1487de71b9b842a1760cda32d6f7e56d8cbb344c628c8c3a4cf790d936aa4ec5

Analysis

geolocation tags

eueuropelondonukunited-kingdom
max time kernel
898s
max time network
885s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 16:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
alpha xskidding/Monaco/index.html
Size 246KB
Sample260804-tr34gade83
SHA256 1487de71b9b842a1760cda32d6f7e56d8cbb344c628c8c3a4cf790d936aa4ec5
MD5 ae12424bfb14566dc102a18b0f6f8537
SHA1 0f7456f58b6ae2a0c0907b72be0c37b8bf389f17
SHA512 401e0c1c80eca262336eeef2cd32ff54c7f4cd05150d5390de7ac48a691c5ffb266b2cb735c047cb5356a6556593261aba6fb8681a81b31439fb0b3b2661900d
SSDEEP 6144:pH2bGbgGyiduhw506QCfDu901FAexvr6LX6YXkPrPpymYUUA70/kub5MJKpLZzSA:7zIGFxe
TLSH
T198340F1FB601190226B3933062567B29FA7042BBB5521B0B3F7CE7102FB569E519BBF4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
16	raw.githubusercontent.com
17	raw.githubusercontent.com
19	raw.githubusercontent.com
21	raw.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2332	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303344908995730"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{F892810B-E070-40E7-9C83-CE209E4AD029}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2976	msedge.exe
2976	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe
4684	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 4684 wrote to memory of 3132	4684	msedge.exe	84
PID 4684 wrote to memory of 2332	4684	msedge.exe	85
PID 4684 wrote to memory of 4880	4684	msedge.exe	86
PID 4684 wrote to memory of 4880	4684	msedge.exe	86
PID 4684 wrote to memory of 4880	4684	msedge.exe	86
PID 4684 wrote to memory of 3676	4684	msedge.exe	87
PID 4684 wrote to memory of 3676	4684	msedge.exe	87
PID 4684 wrote to memory of 944	4684	msedge.exe	89
PID 4684 wrote to memory of 944	4684	msedge.exe	89
PID 4684 wrote to memory of 944	4684	msedge.exe	89
PID 4684 wrote to memory of 4976	4684	msedge.exe	90
PID 4684 wrote to memory of 4976	4684	msedge.exe	90
PID 4684 wrote to memory of 4976	4684	msedge.exe	90
PID 4684 wrote to memory of 3864	4684	msedge.exe	91
PID 4684 wrote to memory of 3864	4684	msedge.exe	91
PID 4684 wrote to memory of 3864	4684	msedge.exe	91
PID 4684 wrote to memory of 3916	4684	msedge.exe	92
PID 4684 wrote to memory of 3916	4684	msedge.exe	92
PID 4684 wrote to memory of 3916	4684	msedge.exe	92
PID 4684 wrote to memory of 4564	4684	msedge.exe	96
PID 4684 wrote to memory of 4564	4684	msedge.exe	96
PID 4684 wrote to memory of 3440	4684	msedge.exe	97
PID 4684 wrote to memory of 3440	4684	msedge.exe	97
PID 4684 wrote to memory of 1744	4684	msedge.exe	99
PID 4684 wrote to memory of 632	4684	msedge.exe	103
PID 4684 wrote to memory of 1128	4684	msedge.exe	104
PID 4684 wrote to memory of 400	4684	msedge.exe	105
PID 4684 wrote to memory of 2104	4684	msedge.exe	106
PID 4684 wrote to memory of 2104	4684	msedge.exe	106
PID 4684 wrote to memory of 2224	4684	msedge.exe	107
PID 4684 wrote to memory of 2224	4684	msedge.exe	107
PID 4684 wrote to memory of 2976	4684	msedge.exe	116
PID 4684 wrote to memory of 4160	4684	msedge.exe	118
PID 4684 wrote to memory of 4160	4684	msedge.exe	118
PID 4684 wrote to memory of 2480	4684	msedge.exe	119
PID 4684 wrote to memory of 2480	4684	msedge.exe	119
PID 4684 wrote to memory of 4144	4684	msedge.exe	120
PID 4684 wrote to memory of 4144	4684	msedge.exe	120
PID 4684 wrote to memory of 2768	4684	msedge.exe	121
PID 4684 wrote to memory of 2768	4684	msedge.exe	121
PID 4684 wrote to memory of 1316	4684	msedge.exe	122
PID 4684 wrote to memory of 1316	4684	msedge.exe	122

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\alpha xskidding\Monaco\index.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffbd8d7c188,0x7ffbd8d7c194,0x7ffbd8d7c1a0
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1968,i,7233033437988881097,2541789290201623163,524288 --field-trial-handle=1728,i,6175995493463643493,7394203284309401093,262144 --variations-seed-version --mojo-platform-channel-handle=2168 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,9263282451085967635,6736692440292830064,262144 --field-trial-handle=1728,i,6175995493463643493,7394203284309401093,262144 --variations-seed-version --mojo-platform-channel-handle=1724 /prefetch:2
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2592,i,12491793930029474451,12238556908100356553,524288 --field-trial-handle=1728,i,6175995493463643493,7394203284309401093,262144 --variations-seed-version --mojo-platform-channel-handle=2740 /prefetch:8
  2⤵
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,10869822943928443040,94820298212533027,2097152 --field-trial-handle=1728,i,6175995493463643493,7394203284309401093,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,13232234805060495456,13579114720489158161,2097152 --field-trial-handle=1728,i,6175995493463643493,7394203284309401093,262144 --variations-seed-version --mojo-platform-channel-handle=3572 /prefetch:1
  2⤵
  PID:4976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4192,i,18265938981499734272,11829490151972701051,2097152 --field-trial-handle=1728,i,6175995493463643493,7394203284309401093,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:1
  2⤵
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4200,i,243681125958590979,11702469842946892789,2097152 --field-trial-handle=1728,i,6175995493463643493,7394203284309401093,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:2
  2⤵
  PID:3916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3676,i,5169362082390701362,15982945470415786377,524288 --field-trial-handle=1728,i,6175995493463643493,7394203284309401093,262144 --variations-seed-version --mojo-platform-channel-handle=3640 /prefetch:8
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3680,i,2261426457851840636,6189522781138151734,524288 --field-trial-handle=1728,i,6175995493463643493,7394203284309401093,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:8
  2⤵
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,14312141270490590453,7202814624620443918,524288 --field-trial-handle=1728,i,6175995493463643493,7394203284309401093,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5876,i,14312141270490590453,7202814624620443918,524288 --field-trial-handle=1728,i,6175995493463643493,7394203284309401093,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:1744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4384,i,2406101429338689337,7500411882762037254,524288 --field-trial-handle=1728,i,6175995493463643493,7394203284309401093,262144 --variations-seed-version --mojo-platform-channel-handle=6236 /prefetch:8
  2⤵
  PID:632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4376,i,11335021081797368234,448571298622886973,524288 --field-trial-handle=1728,i,6175995493463643493,7394203284309401093,262144 --variations-seed-version --mojo-platform-channel-handle=5000 /prefetch:8
  2⤵
  PID:1128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4932,i,13390161065286920702,8878809004216150909,524288 --field-trial-handle=1728,i,6175995493463643493,7394203284309401093,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:8
  2⤵
  PID:400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4960,i,3520608133172652295,16627052782014829461,524288 --field-trial-handle=1728,i,6175995493463643493,7394203284309401093,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5848,i,793282311970786515,4224752792062390442,524288 --field-trial-handle=1728,i,6175995493463643493,7394203284309401093,262144 --variations-seed-version --mojo-platform-channel-handle=5472 /prefetch:8
  2⤵
  PID:2224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5348,i,699434709749850433,513343794716511030,262144 --field-trial-handle=1728,i,6175995493463643493,7394203284309401093,262144 --variations-seed-version --mojo-platform-channel-handle=4924 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3660,i,6171097794574949040,1242659759073408710,524288 --field-trial-handle=1728,i,6175995493463643493,7394203284309401093,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:8
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1032,i,11312939912225112856,14451892122668954251,524288 --field-trial-handle=1728,i,6175995493463643493,7394203284309401093,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:8
  2⤵
  PID:2480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5328,i,17174108866464345479,17582093809942239761,524288 --field-trial-handle=1728,i,6175995493463643493,7394203284309401093,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:8
  2⤵
  PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3128,i,6196871971499350765,9850107390838833063,524288 --field-trial-handle=1728,i,6175995493463643493,7394203284309401093,262144 --variations-seed-version --mojo-platform-channel-handle=1296 /prefetch:8
  2⤵
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5796,i,730435110888744332,5501378473452965545,524288 --field-trial-handle=1728,i,6175995493463643493,7394203284309401093,262144 --variations-seed-version --mojo-platform-channel-handle=3052 /prefetch:8
  2⤵
  PID:1316

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3488

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 1e5d45836fcca7daf9ed7520853dd60e934f175207e58aaed3ac4e3cde11f626
MD5 c3bf32cad39356e4f31a7140fcdecb49
SHA1 aa18e4600b8b82cf080fd2b829b0ef1a9ad36aef
SHA512 b8dc1f8fbda37c29827cb0ce0912953d10b8a3250c1d5d904a4557a523e98414e6a354318d774062646d367c589a0472e4db06eaf95c5a435a1dfa372fdb0332
TLSH
T11FE026C459CAC2BEA608B46B5178578C82D0370E9FC8BFDA1700E585B041048E383BA4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 0ec82d8a5bfa137ca6a2a83a0dcbce53159094ada85b73f6c1c3c01032d157ed
MD5 2440c8ca781e93a26903cb1c483fc859
SHA1 cb4672d86e5c17cb5c69569c790ac13405c1bfcb
SHA512 4f60cfe12bf3ec7b342ae8ce43c310d88dead2e418c9349c9c854c030a11e3f5e786de4bd59d81e842cfe56002b626b384409d3c91afccc2667c579eddf6753b
TLSH
T1E1E0DFC506C8E3BEAA0A644B916C970CC2C1371EEBC8E99A1B0884847202850B6C2EA9
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 4a756e9a8429b0f11a91e82527f00ee73abe5ad9c3765e500ead940fade4abc5
MD5 6442cf8a3cac3c168757b3cbbb28db51
SHA1 d1d7221c7650e681e63bf791c3a9f90a9ed14603
SHA512 6f6852d588eb7fe962acce79cd0077ffc9b68a3ef9559580c047d872811a9ad780b90043ddcfb61c768e954815d0726c6a4ed8e5f8c112bbd7c52b4fe7d15abf
TLSH
T12FE020D405C8D3FD55546587D1F473CCC1C03B0EFFCCE9551B108485710284476C1D65
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 6e33fd86b6d606d25abaef5682c49b85f64ae8b8728b05ad40527a2dade58bfd
MD5 66ee96e91ce2b9f5aae6534a4484f46e
SHA1 263a7c0287fa449161d3fafb6657c6cd819dfa57
SHA512 ea6ae8a3ccca01e0ec6adb398b66291809178482239937804a8058e9e8d19753fb85d504bad3d8c8cce377f6b24d471269141849df5aa5c0fdf6744f122c3cbc
TLSH
T147E026CD06CAC6BFB60AE44B5268578C82C0370FDFC8BADA5714C684B002244E292BA4
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 2703effb03cb2f27b5d540753fea816d46d83cc619455001e32cb47dd503f7fb
MD5 1882c46d944a94b94460749517899770
SHA1 c2f1871ab23c0f599fef6d3e15f971cc59d8882c
SHA512 d47aaa40fea2811a2cfd5ec4b8e8479ed66187a8238972e71d1370f414b7a4b1772e9eb5863c8f28e8eee8a45b28877d0efc9caf852a925223c5a406f78f3aee
TLSH
T15F41E7F002A35B41DF3016B190F11B00367683DDF9737E18829299BE3A3AF63852647D
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 b9992157f8e67a3b74a60c2b6c0bd59942c2fd29d02f6bf69cf29467392c936d
MD5 c637a2d2ee3beb4c51c9da7d94716f1e
SHA1 9a0b7dfa04e35d8036d65240ac25963a57838ecb
SHA512 1cd836f3229bcf50944ae37a283966fea5338be71724131112475346871a18776ddda8cebab2c7503cb7ea737338dd139646c8d72f3a4c801abbd73d76326951
TLSH
T1D31180F3C3E5866E8A1156F09A24AE2BDE2C0606821C7C25C5E4FF2B93F3075E00155F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 58a1f3c4631ca78114e28623617f012382180dc5ad8fbddd73948dcba339b8ea
MD5 a4155a8b22c29cd389303c3255e6ee07
SHA1 a177dd83a9564979927909d184404f1eea4d02e5
SHA512 02115d052483b66412e6dc8d67081dddcece74f4a68b16dab3ca077828c27950820e832be6b2980dfbd9c068b77bd3420b8836ff5642742355366fa816dac246
TLSH
T13C1160F387E1866E891156F05A18AE2BDE2C0506421C7C6585E4EF2793F3071E00265B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 4f208f77a307043e4b605d67ed1c0086074a0ead00ded36c2d0788d070904dd7
MD5 dfd4b3a8187e109a68db6576a0374d5e
SHA1 91fd9c5b90cc85f0db302176f2e0ffd3b3eabf1e
SHA512 39b2b09c3fc4ce9d1283def61f1422bb57e63422e60a61b83541d76740caa1a4e8deb930c2507f02bace7bdcdd458196bb7a4582e682e186b85c61f04e07deaf
SSDEEP 192:sxZIRWkq/fNsH4PH7IdpdqHW6+WNGY9IKkI1IgrJ:sxZIrq/fNsHqEAHbGA9
TLSH
T18722B7126E3868774CC7D30ABB55BF53E6FA503191941E58EAFC961C05E66DE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 97f79d5b3757a3efb84d572eeb8b5070195ceccc9583e505d8891cd8b82084c0
MD5 a60f84af706e81393b99c811052adc7b
SHA1 18737e30c78706981b8f4303a3c03e5fd55f108d
SHA512 5aa6515f099c0f6296802be25875f502c10a0e63f44b9647a68366db937d19fba9fed4c10bc831042e5be13c9e15cb3f2b4570eb460967150e18c10a289b1770
SSDEEP 192:sxZIRWkq/fNsB4PH7IdpdqHW6+WNGY9IKkI1Ig59J:sxZIrq/fNsBqEAHbGAV
TLSH
T1B522B7126E3868778CCBD30ABB55BF53E6FA503191941E58EAFC961C05E66DE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 021ff8dd1bf48d7a331a41a0880711ed2ba66002d8fefc532ee1afa91856a6e0
MD5 c60af4e714ff6eb55d38961b130eb9f5
SHA1 156e45093a17a1e58f7f5b0d266aaf029dd3d4a5
SHA512 69584806d07dd74627dbc9263bc53ef2c6f4d9394af8c9dc9ebb70544cc6622a935d7edb92b7b643a68b119deca0891a7c6f1e213cf3011a4c6bab6596aa6a5f
SSDEEP 192:sxZIRWkq/fNsB4nH7IdpdqHW6+WNGY9IHAI1Ig5XJ:sxZIrq/fNsBiEAHbGj7
TLSH
T1AB22C9126E3868778CC7D30ABB55BF53E6FA603291941E58E6FC961C05E76DE220780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 b094a09438b1ad345cf991e8aa98cb7ea4c3b01e0bfdd498343ed74fc6f3f48a
MD5 b4fcf8cf3e02bf2a9e439f0fd4a68940
SHA1 e853a9f77262f797e28be772aaa903093ca9addc
SHA512 a3bdb7f66861e7885f028eb3056f235a7b55eccd4ea6b89cf7aad10b2c307e84a5e4cd8a4d8d71e5251fb81d1512443b5202d47c7f4ac453aca6312ab1503f47
SSDEEP 768:4cyvIZwWvu+Q+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVDFLlwmW7/ro+bq/G:4cyvIZwWvu+Q+u1jamFLeR7s+r
TLSH
T1D6C2E92B240CCB7E5FC01E9D9D5A6F9B3EA802C7A7588D4047FD994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\6539c260-5404-4f2d-80ed-ee2bdb57a400\index-dir\the-real-index
Size 360B
SHA256 fbcb445c6b649147432b009e2b9441def3421879a29b7a3c572107d2cd0e61b9
MD5 8484a5a65602562646cbe136a68d46cf
SHA1 75b9c179ad557b30ac86f4b26676688e741f9373
SHA512 2961e9b4e02f23b02671dcc5a80a98851f6f6d1cebec33fa9352b6e6c9d6c593b19e97077d0a06c7e9cf2b0a2fa3d0375871f83557007edef4709addcd353cd5
TLSH
T180E0EB008E810936C464033228B64AA063B04EFCA524D402183C40393C0825C610A2EC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ce8b2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\6539c260-5404-4f2d-80ed-ee2bdb57a400\index-dir\the-real-index~RFe5ce8b2.TMP
Size 360B
SHA256 c48c6ab0f65fc5b21ab6e9b956ef3719090c2b29bd5a0902eb8c1856ca4a2545
MD5 7d82283ebddcf9deae4cfd7a9b94fea4
SHA1 eb9b06c16ad4ba593e2f05addacbf1eeb7792acd
SHA512 d189623f5393086ce6788a8ce3b8f08e42c2c768b4991ab35d37b23f2298e2c73181bcbb961e117cdb820d9c53688f02d011255be2a3d4a47de06cb6e6ca0bb9
TLSH
T15FE095C5C7924D21D5541537281749DDF2704550A614F703353C543D2C25ACC5B471CC
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 abb3090552177dabff697aeee62f5ef4595c13d5ab3c7dc8060148d72420b9ad
MD5 7683091353177029ab9dcf13b5951bb5
SHA1 b25674783d5a1b7df7f042194490205a7cf28dab
SHA512 5867cddee88bd9936cf5730948ae46928a1550c2fd2638f6b0fc4bd4231c6546cf203021f0c76710e6c26d586c9dd1d66a9a9c198f0b1da37630b35547d61ccd
TLSH
T119E0D8BA2EE71D20FD5FE3D9293144E900157C888D48FD4E642A6A8B64F02502426C73
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 4b49d2f9d30ff003b291d4e9edb53dc5626706e3d5d93d06828eddadce81fa54
MD5 349da796c88c2ddae09d64243510e13a
SHA1 9378d12042131d66078905ab0df92851d2bd8c28
SHA512 2be79d07d76159c850cdb2bc166bb9eed2451c06009fd5441916e4bda46aa453a1a6f759a6cdb7d984b60fc3468f66fdf7f8f6aeb9fce32cf80d20168883ace6
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDaAYKhy+iVoZFf7Xkn76P59kKBB53ktlFag:mTXjiVoZFf7Xe76B9hB53ulFafI
TLSH
T1EB91F206B13B029339BF685DA2A589368E4131637A14E96E7FB800A18F27E111DFD4CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe593b69.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe593b69.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 f89168ed3323b5b63c4c9743a3621ec41f68c63e77d2c56010f2f4cb85496f99
MD5 9cfb833959ed18feec1730e72302e53f
SHA1 17e81d01f989e27b322b73b6e0b8d9b54757af2e
SHA512 9a3622a12a8049be7dba7cb93bad88cc50132e141bb902b093a521a6a82ebc027f09dc669f540713b72c35ba920c5239e68725a7c53e2b2c894022551850117d
SSDEEP 384:PZcIhsNTPKziu7gdue+CndHeRe6b/BeRs9JKgqijULs:Hh1HgLfE5b/TjKgqmULs
TLSH
T1DA927D3058346D7AAAE6A586F58636135FF8D033E6C52F94A5ECAF0C019B5AC130A52A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 4c8767cd54ad3d9023b9d8bbe6d2a47b89b4ddd9b963e95ffc263346170d39b2
MD5 20724f501fb877d8b4847fe1ade2e79a
SHA1 a4816aba50b684247bca610112ded151bff89bea
SHA512 f24c3839e0a3b5b8ceeef638e77650f3d449c4b66159a0b4cf12976a835ff7f410e34cbd8dea748173a2bee26ce3009ec4a8f4c6b2a71796375c4b61dd6b64da
SSDEEP 192:JONii6v+YLNQmiUybUbZZh+CGp+Fdes9odusIPU6:JONii6vz/7Zh+CndHe9CU6
TLSH
T15A02F9356D382C6B9FF2AE45F5873A135FA82177EA962F84D9E81E0C01D765C2302826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 d5e8687f4811991514ff452902ce97b7072e28bc9b61666cba72908cfb8404c6
MD5 20c92d0c4e9a2855eb7c40b016e1c1b6
SHA1 5cdd0a8410da395381a9c9854cc1263141e92464
SHA512 b0e0776952314b933dcdc759e923c4f8eeb7cd1821aacdc523cca0761e3d8f7cf0bd9ba0e135e5f59b4c4753e497f97d20524d040122d8ee6bebbab9a69b0e27
SSDEEP 384:FiFiZcI6zsNt8TUNTUlIlWKziu7gdue+CndHeRe6e/BeRs9JKgqijULs:MFQSowgdHgLfE5e/TjKgqmULs
TLSH
T178A27D324864997BEAF6AB85F58636038FF49073D5C1BF94E2DCAE0C019B5DC130B925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 ba4cb3aa8aad1dc1dff1cdcf9e1e850ec41543c029a53dde3faad7c47734d02d
MD5 d92417c50e403a55e2154a91c0e88de0
SHA1 1266b8a3703abece86c5eee1377027e0d6417e06
SHA512 a4834f496baab9a749a07e49b2dcd6a8ad7103c140e75c1f1eac4f3c0d0ae4d76de0b47abc7dc7ea17b508e39c11f3bd233df84551002bf8d911ffe3430dff0d
SSDEEP 384:OZcIhsNTWKziu7gdue+CndHeRe6b/BeRs9JKgqijULs:shmHgLfE5b/TjKgqmULs
TLSH
T112928D3058346D7BAAF6E586F58636135FF8D033E6C52F94A1ECAF0D019B5AC130B52A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5dbff638fada4e6c5a53b105a24e0bbafa05ef2943948c1fab05dd59f68c4ec1
MD5 6491d1e88e19e1cc88996ea45262e040
SHA1 5639d36b7049983530a325d1c775bc09643b7723
SHA512 72fa3dcad818cbf3508eb00a47fdc8f46ea514a4bebe61cccf9f616a5ee7a53638a6fa15d2d1997911aecf548b3ff75d58231b6e664999697a1aaff3c3b63080
SSDEEP 192:eON+6v+YLIQmiUyb4bZzh+CGp+Fdes9omOQN6TCHDqcU6:eON+6vz85zh+CndHeRe6g/U6
TLSH
T16B121C356C386C6B5FE3A942F48735135EA89277EA863F84E5EC6F1C01DF6AC1306426
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6c2cddf3-a8d6-4077-a083-a95e5408712e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\6c2cddf3-a8d6-4077-a083-a95e5408712e.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 a82cb51d89840be21297797e385ca4a68ef7b352335fe535690339b0aaf78b71
MD5 7e6ec100cf20e8e377fcfee2afd3f1cc
SHA1 5d8a58ce6a0daf6e248e75083f1d2117ed6d4f01
SHA512 0c0f3f7fdec3eddda3425bc9995f9ab6accb2dcf7adb0e92a369fc93b22ef9072ef9678a793eff49737f5cb57cff4b28193177f4483a5e8888ddf40734cebaaf
TLSH
T124410798AAE90148B3B76E56EBF6A86D847A79772E07D55D00050D5F0A23B40C8A2B37
MD5 SHA1 SHA512 TLSH

Submit Download