979293295,13952533968543705498,262144 --variations-seed-version --mojo-platform-channel-handle=2296 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,10668660818983100221,14554065710020447299,262144 --field-trial-handle=2260,i,6254032466979293295,13952533968543705498,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:2
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2404,i,9645911434780457037,6352079391749173930,524288 --field-trial-handle=2260,i,6254032466979293295,13952533968543705498,262144 --variations-seed-version --mojo-platform-channel-handle=2400 /prefetch:8
  2⤵
  PID:312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,4458566879524266621,3334324207093910463,2097152 --field-trial-handle=2260,i,6254032466979293295,13952533968543705498,262144 --variations-seed-version --mojo-platform-channel-handle=3476 /prefetch:1
  2⤵
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,12407757105236845322,2718075829932714276,2097152 --field-trial-handle=2260,i,6254032466979293295,13952533968543705498,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4196,i,4328549119505201779,4244345826743305428,2097152 --field-trial-handle=2260,i,6254032466979293295,13952533968543705498,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:1
  2⤵
  PID:1428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4236,i,14538683241375855867,3132825021647643274,2097152 --field-trial-handle=2260,i,6254032466979293295,13952533968543705498,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:2
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5020,i,2955251736622833491,7314728376225545911,2097152 --field-trial-handle=2260,i,6254032466979293295,13952533968543705498,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:1
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5304,i,7335478229424005668,753561057883543798,524288 --field-trial-handle=2260,i,6254032466979293295,13952533968543705498,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:8
  2⤵
  PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5300,i,8651770407295798800,16475882448771030762,524288 --field-trial-handle=2260,i,6254032466979293295,13952533968543705498,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:8
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6028,i,4393073221440374497,4491385288355555378,524288 --field-trial-handle=2260,i,6254032466979293295,13952533968543705498,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:8
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6028,i,4393073221440374497,4491385288355555378,524288 --field-trial-handle=2260,i,6254032466979293295,13952533968543705498,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:8
  2⤵
  PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6200,i,9958947999284609434,10459087664828920745,524288 --field-trial-handle=2260,i,6254032466979293295,13952533968543705498,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:8
  2⤵
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6496,i,5278718870536185581,15334633771455413740,524288 --field-trial-handle=2260,i,6254032466979293295,13952533968543705498,262144 --variations-seed-version --mojo-platform-channel-handle=3700 /prefetch:8
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6584,i,17001974944071298355,6351087700780661839,524288 --field-trial-handle=2260,i,6254032466979293295,13952533968543705498,262144 --variations-seed-version --mojo-platform-channel-handle=6568 /prefetch:8
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6492,i,9862680205309726392,17636049721306025942,524288 --field-trial-handle=2260,i,6254032466979293295,13952533968543705498,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:8
  2⤵
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3704,i,10992020445501843474,10172797380193754567,524288 --field-trial-handle=2260,i,6254032466979293295,13952533968543705498,262144 --variations-seed-version --mojo-platform-channel-handle=560 /prefetch:8
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=768,i,18348426058955388741,7509093940707619899,524288 --field-trial-handle=2260,i,6254032466979293295,13952533968543705498,262144 --variations-seed-version --mojo-platform-channel-handle=5864 /prefetch:8
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5336,i,16091335605662495605,14361370380591647196,262144 --field-trial-handle=2260,i,6254032466979293295,13952533968543705498,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5640,i,11910117894486614969,3254577543218544953,524288 --field-trial-handle=2260,i,6254032466979293295,13952533968543705498,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:8
  2⤵
  PID:1372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5668,i,9759887135559269359,9887654287195514012,524288 --field-trial-handle=2260,i,6254032466979293295,13952533968543705498,262144 --variations-seed-version --mojo-platform-channel-handle=5708 /prefetch:8
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3968,i,10523309738435406456,18220954804499648874,524288 --field-trial-handle=2260,i,6254032466979293295,13952533968543705498,262144 --variations-seed-version --mojo-platform-channel-handle=6748 /prefetch:8
  2⤵
  PID:260

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 484bcb5c661e6c1ab7c1e8eb0c2dc5467b2aad2bbfa7193f8c39808e2bc6a2bc
MD5 0303b5ff4733f8166294ea49530b902f
SHA1 dcaf0862a7b91f354c8fbd6433da224b0d79fe0f
SHA512 3c3ff7263abf5e7941634b2d489f03a0b875cc87021be2b45ea0f9cc3587625ccfb24009d6570292f82c542e63f3bb31ee266157332eb559db4019f9a6131084
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P79:fwUQC5VwBIiElEd2K57P79
TLSH
T1A2B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 1526e171c9fef30541acfaae72d7013d607360b97aa55102b70e594c2e36da26
MD5 ec9d48b2ee0f73e508f71391c22eed9c
SHA1 5a0654839cbfb5d64b58dc5a78bd64d21ec2e744
SHA512 9c29cec33ea465e95a46bc358e8f23e58d58c2c66bb54c0b37e9fa78cdd91fe6120031742955ce980375383539b07a59caf0bfe232e827bbb60523e27c11dab9
TLSH
T16AE0208816CCCE3DB550B7C79154630CC2D03A5F9FC4E9451714D8CD3005088B6C1975
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_00007b

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_00007b
Size 1024KB
SHA256 66a8162a73c55b6da333d4ea6448aa9cc49567b4101378723d2e8d8dc3f9df0e
MD5 24541ed0e8208652429afb9648a2d29c
SHA1 d2fa6dfe977b3f690225d66d753f95adcfb07a14
SHA512 2bbb5b233bc41e31eb7980c77fdc694c8546e431d82198131c48714542de959cb9e9586154ced90e74f78808cebc0c4bed5c35709c84704621dc2204d101f42e
SSDEEP 24576:R2UrqZqSYiEjLpmEPAZ3/YvhWvKwjxUOJmcemU:Lrqw+jEPA+Mv5jHGmU
TLSH
T1A02533124C6343766772C75395924E527F0A413D913AE060E1A072A7BACCFEEEE29C7D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 230c1b0a379daa316f5ec6735d9f12e27775326f0463f57a767383d5dadbd680
MD5 01ffdb3d32b4975c5f6c05764971e234
SHA1 8ee3d6a08969f2e7b2a817080a3e38afea50070f
SHA512 2e4c3de08901ea5ac40aa6dee55b057d08ed5c6995f73eebce89ee23cbb93c5718e67f0728869ec46b9d4aaa163c2c972f24f9501e401b5aaf4e09d2c40268e4
TLSH
T17B71A61806A215F4EF5D4131E1F1C9F27D31849DEAFB9EE271981C7F6C0AF5562062D8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c668.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58c668.TMP
Size 3KB
SHA256 97a718531c51d453fe1c86e42af9d6d4e67441354da0039b6f3821e25c70d001
MD5 e537b5d34f367833b5f3f60dbf8a6c1a
SHA1 2432eec1b7b8671b99b8c570365291c40f7b47d8
SHA512 9e64df1bd2d3b8aa3afa37df32d171720c7bfe051f353e66a511895111c91ceb14a1b533c5c9b14569098947a559d1df28b6d5c97078692e6e25b0340a7813f7
TLSH
T1CA618118069259F4EF4C4231D2F1DAF27931809EEAFB9EE1B0881C7F6C05F9562062D8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 8439dcfacce3f3ffc01243e56821afebfe15b5055a1520e6d385633e595c3e1f
MD5 a138303a79b20a4eb4f5582accc04faf
SHA1 670ec2b8bc01a021ea564887eb5f617d5453e108
SHA512 b0a5c879468d37e91205d0c7d2ea06567f6a56451574862ac7bad8a011a713319f5ee0b5a59b2c9864757e3dedb04d8cd4e579f57fcf4532c682be5468141414
TLSH
T19E518BBAD3D4867DC94152F06A156E2BCE1D091643683C9AC8ECEF4FE3F2435E14168E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 08fc5bd7092db6d2140b96fb0395204adbe617aa4df217dc0daf030e06741369
MD5 dfdb321e25bcf29f697bda2b38236c64
SHA1 a888f373e0ead433655d20b5dd3a03842a1d79ca
SHA512 0ae4d4b226e2a2c7cae16885433091c97bc13867ff3b4a832f77904eee7a9623cdd3d766cae62c7e6256a82802b43651e3838a649d289f8a0be8afc534f9ecc5
SSDEEP 192:sxZjRAyM/jK1Ml8UQ/kY/fLsJ00Idp4pHW6+WNBhGdYHXQAqEtIg5xBJ:sxZjGqsY/fLsJ0tUHbOd2yEDL
TLSH
T1D65209166A346977CCDBD20DF946BF63D6F61472A2900E44A9FCDA1C00E6BED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d7d374e01ed0a0c618f278bd37a8865cec73cdfa7584231d7a8dc7adb03c16b5
MD5 b2e3df59fbe93a70b300b3d4086ec8b9
SHA1 50e61b4dfc18304ff7775aa08a2e7ebc4ad701ce
SHA512 4a2ab12a7ae19ed1fc441165e8787cfe90c376814655dc98a98debc79b6b911b77d65faaf42f27d97fe141866441434fa7dac71b216a0ae431f7f6659088312a
SSDEEP 768:CVUZYTMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4RFroVg0F:CVUZYTMWvg0Pou1ja7eLZmR+pF
TLSH
T122D20A3B280CCB7E4F844E9DEC2A6F963ED801CB5A584D5447EA894C03CB7EB512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 8bf3121c542a1410bf0a941a20aa4e145f2e396ff9c832d209d8e99b9dbc02eb
MD5 7bf105dee1edb8e511792f6f572e8212
SHA1 a2fba1c6896dc95b48cf22c84fe076d932141759
SHA512 173960442aad402c6a0866f0f61c6d09461a761c22a4a50e514c13f063ea385ad453bfb4ff549fee9e18e63e0bcec676aefdbe3ad25c77d6bbc127a1aac4f222
SSDEEP 96:KA1eK2AUe4KLSumpCKaMFjGKw0y+JGKCgi:Eq75nlNb
TLSH
T195D1781630BB1B073DBE2A09A65497160B4271A33119B42B7BE904B35D6FE384DFE8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

da514bf2-6eca-4a59-be07-852a3b7704aa.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\da514bf2-6eca-4a59-be07-852a3b7704aa.tmp
Size 13KB
SHA256 b597206e976c4c024b2384a11a816afd0ea4b18f14fdc858d85efaf3378a9a4f
MD5 1f5f36aa380370233eea0b8c0751fc64
SHA1 5a99de2b7eebaf1cdbc21566f8c3d1001df7f4d5
SHA512 262b90a17af7a3e4e4222b19f2d11ade92a4b91f7e0a0f4051c0980cfe86de2dcfd3bc1d87ef16062d0802276cb4022af14fb25752bc4f02fc628f4f0c3e3d33
SSDEEP 192:sxZjRAyM/jK1Ml8MkY/fLsjG0IdpSpHW6+WNByI/YHTtztIgrJ:sxZjGMY/fLsjGtGHbL/k9
TLSH
T1A45209116A346977CCCBD20DFA56BF53D6F61472A2900E54A9FCDA1C04E6BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe594731.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe594731.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 03241a616893a75061948b4a126c2cbc92dfaf55d995e079dbcc042578dc4c9b
MD5 7fc81c3e90fd7f53e1380e1422e06abc
SHA1 a31f84c9bc757ddcac62122c50c6c973e5b6887b
SHA512 49c62f40d38f0a07c6809dbf679706e60a65dff199f3ba678934232aad7ab763f78e3bea44befe3c1b70d3e3fcd286b32dbd1dbb3b6fe2e4d271b81586d6493e
SSDEEP 384:ViFiZcIXAsN68TUNTUlIltC5U+wvBzX5od+8OGQSQBeRs9JKgqijUjhL:cFQw3wg+kvJOFOGjQTjKgqmUjhL
TLSH
T10CD228F244D79936D9AE5B47E77E2D124EBDD067F580AA90B3C86A0CCC461BFD30A811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6bce5795bf7863bdd95c7ffd2f2098933dc78fbc57f5edccfe818b60eeabcd63
MD5 9c5ccac5e5c358c9fada49c5c198894d
SHA1 18f60e663eb9eee8e2c0aacce3728c002912b8a8
SHA512 637ab39c5ec5c1334d9d95b239a26a88a2056c1f44123a2e60bb9bef38c957b41447c48b905be34200231514ca3bd1cf6d96e3c7e7457e2071e528063a7f47a1
SSDEEP 192:yONS61VWQmiUyqIcgGX5Obd+joOpmid/aR3upU6:yONS6W7DgGX5od+8O4QpU6
TLSH
T16F02D63568687C778EE2BE49F58B37135FA9207BEA546F84D6E81B1C00D769C2306C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b04c2577bfa5ed760e1c1650de6d96182b05cf224fa791612045d83dc27ddbb7
MD5 7e2e325df12b8c219b3a4eff6f3c5b8d
SHA1 ed4a20401af8a06f3d725cd5a5d9794a4ddbe3fa
SHA512 41fae89c9c5d7d941f7ed94ac4d2186bc357666186e6f4d47a016fa94d637d32381ad7c846a48e1574a6cbf682bfff9a73a9ad89fc7189399b3589189ba1db54
SSDEEP 192:LON761SWQmiUyqkczGX5Obd+joOpmiO83DjJ+qUU6:LON76j7HzGX5od+8OGQRQU6
TLSH
T18012F9326828BC679EE2A559F48B32139FE95167DA447FC0D1DC2B1C01EF6AC230AD56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 47d66da7fdddf5977ef0d563c4ecf3440596d8d9e9991b6c218c61afca1cac11
MD5 0e29a59e4d7fb277929300c2ef876829
SHA1 ef0de1fe7acb57cd46d07e27b6e03326428777d6
SHA512 5fc238f6b3cdaddb5fd2b13abe1b792790a9a6187d4fe4f5e999b13dc5eac1dd957b28573dc6e284a9cd0bf368f57cf4d36415fcf4d92d5eb6d8ee991582c422
SSDEEP 384:QZcIhsNiAC5Ufw+BzX5od+8OGQiQBeRs9JKgqijUjhL:uh7H+JOFOGtQTjKgqmUjhL
TLSH
T1F6929C31683879739EF6B589F48B36134FF99027D784AFD491EC6F0C009A99C231AD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 3ae83cc3f3afacc33ab7b3c8e521d0e8a125aa9a53568371adc7eaaedad4adee
MD5 045e3ac3a64d98da5596a8354c0a95d0
SHA1 23d89686ca65f527166c66053468aec98d1288e3
SHA512 ce9e20ead8873ebf7441b461c17fe6804a2d7d0b8261725aa27443909a7b525ee06ec60f2d23361f76e96c48bdb6c000854f623622e66b70d21e3b4236568706
SSDEEP 384:xZcISsNitC5U+w+BzX5od+8OGQiQBeRs9JKgqijUjhL:ZSGk+JOFOGtQTjKgqmUjhL
TLSH
T1E4928C70683879779DE6B589F48736234FF9A027D784AFD491EC6F0C009A99C230A926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 cf8029da90cb5917de867a54ccf5466c7932b13198961b10fb1cd840151a969d
MD5 e2388151e77b329f0576d1e33b558709
SHA1 cad800445dd01f151296d519ad7ac3365101b33f
SHA512 94273e4e119ac49a04345863d3dbad263dee3097bff993f5a087267241d917b347672b2ba0f6f389a8ed5020340a0a00f11ab3230d7fb34dbf3b2d5c97a9ab44
TLSH
T105410B5976F91148B3B77F569FF6A86E447ABD772E0AD45D10010D4E0A22E00C9B1737
MD5 SHA1 SHA512 TLSH

Submit Download