hxxps://bpcs-adac-mautportal-web-feature-app[.]vercel[.]app/

Analysis

user interaction
yes
max time kernel
389s
max time network
390s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 15:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://bpcs-adac-mautportal-web-feature-app.vercel.app/
Sample260804-s2tgcatdmb

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
652	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303314707216407"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{3D4B4F84-A02B-4CC6-97C9-7F07F3CFFBA8}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4492	msedge.exe
4492	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe
4412	msedge.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 4412 wrote to memory of 4588	4412	msedge.exe	87
PID 4412 wrote to memory of 652	4412	msedge.exe	89
PID 4412 wrote to memory of 1612	4412	msedge.exe	90
PID 4412 wrote to memory of 1612	4412	msedge.exe	90
PID 4412 wrote to memory of 1612	4412	msedge.exe	90
PID 4412 wrote to memory of 3076	4412	msedge.exe	91
PID 4412 wrote to memory of 3076	4412	msedge.exe	91
PID 4412 wrote to memory of 1560	4412	msedge.exe	92
PID 4412 wrote to memory of 1560	4412	msedge.exe	92
PID 4412 wrote to memory of 1056	4412	msedge.exe	93
PID 4412 wrote to memory of 1560	4412	msedge.exe	92
PID 4412 wrote to memory of 1056	4412	msedge.exe	93
PID 4412 wrote to memory of 1056	4412	msedge.exe	93
PID 4412 wrote to memory of 2856	4412	msedge.exe	94
PID 4412 wrote to memory of 4116	4412	msedge.exe	95
PID 4412 wrote to memory of 2856	4412	msedge.exe	94
PID 4412 wrote to memory of 2856	4412	msedge.exe	94
PID 4412 wrote to memory of 4116	4412	msedge.exe	95
PID 4412 wrote to memory of 4116	4412	msedge.exe	95
PID 4412 wrote to memory of 1012	4412	msedge.exe	99
PID 4412 wrote to memory of 4380	4412	msedge.exe	100
PID 4412 wrote to memory of 1012	4412	msedge.exe	99
PID 4412 wrote to memory of 4380	4412	msedge.exe	100
PID 4412 wrote to memory of 3640	4412	msedge.exe	102
PID 4412 wrote to memory of 1844	4412	msedge.exe	114
PID 4412 wrote to memory of 4320	4412	msedge.exe	115
PID 4412 wrote to memory of 764	4412	msedge.exe	116
PID 4412 wrote to memory of 4808	4412	msedge.exe	118
PID 4412 wrote to memory of 4808	4412	msedge.exe	118
PID 4412 wrote to memory of 4492	4412	msedge.exe	120
PID 4412 wrote to memory of 1048	4412	msedge.exe	121
PID 4412 wrote to memory of 1048	4412	msedge.exe	121
PID 4412 wrote to memory of 5004	4412	msedge.exe	122
PID 4412 wrote to memory of 5004	4412	msedge.exe	122
PID 4412 wrote to memory of 3104	4412	msedge.exe	123
PID 4412 wrote to memory of 3104	4412	msedge.exe	123
PID 4412 wrote to memory of 4640	4412	msedge.exe	127
PID 4412 wrote to memory of 4640	4412	msedge.exe	127
PID 4412 wrote to memory of 4492	4412	msedge.exe	128
PID 4412 wrote to memory of 4492	4412	msedge.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://bpcs-adac-mautportal-web-feature-app.vercel.app/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ffedc9bc188,0x7ffedc9bc194,0x7ffedc9bc1a0
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1916,i,9517815461639187919,11625163761968566600,524288 --field-trial-handle=2852,i,12168340568586946951,10873221184129313914,262144 --variations-seed-version --mojo-platform-channel-handle=2940 /prefetch:3
  2⤵
  - System Time Discovery
  PID:652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1716,i,16705364475087412582,582878339068618216,262144 --field-trial-handle=2852,i,12168340568586946951,10873221184129313914,262144 --variations-seed-version --mojo-platform-channel-handle=2844 /prefetch:2
  2⤵
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2232,i,1766921166578286777,9586286389475179569,524288 --field-trial-handle=2852,i,12168340568586946951,10873221184129313914,262144 --variations-seed-version --mojo-platform-channel-handle=3004 /prefetch:8
  2⤵
  PID:3076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,5612831686388041053,7724789788187471477,2097152 --field-trial-handle=2852,i,12168340568586946951,10873221184129313914,262144 --variations-seed-version --mojo-platform-channel-handle=3440 /prefetch:1
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,6888945187824024561,4931631957632598125,2097152 --field-trial-handle=2852,i,12168340568586946951,10873221184129313914,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:1056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4144,i,13219869564080921483,15464562031312548303,2097152 --field-trial-handle=2852,i,12168340568586946951,10873221184129313914,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:1
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4168,i,10351858599720341768,16871566858989668310,2097152 --field-trial-handle=2852,i,12168340568586946951,10873221184129313914,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:2
  2⤵
  PID:4116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3628,i,5262272249801689594,11237657741673224768,524288 --field-trial-handle=2852,i,12168340568586946951,10873221184129313914,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:1012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5064,i,7236753306844156359,17986498224642366931,524288 --field-trial-handle=2852,i,12168340568586946951,10873221184129313914,262144 --variations-seed-version --mojo-platform-channel-handle=5192 /prefetch:8
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,6783348653427875775,14089925110517749838,524288 --field-trial-handle=2852,i,12168340568586946951,10873221184129313914,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,6783348653427875775,14089925110517749838,524288 --field-trial-handle=2852,i,12168340568586946951,10873221184129313914,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6268,i,6780724070972922129,3376414179922970509,524288 --field-trial-handle=2852,i,12168340568586946951,10873221184129313914,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:8
  2⤵
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,8269318432557700613,17337576604154883777,524288 --field-trial-handle=2852,i,12168340568586946951,10873221184129313914,262144 --variations-seed-version --mojo-platform-channel-handle=4484 /prefetch:8
  2⤵
  PID:4320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,6335869320672696370,9028424312547790639,524288 --field-trial-handle=2852,i,12168340568586946951,10873221184129313914,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:8
  2⤵
  PID:764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5184,i,370278300273496322,15656254194205245835,524288 --field-trial-handle=2852,i,12168340568586946951,10873221184129313914,262144 --variations-seed-version --mojo-platform-channel-handle=5804 /prefetch:8
  2⤵
  PID:4808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6176,i,8195470689457270566,5753300706157459445,262144 --field-trial-handle=2852,i,12168340568586946951,10873221184129313914,262144 --variations-seed-version --mojo-platform-channel-handle=748 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1032,i,6567188888863106631,5173290286852840089,524288 --field-trial-handle=2852,i,12168340568586946951,10873221184129313914,262144 --variations-seed-version --mojo-platform-channel-handle=5660 /prefetch:8
  2⤵
  PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4420,i,18138921273242002930,11511255174447982659,524288 --field-trial-handle=2852,i,12168340568586946951,10873221184129313914,262144 --variations-seed-version --mojo-platform-channel-handle=2620 /prefetch:8
  2⤵
  PID:5004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6332,i,18345461332556729796,11593844739171049532,524288 --field-trial-handle=2852,i,12168340568586946951,10873221184129313914,262144 --variations-seed-version --mojo-platform-channel-handle=6328 /prefetch:8
  2⤵
  PID:3104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5440,i,12193535919223557618,4767753840564542002,524288 --field-trial-handle=2852,i,12168340568586946951,10873221184129313914,262144 --variations-seed-version --mojo-platform-channel-handle=1264 /prefetch:8
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6540,i,10335043693385315396,8155394443087204400,524288 --field-trial-handle=2852,i,12168340568586946951,10873221184129313914,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:8
  2⤵
  PID:4492

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 4KB
SHA256 61e24bbaabc0eac8cb33eb83b7ca1de3b5115203106969f87a8cfe93a164a78a
MD5 ee12acf2d6c6d9f28c93a830e8eddf34
SHA1 cc48fad9221050a8c2302b29ca28df1cb1df5b62
SHA512 dd683773a7ed7e2603b91376e025d2988d3256777a3e1cd69b8d689779a39c348985940b480dea59c62d6a72057bcf386e07bfa7308500acd70e85c32ad0afff
SSDEEP 96:wmJjgmJFmJmmJBmJQmJQmJQmJQmJQmJnmJnmJnmJnmJnmJnmJnmJnmJnmJnmJZma:JjZgTMpppppGGGGGGGGGGEJLO
TLSH
T124915E464395DBBBCF1550DB4DA0A75C40B0370EEFDCDA08039DD9DA304E89AB5B2AA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 d5e1b5ff7eeaa57e5d24416a511723edd40dcf99c6e28832061cde2de6a75e61
MD5 77182adb2212b57c3a0133651905faf8
SHA1 16c617a0b8402decbe5cbe3b7ef8b484f45b648f
SHA512 aa0d06b1a39c9a589fa2ee1862904564c2282119f9f16249d7628dceadaff4aae5d4350b6cf5771a5b50d68a67eb171d7e2ef365b492057e92fdc265c78de027
TLSH
T13851B6384702302CE35641F2B2C30D6671BAB6C1F5E7DFFA17A7A475DA1D3AC8414654
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58bb0e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58bb0e.TMP
Size 2KB
SHA256 fffe8a5e234a107a5c48684bf97ae4e9b8084fa04b518178d41fc9c7115f8721
MD5 b8a7ed6ffd3d9bf0f1fe2935312655e4
SHA1 3fc6e92f357f88e388a0a2bfaafe796de1033aa1
SHA512 f245f806f2ee443ad72989ef31227ef77bd54e784d04c8c176f9d472dd1ec6ea82cd9dfe065c78d455955a938608bd2f4cc923e0b2e9c468593484c82a3ededd
TLSH
T1B551B3384702345CD35900F1B1D30CA6B0BAB6C0F9E7DFFA0B63A475CA1D7AC8814654
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 949fa8677355f76260cb00c30d84caf01e648d17d7a188e4d63bbd5c89194c49
MD5 73e3949d47c2ab967edf96e4db770dbb
SHA1 8d4861439c124c2889c13c2c7cd54b749495f329
SHA512 d29d6ff76315ac2c7c6de50304570ae111974fdd716ae7b7cb577543dff0405aaf4232ddedcbe85eb9ffa7ccbb55ad9b975d5e0cb5f5c81845faeea4cb6faf24
TLSH
T13031DDF6C3E5852DDA0052F49A28AE2BCF5D05024368782586D4AF1BA3F60A2F44195F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 e5b35ee2d2ee5161c6da36c0615dfe3db362fd0962d0ab82fe3b5fc3efb6bf8a
MD5 8a3430eb61a95399660376a535ecf7de
SHA1 4c8e91bee70a0ada06aee2aab7be40b7d13a5032
SHA512 918c41c8d040021784b52ecef8c1f6c654c89c6a6697cdb09fdd26f532f412d4a31d23cfb8831945802b26e10afb68f65468dbf8de52cae91efd126a7f5ca7c0
TLSH
T14A31EFF693A5466EEA1156F4DA28BE2BCF5C0512436C382587D4AF1BE3F2072F041A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 d38838ea8aefb74696377d4b90a2fba4e9e22860096923b411c7576ccf8b6b9c
MD5 fb71dc7efe9b9cd0025610fdb50fa4e3
SHA1 32c4b6813ac7c805ae8bde869eec9f8de34a992f
SHA512 9f161ac1c14f6627a000ae48ec3a3e973bfd39f79858a2bc23f166f33ae306427aa67e6e9d89104eeeae14489c8e77d5cfc30a34c63e763388a3b31b229687a1
SSDEEP 192:sxZ8ZRHyM/jK1Ml8MkK/fcsZGjkIdpx4HW6+WNWpy/Y9I9kbRIgUEJ:sxZ8ZZMK/fcsZGROHbT/gUI
TLSH
T12A52F9126A389977CCDBD20DFA45BF53D6F5147396900E58A9FC9A0C00E7AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 e58eae80d29801e9bde36a753808c068a9055349cb4dc3dbc00cf320e9e8d45a
MD5 4c0ca0a294493afbd51cfe4ca3bcf47b
SHA1 81aaef4813871687baaa8ff32b796fa4149a1f70
SHA512 a79b40edf546863c52d67d4776b3a1b1fd16b8247085e300db45b1ac120afa4997d054fae249f685a8cf3e18bdbcf8b15072e65259e74240d72514963992783b
SSDEEP 192:sxZ8ZRHyM/jK1Ml8UQZkK/fcspTjkIdpbxHW6+WNWpy/Y9IEPbRIg5DEJ:sxZ8ZZqaK/fcspTRtHbT/yBI
TLSH
T1DD52E8126A385977CCDBD20DFA85BB53D6F5147396900E48A9FCDA0C00E7AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 533c5c4ca86bbefb5cb37f8fad0de1fec649f06c0bfcfffc4c0f3f6488a24748
MD5 942a40fc42ed5f135dfcd3e060c0c619
SHA1 710aedfb8091ad7c21348d23e3dbc70c397a4b8c
SHA512 a451696f046ea45ef6c214f79725c4e371f7de6c4208d7f89a810976a23f5f45430b95de150bd656afbc953fa5acd4e3f2ee94abdf940313af004f60bfc3694f
SSDEEP 768:HIcv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWNyroKg6TTw:HIcv21wWvu+Z+u1jaeFLeRNpKnw
TLSH
T1A4D2FA2B280CCB7E4F841E9CED2AAF866ED801CB57988D5447FA494C03C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e82f27c9-ede0-4460-8499-869f1aac6d13\index-dir\the-real-index
Size 552B
SHA256 c0d2f0fe74c275c23d1c51b057a156b939a4ba92b54b366b281412763068bfda
MD5 81abc41599916369450dd6bd32b4be2a
SHA1 48e31b3c7b553eb9c5e42e2ca5afc5d455aec8d9
SHA512 96dcaf1dd01608121cf174ecf6038bc62dec174217ac720a8414876e5994b2d8bd297307da2896be57b406e3dfa2f8003cb8e6d2d53591d8bcdd3e993d02543e
TLSH
T11BF0AB508F915C2AED580A7220F510F073B0CEFC7322C59A552C663A2C2230854671C8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5cdefd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\e82f27c9-ede0-4460-8499-869f1aac6d13\index-dir\the-real-index~RFe5cdefd.TMP
Size 552B
SHA256 c411b303c65c690dc01d981895e468ab703a07f76edacc2b54b94b6a905f66d0
MD5 1fb0b384a567de60beba7e0468ec7d57
SHA1 b7f3e1ee10899b9edcdb073fd6346fd18bfcccfa
SHA512 f8ef300f3ef784829279afa5702252e9f1beb10820007686219418b012e3833ec1be5e91c720c669341943d97daa3e83884e6393f2c0bdba74ae530f8832d59b
TLSH
T132F0F186C7914407EC600AB114F504B5B270C9507232E483202A693E2C723C855270C8
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 830e99dca0cedc1d2535a2d33789a32386b0cc98512e0cfa92d453350aa1315a
MD5 964711b31a6a70be79971782129660dc
SHA1 f6fcc467a4ac010fc9fdb4f52dec00bc0353310c
SHA512 93e206110e2a6b136d3f8eae3b1f19f325aa705b9b874d11935c688c6795dd3632f91782113588873bf0a19579ef2dd879b9a0a0f0317d4ecd0677fa4bca82a4
TLSH
T142E0687A2DF62430FD6BD7D2147144A4006478B989C6BC8F683AAA8650B23552846C65
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 140635f56a36e9fcc322a35e8163776f4e5368048ae84751f1081f3892aa6804
MD5 a843357bd052095aa58b0456a1bdf577
SHA1 b04f23e21be8247ef0d15977f1fb839663a07dc8
SHA512 ade69a3f652d60d6894c6b09f7f374c5cbcfa84e42ec4836b85c393797dec1f165e0b2e434665fa9a3dd76604114ae5a68784bb3d6dc9f6382fdfc9cb00e26a8
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBD+HyKokuK2EKnq/M:mThJ3x
TLSH
T163918216313A029238BE3858A39687375E4235A37918A87F7BBC45610E37E117EFC8DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe593222.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe593222.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 f1ee1951eca2eade5ba2f620ee16d12c01a7b9561cd2ec53ac734c794b6c1b53
MD5 5ec989fe2fce032f8a94322dbfa02444
SHA1 530f014ad5aa8780966faf4b340158e9ebd2d2b5
SHA512 28a0b21310743042b8e4334325b39a53ffdb212b8ef4a5ad26394d707ffa195059b879056d5324e077b18ffe8ee8028483c400cc2e3bb5af09a64c1c36715f05
SSDEEP 384:gvZcIBsNfSDPrzil7Xe+CnOqEl44xBeRs9JKgqijULhOGL:gnB9aO/OHljxTjKgqmULhOGL
TLSH
T1A3928D7198385D76A9F7A541F88736075FF99063EAC02F94A1EC7F0D02DB68C130A926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 ed7862142014a12c1a4cb618e1549f11daa7c9ed6da4c22f1e50bb30cd70303d
MD5 fb7281a5f287f52e4ab1bf9cca379aee
SHA1 453a9d74cb7b42397a5125484832af7a88333c05
SHA512 ec328d0eb05af6943d42f37eab2af8f757db0206221f455664b1d4fc8f57c6b3df17bbbb7a1744bc7eb6beb3c1f523d4a66c7b41196336c06fe9ba6cccb581b4
SSDEEP 384:HpiFiZcIuK7sNB8TUNTUlIl7DPrzilTXe+CnOqEl4zxBeRs9JKgqijULhOGL:HAFQu68wg5eO/OHlixTjKgqmULhOGL
TLSH
T12FD218F248E74976D9AE5B43A77E2E024EBDD063F5806A90B3D8690CCD871BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 428de63aca4327a1a0330bdda634618b580c368f9702100a9d177359c84f17ab
MD5 2e82f4b9a813aca7d421e069d5800d56
SHA1 a75e39a9fc4992aedbbcba625dfe20daf0522513
SHA512 4a3f7048699c5cef670514d73f658d7dd74b73e97127235d061413b9ee97391d904a456c0cf8714d32a5ea4a2cdd3164a95d1199a9a8f463aae0c61ab36a1656
SSDEEP 384:/vZcIBsNf7DPrzil7Xe+CnOqEl44xBeRs9JKgqijULhOGL:/nBkaO/OHljxTjKgqmULhOGL
TLSH
T17B928D7198385D7699F7A541F88736075FF99067EAC02F94A1EC7F0D01DB68C130A92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b35d69d5339a31ab1215d31b3108792ade608d67c6c33e65b49256dc25d98704
MD5 4d1fd382f72c2199c41e1cb52184203e
SHA1 86098cbd4c9ad8d0e454758a7c8515720109e9b1
SHA512 cae0cf2b62a7e1e8f33aa7079cf096ab46f49fa4c797a4b0ed3dbcf399f683a2fe8ab5f4474aa7203ff9c419dca1276039b1669897eab5f2cb952f2a687c1e36
SSDEEP 192:kEONK6v+YLKTQmiUyoLlh+CGVgOqEl4BCHwqYKU6:7ONK6vz+1lh+CnOqEl4GxU6
TLSH
T19F123B32BD385C6B9EE26945F48736135EB95227EA853F90D5DC3E1C01EF69C230A827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8fcf8decf79f0674b94a5946b663060727f1326e08245f18222a069ff4391d67
MD5 5768b1d2da6aa7fcb68b1a7c894fcf72
SHA1 e629487092cb58b347a28021b6c7dd0e6f93e095
SHA512 a41b33380ebb71b9b013fc35397d25f92904c1abf82ea2c0fc83d86e118011d724c4bb04d05c7773d2c3086f33813b26d84d3589e8f98e567db1958c184c7e67
SSDEEP 192:JONt6v+YLNQmiUyFLZh+CGVgOq8uswT7U6:JONt6vz/cZh+CnOqywPU6
TLSH
T16302E835AD782C7B9EA26E45F48737176FA5213BE9912F90D9D82E1C01D764C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7d1e0ac1-2416-4f88-992a-126a4c76ce94.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\7d1e0ac1-2416-4f88-992a-126a4c76ce94.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 079bab57695f740303fe229f4f682a62e2fdaa9673beeddd94d832203995219e
MD5 d188f4a74e22be4c1e9278b017bdbca6
SHA1 6352351218b16d4e417919f567bd6dfa45a6d8c0
SHA512 47663e9036333ee3c5b8fffc98b8be7be704cc64646f0f6d9dfe0e84789906709c5373473263b22cd1612c22c58557f143a0f3a05ce75789effc9057b9865cbe
TLSH
T1A7412B58A6E90148B3B72F569BF7646E447BBD773A46C45E10110E4E0A23B40C9A1B3B
MD5 SHA1 SHA512 TLSH

Submit Download