hxxp://doxbin[.]net

Analysis

user interaction
yes
max time kernel
898s
max time network
892s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 17:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://doxbin.net
Sample260804-v4cygsed39

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2844	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303384261032685"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{5239C938-713C-4384-BE84-A91442F2F943}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1160	msedge.exe
1160	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe
1492	msedge.exe

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 1492 wrote to memory of 3976	1492	msedge.exe	85
PID 1492 wrote to memory of 2844	1492	msedge.exe	86
PID 1492 wrote to memory of 4388	1492	msedge.exe	88
PID 1492 wrote to memory of 4388	1492	msedge.exe	88
PID 1492 wrote to memory of 4388	1492	msedge.exe	88
PID 1492 wrote to memory of 5096	1492	msedge.exe	87
PID 1492 wrote to memory of 5096	1492	msedge.exe	87
PID 1492 wrote to memory of 964	1492	msedge.exe	90
PID 1492 wrote to memory of 964	1492	msedge.exe	90
PID 1492 wrote to memory of 964	1492	msedge.exe	90
PID 1492 wrote to memory of 3752	1492	msedge.exe	89
PID 1492 wrote to memory of 3752	1492	msedge.exe	89
PID 1492 wrote to memory of 3752	1492	msedge.exe	89
PID 1492 wrote to memory of 3648	1492	msedge.exe	93
PID 1492 wrote to memory of 3648	1492	msedge.exe	93
PID 1492 wrote to memory of 3648	1492	msedge.exe	93
PID 1492 wrote to memory of 3920	1492	msedge.exe	92
PID 1492 wrote to memory of 3920	1492	msedge.exe	92
PID 1492 wrote to memory of 3920	1492	msedge.exe	92
PID 1492 wrote to memory of 116	1492	msedge.exe	96
PID 1492 wrote to memory of 116	1492	msedge.exe	96
PID 1492 wrote to memory of 116	1492	msedge.exe	96
PID 1492 wrote to memory of 4812	1492	msedge.exe	98
PID 1492 wrote to memory of 4812	1492	msedge.exe	98
PID 1492 wrote to memory of 4812	1492	msedge.exe	98
PID 1492 wrote to memory of 664	1492	msedge.exe	99
PID 1492 wrote to memory of 4476	1492	msedge.exe	100
PID 1492 wrote to memory of 664	1492	msedge.exe	99
PID 1492 wrote to memory of 4476	1492	msedge.exe	100
PID 1492 wrote to memory of 3196	1492	msedge.exe	102
PID 1492 wrote to memory of 4668	1492	msedge.exe	108
PID 1492 wrote to memory of 4668	1492	msedge.exe	108
PID 1492 wrote to memory of 4668	1492	msedge.exe	108
PID 1492 wrote to memory of 600	1492	msedge.exe	120
PID 1492 wrote to memory of 1888	1492	msedge.exe	121
PID 1492 wrote to memory of 1736	1492	msedge.exe	122
PID 1492 wrote to memory of 4164	1492	msedge.exe	124
PID 1492 wrote to memory of 4164	1492	msedge.exe	124
PID 1492 wrote to memory of 4164	1492	msedge.exe	124
PID 1492 wrote to memory of 4296	1492	msedge.exe	126
PID 1492 wrote to memory of 4296	1492	msedge.exe	126
PID 1492 wrote to memory of 2320	1492	msedge.exe	128
PID 1492 wrote to memory of 2320	1492	msedge.exe	128
PID 1492 wrote to memory of 2320	1492	msedge.exe	128
PID 1492 wrote to memory of 1160	1492	msedge.exe	129
PID 1492 wrote to memory of 3312	1492	msedge.exe	130
PID 1492 wrote to memory of 4260	1492	msedge.exe	131
PID 1492 wrote to memory of 3312	1492	msedge.exe	130
PID 1492 wrote to memory of 4260	1492	msedge.exe	131
PID 1492 wrote to memory of 2972	1492	msedge.exe	132
PID 1492 wrote to memory of 2972	1492	msedge.exe	132
PID 1492 wrote to memory of 3572	1492	msedge.exe	135
PID 1492 wrote to memory of 3572	1492	msedge.exe	135
PID 1492 wrote to memory of 3220	1492	msedge.exe	136
PID 1492 wrote to memory of 3220	1492	msedge.exe	136
PID 1492 wrote to memory of 3220	1492	msedge.exe	136
PID 1492 wrote to memory of 4972	1492	msedge.exe	137
PID 1492 wrote to memory of 4972	1492	msedge.exe	137

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://doxbin.net
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7ffa9c43c188,0x7ffa9c43c194,0x7ffa9c43c1a0
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1908,i,14266220219613687729,2850465269532950422,524288 --field-trial-handle=2232,i,12519562122062659056,9428161140644077369,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2296,i,4552410750198076452,15371036463099645964,524288 --field-trial-handle=2232,i,12519562122062659056,9428161140644077369,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:8
  2⤵
  PID:5096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,15912188685241268411,8733648203856067204,262144 --field-trial-handle=2232,i,12519562122062659056,9428161140644077369,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:2
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,411539502642943118,11080624206177387757,2097152 --field-trial-handle=2232,i,12519562122062659056,9428161140644077369,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,9140172694458473488,3849178490469507874,2097152 --field-trial-handle=2232,i,12519562122062659056,9428161140644077369,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4208,i,4646093471905446407,14650152133539561978,2097152 --field-trial-handle=2232,i,12519562122062659056,9428161140644077369,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:1
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4272,i,842020835648026764,14739811190923366596,2097152 --field-trial-handle=2232,i,12519562122062659056,9428161140644077369,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:2
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5072,i,11916048207382659111,3603697612128287627,2097152 --field-trial-handle=2232,i,12519562122062659056,9428161140644077369,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:1
  2⤵
  PID:116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3544,i,6532778573190914309,10950190787662728846,2097152 --field-trial-handle=2232,i,12519562122062659056,9428161140644077369,262144 --variations-seed-version --mojo-platform-channel-handle=3752 /prefetch:1
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3840,i,17184916750929999467,4836182137821368177,524288 --field-trial-handle=2232,i,12519562122062659056,9428161140644077369,262144 --variations-seed-version --mojo-platform-channel-handle=5304 /prefetch:8
  2⤵
  PID:664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3732,i,4614206460240621649,9138257654361499175,524288 --field-trial-handle=2232,i,12519562122062659056,9428161140644077369,262144 --variations-seed-version --mojo-platform-channel-handle=3744 /prefetch:8
  2⤵
  PID:4476
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6008,i,15830500653246822891,2480654579034296476,524288 --field-trial-handle=2232,i,12519562122062659056,9428161140644077369,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:8
  2⤵
  PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6008,i,15830500653246822891,2480654579034296476,524288 --field-trial-handle=2232,i,12519562122062659056,9428161140644077369,262144 --variations-seed-version --mojo-platform-channel-handle=6024 /prefetch:8
  2⤵
  PID:3196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6188,i,3151141224991772518,6786000849490501353,2097152 --field-trial-handle=2232,i,12519562122062659056,9428161140644077369,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:1
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4292,i,2222728180612194992,3632532894138603005,524288 --field-trial-handle=2232,i,12519562122062659056,9428161140644077369,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:8
  2⤵
  PID:600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5080,i,47968616618432833,6743228461753870011,524288 --field-trial-handle=2232,i,12519562122062659056,9428161140644077369,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:8
  2⤵
  PID:1888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4256,i,16745372192269862184,5966001268777910530,524288 --field-trial-handle=2232,i,12519562122062659056,9428161140644077369,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:8
  2⤵
  PID:1736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=2556,i,4888016921506828993,2077819056135720907,2097152 --field-trial-handle=2232,i,12519562122062659056,9428161140644077369,262144 --variations-seed-version --mojo-platform-channel-handle=2088 /prefetch:1
  2⤵
  PID:4164
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6168,i,415407229963709245,9077075274701085959,524288 --field-trial-handle=2232,i,12519562122062659056,9428161140644077369,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:8
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=560,i,9847475752196921759,18195025716690162064,2097152 --field-trial-handle=2232,i,12519562122062659056,9428161140644077369,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:1
  2⤵
  PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6208,i,4040380361139377506,8056473801002880601,262144 --field-trial-handle=2232,i,12519562122062659056,9428161140644077369,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3492,i,5117783366247537137,5199042816810917168,524288 --field-trial-handle=2232,i,12519562122062659056,9428161140644077369,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:8
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3968,i,15638114499216339404,9299982114615722892,524288 --field-trial-handle=2232,i,12519562122062659056,9428161140644077369,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:8
  2⤵
  PID:4260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5388,i,4964824639127154145,3566714789764384450,524288 --field-trial-handle=2232,i,12519562122062659056,9428161140644077369,262144 --variations-seed-version --mojo-platform-channel-handle=5476 /prefetch:8
  2⤵
  PID:2972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3964,i,5987006740912424564,6810206399968795918,524288 --field-trial-handle=2232,i,12519562122062659056,9428161140644077369,262144 --variations-seed-version --mojo-platform-channel-handle=1020 /prefetch:8
  2⤵
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=6208,i,16865847908987134389,5061272567601995173,2097152 --field-trial-handle=2232,i,12519562122062659056,9428161140644077369,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:1
  2⤵
  PID:3220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,743557071569186280,14985282045371337643,524288 --field-trial-handle=2232,i,12519562122062659056,9428161140644077369,262144 --variations-seed-version --mojo-platform-channel-handle=5636 /prefetch:8
  2⤵
  PID:4972

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:568

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 19770e7fe2094711e80964a836e60964de6a8ad16ccaac3d8dfad98369019638
MD5 44dad74e010b183434bee387e897e5a5
SHA1 1e8cd1a25c1805f95db825d1abc631a4dc4b3528
SHA512 4bbc70e7b7329e93d20b196e728888ea0151b121d95738e26f908478d84bd38ac8410bda7f62d907ab7d1206a6ca2df9c6c71f59ce1ad6ea772dbae5c26236d5
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P73:fwUQC5VwBIiElEd2K57P73
TLSH
T1CEB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 fde3b41a5711362d7f3df7d71563d5eb6cc679bae7f80f74afcdf81dbc09eafd
MD5 3406d3b708dcef0116bffd8eaa181ad4
SHA1 3df64b48bff2b9d4160d900e91a7670046a24340
SHA512 d22d05c221bd19bc3b07e9a5ed722fbf8fbf75d695302fe8ec441d6d1e653bd63b3751a9608b344cc859feb79c5869aaeedd08bf846dc01a522b3a0dbb1637d9
SSDEEP 12:sUXhV0xosU8xCe+JKlkQuMRxCb8ZXfgYJ0IJpP0KLsyW1L7Fx6:fRqxosU8xWMk8xVZ4YWI30otWn
TLSH
T18F727886B34494FFC8C35A7189BE27902374F6DE5F02836B6A3A7A0E2E271C44F44220
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 083d78ea5ea69126b24164f2e05fc467ce21fdcdf2ec67f8e94c4366a1284886
MD5 da79f81681859af2b76762aa37a5f73e
SHA1 53d69c959eb46848bc7ed7b5c480df864295389e
SHA512 f647681c342e36fa2f41fb9d54d089303f98b802703a42609226ef5755aafc91ef00af41a82f980c0f2819709322c59ef6cd1c18725ef5133691894902fc44c1
TLSH
T1FCD09B7077CDAC11D5450471D45547535D96CA4C24D7DB076011801D68557D9B35E067
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 83d8fc0d4d488ce2df864923c4724c70dd67bac9c49cfd332a5b30b4a4b3f23f
MD5 3428384a7876386ecbbab9c0599dfd78
SHA1 2620e0ea07106de79492e013ef9bf02c8a32d1e7
SHA512 903cb78ce8b31f4148e456c44359de200ac103f70e03793c73cc85e34799709b1c152952275e6426a57f3faf59819e2b35321464b43cd3ac495c36a6e574ca3c
TLSH
T14AE0DF8892C6CEB40D22A64BB98B735851D071A9DE9CCADA727660C6381406083A58A8
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 7723b4cc0f86bd2dbfc626addddddf400a5eac743bfc1fc07219837c4ff04f06
MD5 4cc01499f0c52c6976d7504ffc5bc130
SHA1 2f2740dbfb8ffd18ec4b7c3d56afab52940d0167
SHA512 ee05baeb207dc87b0b3dd13b5c7b09ebd5afe46f6bc4a51670c6b01e1edd39b3b86c387e2f6356f441be9d71feb68c0ca0cb87d328fa8d5c3b0644e202b3fb80
TLSH
T122E026C945C8C23E9E10BE47526C631C82C03E0FAFC8F99A27348484B482250A387AAD
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 f803625f7089762ff6faeb3ece82729aca5f5a8ea6348ac385095f4ef1109a96
MD5 886d3a2f30ae328537f8a8495b7ac587
SHA1 7c18a459a31db22bab627b1df46f4732da5c15d8
SHA512 8d54299c0b059afd776373426c1e9e04dc2a04db5ba8722970b08f1abe9288e7b9230a4254217fff0985090db156a1f16de461ec7037774cdff0e4deaa405a0a
TLSH
T1D5C080D8BDCC845DC281187E5716F400075176119417A6170551FCC03241EE01F29120
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ba83c988b2f9fc59add1c622358f49ed16bb95b866cdffc10b140fffab943cd5
MD5 23a7db4f9f14ee7f53d694b22b000962
SHA1 ee26a24628b3c418725be782f7ae378d58f2849c
SHA512 652792998aef985e262056998b9238a76517fe0c09a63c1cf4aa4eddc10bdc5b41e66c621f1190b4e49c7125cea63ef68c25944947e0d7a6f3447299b7b126c6
TLSH
T17161291A83696053DB9E1631C0CD0B023572B5FD595BBF2A0980B17F6537BA1D7AD04C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 945B
SHA256 973f0d11f69a74bc1dfad14c80cec670e4d8c28eb9733cba3d4a46f131c06ff9
MD5 4f4a49ad120d2cb26f8db168e6d11e03
SHA1 47c886a1192c00eeb6ef2f198d5a3e436f9a19c8
SHA512 eb663aeb7b12b23f7c02e05ac74eed8da0b4e420c29c3172f2a80460665970baccf08dde824596159e3d91701f4b61f6159d59950cda5647ec4cbee2242d2265
TLSH
T1F3117DF387D1815EC91557F05A28EE1BDE1D0506421C7D2985D4EF67C3E3076E102A5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 928B
SHA256 f44d816cb68e167f5a721744429fbabd15d97fb4ed5f95ebc84ea64be95181e4
MD5 18e5345e5fb2a56f1ea245749c0b4b77
SHA1 50fa35ce0d2d8c7fe0ad26ae2f7bfa4ca8cf9650
SHA512 65a30c9e1d1a9abf051ac43d9adc85e9b422402c12c016fb48f8b4f3f7ce8a3f4a6f91769d5ba3b2abc0579b5e90c60521b49e34b470c4679427d61baea74357
TLSH
T1AB119CF3C7D5C56E891116F05A28AE2BDE1D0A06421C7C29D9D4FF2B93F3476E10255B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 1042aec3e3e44fdde8b527f510abe65e87a349f79ddee86491b97e66e2f3d069
MD5 2e58bb2d2752407bc4fd4590cedbcd77
SHA1 43e76d4edf725e356bae64b95734e2e712d3db68
SHA512 1421d7b2d10e30a95152a2da9cbcae80baf8f33876f0e9ae44fed0558feb0cb67c63011764db779fac1f3a06a376d841026a2554d811962a35fdd9ff97264db7
SSDEEP 192:sxZRRCyM/jK1Ml8UQQk2/fhsakfoIdp9CHNF6+WNGYwqJ0sIg5oJ:sxZRkqj2/fhsaGZwHwGwS
TLSH
T16952F911AA345A77CCDBD209F981BF93D6F9547392900E48A9FCDA1C04E6BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 dff1375e2191d802cc9a9229717da68ee532790aaba6179457464e5946537183
MD5 e7c39b01ab80a4199b9e01c884b697f6
SHA1 2220c5cbb6c29d3a512d829b21d58d20daa6ccd4
SHA512 ed2a49968a63ff7410f02a126228dee41f12768154ce507be475543d6d62e9a878c70c3b25e9132c7e8607e942304f9c7893f62b33c812d8973a7ffdba1b969d
SSDEEP 192:sxZRRCyM/jK1Ml8Mk2/fhsDkmoIdpvCHN8e6+WNGYwKomsIgrJ:sxZRkM2/fhsDXZKHEG59
TLSH
T17442F8116A34A977CCDBD309FA45BF53D6F9547392900E58A9FCDA0C04E6AEC220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 e57bbab64778ef408fe04d3ba9356fc94ae091fae1f95d2013862c74502db7c4
MD5 5d90f07bc903b23595fcaaaff6268934
SHA1 eb6a1de95c5efb9196d7550161cde769c0f3bcc0
SHA512 a6b29698b199634b09bba81da0f32e652fc2811f90c1cae48c965d2ab7ee78138bc5b3becc5555d0b1da2c93d905a1246aa792441a2f46e0eee542b0954256c2
SSDEEP 768:kV4jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+dProhtcahaR:kV4jeXmWvmKLEu1jacPLZQdcEz
TLSH
T185D2093B280CCF7E4F844E5DEC26AE976ED801CB6A584D5447FA894C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 5c7d2fe442d4cd9e02de363101ed196630c53f005cd3338145dc4500d5ce7fa3
MD5 15e055492a29de93f62aeb8485fcf73a
SHA1 d00b5b923ed5d35983ac4aeff794f719cc515b98
SHA512 9eb0315c7b428ca0acf5ae9b897604c43d7aaa2a058cb68f109830a5674e90865571ec1ea00554a232dfed1eddade84f71c373a3e4c97ab09844d1104c04bb2a
SSDEEP 24:KdWf5qra4dsYU4M4+fIjuUKiXhaYU1E2ESmKMb8WJyXYafNWHacdwMI44k+bIjyV:K4TINKEkY7yFTI1KQE48QIvK128zyZz
TLSH
T16791604930BF02653E7E281D92D1A6178B4276637528E83F7BA840B21E67E240DFDDDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0a74c55b-f224-48b9-854b-f8d2e66da33b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\0a74c55b-f224-48b9-854b-f8d2e66da33b.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 c8997123ba640a35d9079e2feeaba1c8d8dd2f935f9d2825e51d03985ee5a203
MD5 344b3446ae72d6d2f17a0c055a86489e
SHA1 43fecbcca9b8e55d40a6a1c14c29f218ec54e9bd
SHA512 00c5d6e9554610a8e5ac59f3d2baa3015b8070f1032aa52b0d12514209a2648bbeb3490de420d0fe0983aac89eb60bf35c17d87395fba19f620ed3e2bce0183e
SSDEEP 384:jZcIhsNruwvFngbNif+uOdKc+2AFEDWNv+xQA/hLW7:7hAFuqjOAcluEDa2xQA/o7
TLSH
T1E8927E31B8789C2759B6A355F48732138EF850639AD5AFD4D1EDB72D00D66AC231F822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 1c007ee34b41260d510d1ac8815b405179ed0adece707124489df3f3832153b5
MD5 cd0789d93e11e93eaf34c08c840bc976
SHA1 5627142dff52edd7ac1d8ff1c3d4c35d32871982
SHA512 3866520c612bfc887b76a66d06aafb0534557db9f30d691fc68352a8cd1483bd133403a56962ebf04ca96ddcc3da34162672082b52c23fad25fc49a3519241bd
SSDEEP 384:NiFiZcIXzsN18TUNTUlIltwvFngbNif+uOdKc+2+FEDWNv+xQA/hLW7:EFQD0wgsFuqjOAclwEDa2xQA/o7
TLSH
T19DA26D33A8A8D92B9DB69B55F48B32138EF45063D9D5EBD4E2DCAB1D00D769C130BC21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 85dd318759a59db56f9061ee8dae51385c8b31f225fce6dab8d1713375a30ef4
MD5 14327063162195d2ad3da5f24e7552d9
SHA1 30e6e20b31cd83adeb713fddeea4a6f9cb2f594a
SHA512 7012a31135a0353f659bfd57b6baed1ba592b52f8d3c38996f06cedb1b620ecf11240d3ee9c3e06b01f56d5a1c63956b08fb5258a5f88d355be26e1dbabf82e2
SSDEEP 192:EONo6hZ0QmiUypppc/+jVQO1L75wOZFx1WU6:EONo6oEpu+uOdC2xWU6
TLSH
T12602FA3568786C778EE2AE45F48737279FE5213BE9916F84D6E85B1D00C769C2307832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 2a6a4443dbb0bf866f690d60fcb687607036e902e1869ace5f251147c37e2b9e
MD5 c4d0197d2d861ee4ec9f5c8898f645ea
SHA1 d28eef6699109636b75d4254b0c6e52697fe53d7
SHA512 e3bec5d74f02ef4cf9a218bb289d6033f643d1a2f65cdf9a08a71d6c12f33fed0c7d8d14986d9f97c51e25ee179eb3ead0baee01ee35fcb122937877bddb7ee7
SSDEEP 384:9ZcIhsNrtwvFngbNif+uOdKc+2AFEDWNv+xQA/hLW7:lh/FuqjOAcluEDa2xQA/o7
TLSH
T18B928E31B8789C2759F6A355F48732138EF890679AD5AFD4D1ECB72D00D66AC230F822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d5399d91c9f2678d853d88f146cfd7934c6e4fbd54b206f0cadf8a2a072d38e9
MD5 5372b64689ec7c57c5ae8d99f25962c7
SHA1 fbeaea4c6311be45d279429421eb2f7d081870f3
SHA512 051775682ac4ee874b4a68d4c2d6bf04cf921279564dcae318e1d27ec9ae8ac359ec8cd658edc57185071cbc58383062f8932c7337c8349473d0246128973987
SSDEEP 192:VONe6hZ3QmiUyQp+c/+jVQO1LKc+2BV5cOq5qO7EU6:VONe6lD+u+uOdKc+2O9EU6
TLSH
T15B120A366868AC278DE1A651F48736578EE51127EAC5BFD4D5DC2F1C00DBAAC230F812
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ecdf09e0-9517-42c2-b32c-285045f258f0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ecdf09e0-9517-42c2-b32c-285045f258f0.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 9b05c5cb7e073de09d32b9496b9f72c10ff0c535042deb5ad15487c775e1eb44
MD5 2cd3508d77971ef8660bf995516b0e1c
SHA1 43c4c1b222e7a577d14dfcd66ffe5c53551882c7
SHA512 10e7af8462cfb6a1ccc0dfb2f1d34ea6740a01b0100195e1032e6b3174a3f36d22228207a310e559ff53e68867c683bc7a16ce39fa27a8675ee2c99e8b53f534
TLSH
T15F413D48BAE91158B3B76E5AABF6982E447EB8772F07D45E10010D4F0B23B00C971B37
MD5 SHA1 SHA512 TLSH

Submit Download