1487de71b9b842a1760cda32d6f7e56d8cbb344c628c8c3a4cf790d936aa4ec5

Analysis

geolocation tags

eueuropefrfrance
max time kernel
898s
max time network
747s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 16:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
alpha xskidding/Monaco/index.html
Size 246KB
Sample260804-tr34gade83
SHA256 1487de71b9b842a1760cda32d6f7e56d8cbb344c628c8c3a4cf790d936aa4ec5
MD5 ae12424bfb14566dc102a18b0f6f8537
SHA1 0f7456f58b6ae2a0c0907b72be0c37b8bf389f17
SHA512 401e0c1c80eca262336eeef2cd32ff54c7f4cd05150d5390de7ac48a691c5ffb266b2cb735c047cb5356a6556593261aba6fb8681a81b31439fb0b3b2661900d
SSDEEP 6144:pH2bGbgGyiduhw506QCfDu901FAexvr6LX6YXkPrPpymYUUA70/kub5MJKpLZzSA:7zIGFxe
TLSH
T198340F1FB601190226B3933062567B29FA7042BBB5521B0B3F7CE7102FB569E519BBF4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 3 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
18	raw.githubusercontent.com
19	raw.githubusercontent.com
20	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3796	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303345080954011"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{13275309-081C-4CCF-A0CB-3DB970A2CC4C}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4224	msedge.exe
4224	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe
3804	msedge.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 3804 wrote to memory of 6140	3804	msedge.exe	89
PID 3804 wrote to memory of 2300	3804	msedge.exe	91
PID 3804 wrote to memory of 3796	3804	msedge.exe	92
PID 3804 wrote to memory of 2300	3804	msedge.exe	91
PID 3804 wrote to memory of 2300	3804	msedge.exe	91
PID 3804 wrote to memory of 2832	3804	msedge.exe	93
PID 3804 wrote to memory of 2832	3804	msedge.exe	93
PID 3804 wrote to memory of 6008	3804	msedge.exe	94
PID 3804 wrote to memory of 1980	3804	msedge.exe	95
PID 3804 wrote to memory of 6008	3804	msedge.exe	94
PID 3804 wrote to memory of 6008	3804	msedge.exe	94
PID 3804 wrote to memory of 1980	3804	msedge.exe	95
PID 3804 wrote to memory of 1980	3804	msedge.exe	95
PID 3804 wrote to memory of 1812	3804	msedge.exe	96
PID 3804 wrote to memory of 1120	3804	msedge.exe	97
PID 3804 wrote to memory of 1812	3804	msedge.exe	96
PID 3804 wrote to memory of 1812	3804	msedge.exe	96
PID 3804 wrote to memory of 1120	3804	msedge.exe	97
PID 3804 wrote to memory of 1120	3804	msedge.exe	97
PID 3804 wrote to memory of 1048	3804	msedge.exe	99
PID 3804 wrote to memory of 4048	3804	msedge.exe	100
PID 3804 wrote to memory of 1048	3804	msedge.exe	99
PID 3804 wrote to memory of 4048	3804	msedge.exe	100
PID 3804 wrote to memory of 2836	3804	msedge.exe	102
PID 3804 wrote to memory of 4664	3804	msedge.exe	106
PID 3804 wrote to memory of 3436	3804	msedge.exe	107
PID 3804 wrote to memory of 936	3804	msedge.exe	108
PID 3804 wrote to memory of 5496	3804	msedge.exe	109
PID 3804 wrote to memory of 5496	3804	msedge.exe	109
PID 3804 wrote to memory of 4224	3804	msedge.exe	111
PID 3804 wrote to memory of 4580	3804	msedge.exe	112
PID 3804 wrote to memory of 4580	3804	msedge.exe	112
PID 3804 wrote to memory of 4732	3804	msedge.exe	113
PID 3804 wrote to memory of 4732	3804	msedge.exe	113
PID 3804 wrote to memory of 2856	3804	msedge.exe	114
PID 3804 wrote to memory of 2856	3804	msedge.exe	114
PID 3804 wrote to memory of 1240	3804	msedge.exe	115
PID 3804 wrote to memory of 1240	3804	msedge.exe	115
PID 3804 wrote to memory of 4844	3804	msedge.exe	123
PID 3804 wrote to memory of 4844	3804	msedge.exe	123

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\alpha xskidding\Monaco\index.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2c4,0x7ffe2b0dc188,0x7ffe2b0dc194,0x7ffe2b0dc1a0
  2⤵
  PID:6140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1848,i,17247422539219969067,14976471547075360976,262144 --field-trial-handle=2580,i,10737444398118972789,14100265475307522377,262144 --variations-seed-version --mojo-platform-channel-handle=2572 /prefetch:2
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2124,i,8019019912500623249,17631172987535854594,524288 --field-trial-handle=2580,i,10737444398118972789,14100265475307522377,262144 --variations-seed-version --mojo-platform-channel-handle=2780 /prefetch:11
  2⤵
  - System Time Discovery
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2404,i,10662322596890047839,2192815730658718203,524288 --field-trial-handle=2580,i,10737444398118972789,14100265475307522377,262144 --variations-seed-version --mojo-platform-channel-handle=2884 /prefetch:13
  2⤵
  PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3632,i,966135956692613433,2554745177062934389,2097152 --field-trial-handle=2580,i,10737444398118972789,14100265475307522377,262144 --variations-seed-version --mojo-platform-channel-handle=3664 /prefetch:1
  2⤵
  PID:6008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3636,i,10640333246493582094,15035502965771807227,2097152 --field-trial-handle=2580,i,10737444398118972789,14100265475307522377,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:1
  2⤵
  PID:1980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4308,i,4229686012967447609,18362876771369105328,2097152 --field-trial-handle=2580,i,10737444398118972789,14100265475307522377,262144 --variations-seed-version --mojo-platform-channel-handle=4984 /prefetch:1
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4320,i,8315788341411335788,18226319631685616278,2097152 --field-trial-handle=2580,i,10737444398118972789,14100265475307522377,262144 --variations-seed-version --mojo-platform-channel-handle=4856 /prefetch:9
  2⤵
  PID:1120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,684096368653788831,7545096594903606031,524288 --field-trial-handle=2580,i,10737444398118972789,14100265475307522377,262144 --variations-seed-version --mojo-platform-channel-handle=3784 /prefetch:14
  2⤵
  PID:1048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3832,i,12737079314623666268,2934760931382681525,524288 --field-trial-handle=2580,i,10737444398118972789,14100265475307522377,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:14
  2⤵
  PID:4048
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,2320120359479304174,1954266888007176463,524288 --field-trial-handle=2580,i,10737444398118972789,14100265475307522377,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:14
  2⤵
  PID:5496
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,2320120359479304174,1954266888007176463,524288 --field-trial-handle=2580,i,10737444398118972789,14100265475307522377,262144 --variations-seed-version --mojo-platform-channel-handle=5884 /prefetch:14
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,5322774402184578038,6727668828902201906,524288 --field-trial-handle=2580,i,10737444398118972789,14100265475307522377,262144 --variations-seed-version --mojo-platform-channel-handle=1228 /prefetch:14
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5880,i,9029235589829922632,1420418831966598155,524288 --field-trial-handle=2580,i,10737444398118972789,14100265475307522377,262144 --variations-seed-version --mojo-platform-channel-handle=5164 /prefetch:14
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,16938157199147139179,4260652681489872928,524288 --field-trial-handle=2580,i,10737444398118972789,14100265475307522377,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:14
  2⤵
  PID:936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1220,i,14398398695809375589,11307870128382025827,524288 --field-trial-handle=2580,i,10737444398118972789,14100265475307522377,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:14
  2⤵
  PID:5496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5588,i,3211699190679536218,3750024824818950729,262144 --field-trial-handle=2580,i,10737444398118972789,14100265475307522377,262144 --variations-seed-version --mojo-platform-channel-handle=6388 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4828,i,4264774875982385763,701973254183648688,524288 --field-trial-handle=2580,i,10737444398118972789,14100265475307522377,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:14
  2⤵
  PID:4580
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5800,i,810918009155544326,16147339260196689137,524288 --field-trial-handle=2580,i,10737444398118972789,14100265475307522377,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:14
  2⤵
  PID:4732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6140,i,460593875812974739,2236256449367223731,524288 --field-trial-handle=2580,i,10737444398118972789,14100265475307522377,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:14
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5744,i,18154316216939299188,16223371600386044902,524288 --field-trial-handle=2580,i,10737444398118972789,14100265475307522377,262144 --variations-seed-version --mojo-platform-channel-handle=6724 /prefetch:14
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3136,i,2819434371299973019,12456537086855875873,524288 --field-trial-handle=2580,i,10737444398118972789,14100265475307522377,262144 --variations-seed-version --mojo-platform-channel-handle=3120 /prefetch:14
  2⤵
  PID:4844

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3272

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2168

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:520

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:3256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 ecf415a6fd93b1d86635af7cebb059cf11e8872aa71f180cf2cdecd241e8b92e
MD5 1cc18ed83f61e4ee548b697b5a66b0fa
SHA1 ed69a1427ff4111cc52a9df0cb22a2b720753560
SHA512 cb163b5c9bf281b5c025277142676a6892cf4ea9a9163cea40043ef199b5036031e50cc2184fef769cf51473db29c52b63204c9421988ac1eca717890131b4a1
TLSH
T1C5E026E56AC8C27FBA05744B53A8670C82E0360EDEC8BDDA5720889C7841640A2C3EA4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 75a162fd3fa555245da1eb2c4bd130896efa05a7f5f150480fcfb2d0bfa670f1
MD5 3a26cd0694e5da1dd97e6e6584491e36
SHA1 715db7ee8820b84eaf64dee1e341d1a2b0d96427
SHA512 17b14d64e6c928336f3aaa5bfbf13871d2fa25b7b05030ee5195edb4c74c9952d52ca1ea0d23cafe0bd7f76688acd23165c3150014793d1c3ddefd083c11997e
TLSH
T1D9E0268486CECABEEE0074875368634CC3C0360F9EC8EDCA1720C4857402498B2FABA8
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 3a7b22c2643ed0e64df03f9f688d77bd1e89c59ea565bc08dce06d40ae4d45d1
MD5 9f8fe212e889b2653f3ebaca1f6f70bd
SHA1 a6149045bf01b81d2005dc33836fc5662eebd1cc
SHA512 3bea396d6531f6c68dcae0f05172183d3c8f00c4c848194ae570e63d9ea1a9bd330f0157d1c280f24d060aba204434277d18d5fce9b466000a268e8c73893aef
TLSH
T11AE020C594C5C6BE5904748763B4774CC1E1361E9EC4E9451B2488457401444BB99FA4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 4b24b01394e4034e8136ead6517f09eb9a2e483bb86cf4267509c8811b3b78a6
MD5 83e6b322acd8cfb1145b05028b34705e
SHA1 88322443e2907fc4f34287448324d8e9cd8c992d
SHA512 d23d4f49c27650b78a5e255d6192c0d768683dccedb2dc22e45fd2e9ff1152c9b5ea4ed229c20b2dc48442be0afb92319028745696f5446c15b8ef348d866957
TLSH
T1B1612E090B121EC2CB6443BA59D524DCBAFDC9D503876A5080ABED7E7883F1B5BD522F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59932e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59932e.TMP
Size 3KB
SHA256 41d6a0bc3f80eb17f3961280f4a7a0ff84ee90e572dbd1c591510abf3b7831a3
MD5 4269cbb5338b4203da1b1b4c3201d6c5
SHA1 4d252b402b624df2faead988f4f28023e7c1d017
SHA512 add604ef0fd8a61b99700e3b908696e395368688b39a3bf1c2d4ed52d762ecfca7d7b742d234cae6a66dd1578cec441980d6daa74c379f1f9fe4c676e10ba6c5
TLSH
T16E613E090B121DC2CB6443BA59D124DCBAFDC9D503876A5080ABED7E7883F1B5BD122F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 4171e5dda7cad86b3e1bfa661404abd668314db37008af87cdb81b3e269e4526
MD5 9ff76275f0a0598b62fbb5a7575c3356
SHA1 ee3f0cb95e45b029e015ae3ded72be7be4a2c72e
SHA512 b35735325968b1c8cff6037a16bf7ed37b6fb7935a3db069111a9f65b2c67c53de56524c4e8f1423e701f8bdef3d9644732fa9bc3cdfaea7861ea6038b90ea9a
TLSH
T14B41E1F7C3E4966E890196F0AA187E1FCE2D0915832C7C6AC5E0AE1B93E3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 41d3d28c4bf63b229d13e217085eadd9166234b5d37d746ca21dc33d919bd8a4
MD5 7509f3f05673ae452f9fe6707ec36560
SHA1 c3d84547b5a0fa6d99a69d2ed867cdca6054cee2
SHA512 f45595d2d9b1f60a0800ab10aa66247cb438833f0caacef9a957f10ab5b10554817dcd7981e42551711e73949a3a4659b6d0cab12cc8efbd0d58e3c9f641d122
TLSH
T18841AEF7C7E4966E890196F0AA146E1BCE2C0915832C7C66C9E4AE1B93E2471E14165F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 a86f88ee793f28712d61dd4878ea9f90380e85a19197a67063ef880dd3ed7e2a
MD5 e4e0838ff8e55d802ded164faff7ad8e
SHA1 337e86287bbeaef7850ba644206a307db696bb76
SHA512 d88a294f1a35c98151248d000e4c63b22f754cd1b1782e8740e95f6ef828ac0ace6cce1c45a0549ad5a1def73a62d3adcde31494b6bb48d97ae7de62ce99a58b
SSDEEP 192:sxRHRRsbE/fKs24ZprQ5oqzoA8p4//g6+WNIYn83h5GaIgDVJ:sxRHaE/fKslZRni/5ITRtj
TLSH
T19232B615AA68A83B5CCBD31DBB557F93D2F9603261D02E58B6FC961C04E76DE120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 38371fdd3319b70eefa63ed4530cfea1eee9f49c994c307f87f0038521d7988b
MD5 348cdd8885072a71256f03339ee48221
SHA1 e9f7c38464ebeb4ae5f9077bea73464e0c3ce029
SHA512 c10911f2a5e64d59f197b610c489c9cce6b81a5d22d264f9170a66324fdd3b3c98bd02070c274b8607124199cd09cb8390bb629fb03457aa9138e500227f1304
SSDEEP 192:sxRHRRsbE/fKs24ZprQ5oqzoA8p4//g6+WNIYn8oh5GaIgDbJ:sxRHaE/fKslZRni/5IT+th
TLSH
T1A232C715AA68A83B5CCBD31DBB557F93D2F9603261D01E58B7FC961C04E76DE120740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 c2d9e476d9decc49febbc6f669e05a37517ec20174e48c70ff9437ec113deee7
MD5 3708fc1c95e67e56a91000eba2411b4f
SHA1 2b51b7b6e40291928e37fdc70a44a16c939fc04a
SHA512 f261cbcd99654901bf450af15b8ffb5d4e1e0398cb4379a325fce3d3a4c6f9ed69d2b9f41178642a05a6ffa1a48dbbe68c5b8a2c4526378f74390cb98512e869
SSDEEP 192:sxRwRRsbE/fKs/4ZprQ5oqzoA8p4//g6+WNIYn83h5GaIgIJ:sxRwaE/fKsgZRni/5ITRts
TLSH
T17732B6156A68A83B5CCBD21DBB557F93D2F96032A1D02E58B6FC961C04E76DE120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 14db3a8d215836e35561c9966cc948d7b7ef3474e220ef952d05f7cd91636839
MD5 9293550233c52c13294476d12018012b
SHA1 b38075156d73556ca54efccdaa4e44d7504bd699
SHA512 ac94655cb227f0412ce36c5812f1958d4cdded2293c2b2f8aaa1bf77801bfe7f93e80d17aaa95b4fbfcc820d0dcb6208629f966fbf00f6bc4d21a39c05ad5666
SSDEEP 384:wum8dzAfCtgoSFf6MKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVU494oRPQrohMZ:wb8dz6Wgouf6M8F1+UoAYDCx9Tuqh0V3
TLSH
T112B2EC3B604DCB7E5F800AADEC19AFDB7D9802C79A988D4447FE990C02C77EA51194DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8ee8ad58-4f1c-459c-bc95-4ac98d1cfc38\index-dir\the-real-index
Size 552B
SHA256 e8180e456e704b88abb2b3f89cf95f25d5a7922b6401c6eaa2d6545c311f3926
MD5 8a9abc6f47300c1ae77d931395c38aff
SHA1 1199bbde3ca0ff54fec5660b79b5894717b1546d
SHA512 fa80255b69a9cef9a1f9fe1129a5a429f4c3c3d49ca2fcee44201378b6919c1f40b1c4a6d3298ee54a8a304ef009c556ede5c80efd07043126a885e3d37e7c44
TLSH
T171F0F19BECA7D583C83278B7157A350A333E09FD21015EAB002D503A9E72B3D8241345
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5dcf59.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\8ee8ad58-4f1c-459c-bc95-4ac98d1cfc38\index-dir\the-real-index~RFe5dcf59.TMP
Size 552B
SHA256 c04d79258a1d0a2dbe1152a209f38a2d23e89843f1bf54d97ec292689cbca75c
MD5 c4ad0c45d033e1fb08f821034eedca44
SHA1 efe57454cdcf6bac0b7a863a69cb921ba61acbb2
SHA512 89b758c27ac2dbc98592c5217c313829a9927799433e37a19816544a846b260ad2f576e9c03dbaafee0dbee545555dfe569451a76be54d9c8a02120950c1f965
TLSH
T102F0F1E70091ED92D92194F921256016323E08303155DA8F609B242A483177C8281A41
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 d4db5065fc4a6683a49192235a87ff2ed1608e9ee6fc5a2be68a5ad6509f78e6
MD5 48304d8fd6317d1871817980cda148bd
SHA1 3220f6a74a9e979ba6ee2e4943e71972b41aa5d9
SHA512 d53c0400555b9823f3ee2ce1523e5307aa235a48c7271913033798878c4f1e3901f9f6cfb62164801c5c1444a9e144f8f9d9d3b0a63cfca97431cecd73d82015
TLSH
T190E020773EF72814ECEFD7DB1835745105117554844DBD5F6816E2D710B236434AAC61
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a27cd.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a27cd.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 937df830cf8a9d44118efac39227bae944374f4770453ddc1ea630a906a14227
MD5 679634a342dbc6e35e22a2038e87679d
SHA1 9cf96aa2dc4523739cdbe3a2a8beb4d01f45b501
SHA512 d3910faec0e9647557083ca7407997b7b8e1de0800fa8d6611e314ed694136cd74efdffeb9acc8be246e35aec9b56fc5403fdfdaf28a4d15295693f0c09b2efb
SSDEEP 768:gF3xBWXDZIO0BoG6Nzc4ReyIsPkAa2xQAL:gF3iVtc44bs8Xrs
TLSH
T126F2BE71EC34DD63ACFAA345F54B3252ACF5912781D86EA486EE3B0C05476DE031B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 6d0ee75b5c32796f5daa19abba6995e02dfa15089a6f54648c88fd9b45d6002a
MD5 d10ed206a7cc89aeb02b39558d228618
SHA1 cd72e2c48db83434bc41887295ab6e2cdbddabcb
SHA512 5a13b91fc4130e009d7085cb6fab4000c6f8aa72fb5315dc4786422154f71717d228bc314b6912d06ff5346361f20593afee1c2cd5ad2a185dc1b95e5a739180
SSDEEP 768:dF31BWXDZIO0BoG6Nzc4ReyIsPkAa2xQAL:dF32Vtc44bs8Xrs
TLSH
T1A1F2BE71EC349D63ACFAA345F94B3252BCF5912781D85EA486EE2B0C05476DE131B823
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 74544fbc5bde49c1373c0af89639b05635ef9793725e2fcaee61bef32b6b0065
MD5 80e906c7a84c829d93857ae615a35d65
SHA1 ce7aa65d207e9ad39a9d157573844b6f9a020654
SHA512 9cb9cbf454b155730af5f6a5aec805d95d5068cd45a49eb2ae150d4f5998eeba377e1da7d4b6e56c82bd85054b5d7b326641a710a97cfca8a5d080ca76e2ea81
SSDEEP 768:Erv+4UNbdK3xWWXDZIO0BoGKNzc4ReyIsPkPl:EbsbI3jftc44bs8Pl
TLSH
T1AB03CE32F828D973ACF66682B40B35537EF4616B81C91AA4D9DE2F4C064B5DE131B913
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 8eb203e2a6fc92e7c369e0fa062d83e46ac2d43cf938fbef9e94f49b7f704024
MD5 0a75c89f2400669cbd4f2d8cbd47db42
SHA1 3f5dbc6efde62e1ce34c1565a625f951e5e352a7
SHA512 c1f4c3dc4506474cef036eb2f78e1284eaf222b9b7572c3a47fb8ce2f7d50ca1f2ff19de1fff62ff8603b099a7d63a1890ce0b807d24d0da9e5742ddcc4b7806
SSDEEP 768:KFQK3RwgjBWXDZIO0BoGaNzc4ReyIsPkAa2xQAL:xK3IRtc44bs8Xrs
TLSH
T16503BE72ED64C967BCBAAB85F94B3252ADF15167C4D8AAA4D3DE2E0C01471DD031BC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 d076515f116c394f4c9830786d759d8efb4337b185bce22d3787d8d49035bb3b
MD5 cb4af94c8faaa782b4dffde4691625ac
SHA1 ed28b8e4ab53b7628f759fb19e4a745ea1026d28
SHA512 2f283ebfde18cde92d136d831821b87fc9c7c283b94c82d5343d2865eacbe9a6adfa23d94c9955cbc73d9c4ebb9efd7068cd920700c0bd4db5516fe17571b15d
SSDEEP 768:6rv+4UNbds3SDDZIO0BoGRNzc4ReyIsXJeVH1S5D:6bsbS3Oqtc44bsZEH1Y
TLSH
T15D03CF32A878CA77ACF6A786B54776533EF8512B82981ED0C5DE2F0C464B1DD030B927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download