0e3df7e8abedbf3619ed39c5ee87a9299b7f03ab61a9ec9c525912ab6800f7c7

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
max time kernel
899s
max time network
741s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/08/2026, 00:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
resources/public/index.html
Size 383B
Sample260805-a79fmsgq6w
SHA256 0e3df7e8abedbf3619ed39c5ee87a9299b7f03ab61a9ec9c525912ab6800f7c7
MD5 e582b9106fb430459c697d4c5a519c25
SHA1 418242c0ee36e592982e3569c6bbb78f7274546a
SHA512 dcc2c76bda2f6567f90161911ab49600cd7896ee5607a4bfb842439189745156941c20d32b09d64b2554f1184b413f0b9f7399ec10013452cd45b791a39c96a3
TLSH
T112E0DF43C0E18809D32182700CC1F15D4BA2F6DBA7CA6D49B98A20898FC0B90CED72E9
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4864	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303653407983579"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{2D4E1C13-0DC6-4EED-BA66-7B49D8C1BAD0}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1064	msedge.exe
1064	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe
3128	msedge.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 3128 wrote to memory of 3892	3128	msedge.exe	86
PID 3128 wrote to memory of 4864	3128	msedge.exe	88
PID 3128 wrote to memory of 3844	3128	msedge.exe	89
PID 3128 wrote to memory of 3008	3128	msedge.exe	90
PID 3128 wrote to memory of 3844	3128	msedge.exe	89
PID 3128 wrote to memory of 3844	3128	msedge.exe	89
PID 3128 wrote to memory of 3008	3128	msedge.exe	90
PID 3128 wrote to memory of 4228	3128	msedge.exe	92
PID 3128 wrote to memory of 4228	3128	msedge.exe	92
PID 3128 wrote to memory of 4228	3128	msedge.exe	92
PID 3128 wrote to memory of 4876	3128	msedge.exe	93
PID 3128 wrote to memory of 4876	3128	msedge.exe	93
PID 3128 wrote to memory of 4876	3128	msedge.exe	93
PID 3128 wrote to memory of 2668	3128	msedge.exe	94
PID 3128 wrote to memory of 2368	3128	msedge.exe	95
PID 3128 wrote to memory of 2668	3128	msedge.exe	94
PID 3128 wrote to memory of 2668	3128	msedge.exe	94
PID 3128 wrote to memory of 2368	3128	msedge.exe	95
PID 3128 wrote to memory of 2368	3128	msedge.exe	95
PID 3128 wrote to memory of 1972	3128	msedge.exe	101
PID 3128 wrote to memory of 908	3128	msedge.exe	102
PID 3128 wrote to memory of 1972	3128	msedge.exe	101
PID 3128 wrote to memory of 908	3128	msedge.exe	102
PID 3128 wrote to memory of 1652	3128	msedge.exe	104
PID 3128 wrote to memory of 896	3128	msedge.exe	109
PID 3128 wrote to memory of 3604	3128	msedge.exe	110
PID 3128 wrote to memory of 4524	3128	msedge.exe	111
PID 3128 wrote to memory of 1844	3128	msedge.exe	112
PID 3128 wrote to memory of 1844	3128	msedge.exe	112
PID 3128 wrote to memory of 1080	3128	msedge.exe	113
PID 3128 wrote to memory of 1080	3128	msedge.exe	113
PID 3128 wrote to memory of 3392	3128	msedge.exe	114
PID 3128 wrote to memory of 3392	3128	msedge.exe	114
PID 3128 wrote to memory of 1064	3128	msedge.exe	115
PID 3128 wrote to memory of 1672	3128	msedge.exe	116
PID 3128 wrote to memory of 1672	3128	msedge.exe	116
PID 3128 wrote to memory of 3788	3128	msedge.exe	117
PID 3128 wrote to memory of 3788	3128	msedge.exe	117
PID 3128 wrote to memory of 4996	3128	msedge.exe	118
PID 3128 wrote to memory of 4996	3128	msedge.exe	118
PID 3128 wrote to memory of 4860	3128	msedge.exe	119
PID 3128 wrote to memory of 4860	3128	msedge.exe	119
PID 3128 wrote to memory of 1920	3128	msedge.exe	120
PID 3128 wrote to memory of 1920	3128	msedge.exe	120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\resources\public\index.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7ffa53a2c188,0x7ffa53a2c194,0x7ffa53a2c1a0
  2⤵
  PID:3892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,10325786086269373868,8370523253872049497,524288 --field-trial-handle=2884,i,14987647675312082657,16311786042851984770,262144 --variations-seed-version --mojo-platform-channel-handle=2924 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1704,i,5296666251815410722,3161003162802387277,262144 --field-trial-handle=2884,i,14987647675312082657,16311786042851984770,262144 --variations-seed-version --mojo-platform-channel-handle=2860 /prefetch:2
  2⤵
  PID:3844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2184,i,1760702122456436893,17913267665540259341,524288 --field-trial-handle=2884,i,14987647675312082657,16311786042851984770,262144 --variations-seed-version --mojo-platform-channel-handle=2932 /prefetch:8
  2⤵
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,1590487116030538265,16089672154898979994,2097152 --field-trial-handle=2884,i,14987647675312082657,16311786042851984770,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,11015980302843036448,11838662412051802777,2097152 --field-trial-handle=2884,i,14987647675312082657,16311786042851984770,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4176,i,15365751338620820221,755840974996523025,2097152 --field-trial-handle=2884,i,14987647675312082657,16311786042851984770,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:1
  2⤵
  PID:2668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4212,i,10873142760333677143,3694891872652027911,2097152 --field-trial-handle=2884,i,14987647675312082657,16311786042851984770,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:2
  2⤵
  PID:2368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3308,i,15168500678064157572,5978935597342910767,524288 --field-trial-handle=2884,i,14987647675312082657,16311786042851984770,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:1972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3424,i,7139691152671348439,17530121183827922160,524288 --field-trial-handle=2884,i,14987647675312082657,16311786042851984770,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:908
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,10168155225513303063,5032267750595607802,524288 --field-trial-handle=2884,i,14987647675312082657,16311786042851984770,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:4600
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,10168155225513303063,5032267750595607802,524288 --field-trial-handle=2884,i,14987647675312082657,16311786042851984770,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:1652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4552,i,11929279292666087899,12760067606422795223,524288 --field-trial-handle=2884,i,14987647675312082657,16311786042851984770,262144 --variations-seed-version --mojo-platform-channel-handle=4212 /prefetch:8
  2⤵
  PID:896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4556,i,135132033677490184,17608159009177568155,524288 --field-trial-handle=2884,i,14987647675312082657,16311786042851984770,262144 --variations-seed-version --mojo-platform-channel-handle=4544 /prefetch:8
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4540,i,16982553935490730214,15876225272858068958,524288 --field-trial-handle=2884,i,14987647675312082657,16311786042851984770,262144 --variations-seed-version --mojo-platform-channel-handle=5996 /prefetch:8
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4480,i,9827291203990897448,9326744338557092100,524288 --field-trial-handle=2884,i,14987647675312082657,16311786042851984770,262144 --variations-seed-version --mojo-platform-channel-handle=5124 /prefetch:8
  2⤵
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5948,i,12370924450365681191,4348971929945550608,524288 --field-trial-handle=2884,i,14987647675312082657,16311786042851984770,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:8
  2⤵
  PID:1080
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5212,i,17860456862035086722,16791669293601300411,524288 --field-trial-handle=2884,i,14987647675312082657,16311786042851984770,262144 --variations-seed-version --mojo-platform-channel-handle=784 /prefetch:8
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5864,i,12033318028514637605,9386910038749478695,262144 --field-trial-handle=2884,i,14987647675312082657,16311786042851984770,262144 --variations-seed-version --mojo-platform-channel-handle=6240 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5540,i,10964275576498434330,5316419854662833078,524288 --field-trial-handle=2884,i,14987647675312082657,16311786042851984770,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:8
  2⤵
  PID:1672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5344,i,12386407862559809879,17629958973322865784,524288 --field-trial-handle=2884,i,14987647675312082657,16311786042851984770,262144 --variations-seed-version --mojo-platform-channel-handle=5296 /prefetch:8
  2⤵
  PID:3788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5300,i,11861480605242494266,4359852304065374017,524288 --field-trial-handle=2884,i,14987647675312082657,16311786042851984770,262144 --variations-seed-version --mojo-platform-channel-handle=5052 /prefetch:8
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5260,i,9563601339930707282,6349174869241450500,524288 --field-trial-handle=2884,i,14987647675312082657,16311786042851984770,262144 --variations-seed-version --mojo-platform-channel-handle=2616 /prefetch:8
  2⤵
  PID:4860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1324,i,8075666517478982204,17662739002158758430,524288 --field-trial-handle=2884,i,14987647675312082657,16311786042851984770,262144 --variations-seed-version --mojo-platform-channel-handle=2620 /prefetch:8
  2⤵
  PID:1920

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1724

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 acf2ca2fd979c7d8ae7b74bb0af4308e4abd3e42e1f32fd1a04b0ca1a2b166c8
MD5 80eaf72bc0ff9c89a5c23f07f38ee8f5
SHA1 cbf109666417a1db022b3f49a91481b9755a1b8e
SHA512 b21d0ebff096128eae96a603cc0e96af95cbca34e613c40faa0cc8c5c17961106d997b66011c3051ead599494bd80939479f2526a2e65ff25600b04b19065afd
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7T:fwUQC5VwBIiElEd2K57P7T
TLSH
T15EB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a612efa1a3f1d4ee262abb96d63f3b4a31c2ad6c544574be7246db0f52212e1d
MD5 e0045423d265fbb4204e2ccf9cf4e729
SHA1 5cd430c76a965b7d49eb6f686349a92180871674
SHA512 e0fe72d7795acfb0a22d0da2bf0fda4779e67429fc7f0868abc95950b557948a8b07360e9f45a7446cbe79ca28b10086e9e6f63cce1bc4e718efef8261f1e913
TLSH
T11BD09B55754D7415D31B01315411E360955A4462A172D2457120440DB97C81857E5257
MD5 SHA1 SHA512 TLSH

Submit Download

7842f3e6-ddec-4f77-b0aa-d4f7ccc2163b.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\7842f3e6-ddec-4f77-b0aa-d4f7ccc2163b.tmp
Size 12KB
SHA256 d560206858addd999ed8041c852c104cdd6b182e2ae9b7f89c10b50baa171976
MD5 0dc76bf8be47f530b1cecffaf1b8f2fe
SHA1 4590ec44eb85d609f0eca14ae48bd29f78506d53
SHA512 6a9ec42dade77492d49a465fc31830b5c54a744db2d1a5674800d7f75a6b4645a052687c7195b9b23d7de19831126472126dbf7f7d455f64e33b1e2ece8286a5
SSDEEP 192:sxZmRCyM/jK1Ml8Mka/fVsgUa2QhxIdpdDHW6+WNGYHjwF+YIgrJ:sxZmMMa/fVsg92Qh6NHbGPb9
TLSH
T1324208156A34A977CCCBD20DFA41BF53D6F95572E2900E44A9FCDA1C04E6AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 6KB
SHA256 f91fb101fc1ef13985c5d974d8712bda92f707d0c8bce1e6a2e47c94be704d71
MD5 50de76d50e618926d374ae8caf9f7835
SHA1 1905a128458faaa8ea5f1fc0cee141533872cf75
SHA512 7072e895412a3dbf0dcaa7f2dbf07d47afd37294d9ab04f7a5a2a7acbff05c9ee6e8c04c5b15a9c5620da6a5eac38352e0be5ac8450669b25543adc9c9f9a8eb
SSDEEP 192:Vj87661t1t1t1t1t1t1t1t1t1t1t1t1t1t1t1t1t1t1t1t1t1t1t1t1t1t1t1t1v:Vj87661t1t1t1t1t1t1t1t1t1t1t1t1v
TLSH
T19EE14F0A46E4C7AB8F1560DB8AA4529D01B0370EEFDCD508176DEDD9304E49EE4F6AF8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 6KB
SHA256 3800e57c0b41a787857342df7f24c1144fd3c9fb90b8c11abecc030ea2fffb5c
MD5 46f8d89291b06079929a2ff2abb11047
SHA1 e1be8c92756cb8d08fd5b000779ca22bf9842bdb
SHA512 bbddc4843d4b650c834f6afe3bf77587d24a8e04018a3bff9bae9720ea30579e6971ae8227843016dbe2416cd31f5b3581992fe1cfd5f80a16dc7edce2ea2602
SSDEEP 192:vj8l60DDuuuuxxxx8888KKK////EEEEZZZZM0LO:vj8l60DDuuuuxxxx8888KKK////EEEEg
TLSH
T107E1184686D4C3AA9F0610DA8AA4A2AC00B1370DEFECD548175DCDDD304EC9EF5EDAB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 6KB
SHA256 1233d0cf3e53899f8e17bf545ad257ad6301e84be9f6730eecdb68fd5d51d9ae
MD5 83e547c094bf11f10388dd4c2c5edb35
SHA1 7bc6b3f95e9d80357e4b8edee296cc82f9bd9406
SHA512 1344141514879d42ae71f915a901593c923229e5cfad759f3fc8541498bef6036ebc6f47d7673e382976a9e0b0eabc4bdcd83d8a4922104cb4cd08816efcd1c9
SSDEEP 192:rjEA6dUUUKKKnnnn4444ttzzkkkppppiiiiMXLO:rjEA6dUUUKKKnnnn4444ttzzkkkppppv
TLSH
T1AAE11D4782D4C3DA9F1650878BA863AD40B1370DEFECD5081B5CCDD9704E8DAE9E9AB4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 6KB
SHA256 bb42b3e3550de915fd70d8d1c7cd741c5b0c77d48cb12aff990ffd193362cca5
MD5 3b5ab5224a521659b2bd8722eedef12d
SHA1 b1bec9d7df73b2fa9dd6e7586e02cd199d1d274d
SHA512 ca6bddf94cb081147d5cc637d0e043f8369761ab072c8cf238d24d22f2dfe2808dff88d4549639922fcbe0b364e7baad808f7d0ba8295474d0244ccad2387d93
SSDEEP 192:cjc+6r55555555555OOOOOOKKKKKKKKKKKKMuLO:cjc+6r55555555555OOOOOOKKKKKKKKK
TLSH
T1F6E14C4282D4C39A8F1610CBCAA4639D40B0770DEFECD948179CD9D9318E49AF9F5AF9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 99a50113c4a25520394b1240924322a4fc7b270eb50074fb198220b660a5b24f
MD5 5c1253eb9729c6c2ea030b4ba7c56312
SHA1 c01da75c8acf05a918d87c80df80f7bb3e183732
SHA512 2a654c3b511ffe719c188eb69a1a943b162afac1c34475d8ded320f8cee460825ef917aae7ab44f7f4666430599d0dfad300a9d4b5f8cf2d4d67ad4ed92616f2
TLSH
T1B4714DF912AB34A1D7248230E4D306FDB47B4455DB237E51C100ADBCAAC6BD993EEC18
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58be59.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58be59.TMP
Size 3KB
SHA256 de3d929e443586128fcaf5ad8f7504ba499b562397cd9385eb4924ec21d3b7bf
MD5 319b49f22341f4a74b51b4a51b20db61
SHA1 fa8bf6614d00e5425836cc3b36884421c0094610
SHA512 a7ee5ff6d45bb0370e185218ea3e63c763fc118fb353f904a7422325c64c009c4608f1dcb391c54429c4a69454d0c00c02c148daa0c9409e6f036251db1b5c05
TLSH
T115714DF912AB3461D7248230D4D306FDB4774455DB237D51C1009DBC69C6BD993EEC18
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 7255105c3532110add418db1f3464a72ce72c0564cbc6f6579347f28cbb0d6b7
MD5 a02cd59553817942799047cce557969e
SHA1 f75a69500c59c07bfde8fba0ac96a1bfff92fef6
SHA512 395555067acf744c3c80664b01c6effebb488378a38ae1ad33ba62228d2eac7d959a28cb62c8bd3f4a7b26ef3cdeeb1e6e18f861583c355ea57518480faab8de
TLSH
T13A117DF3C7D5856E890117F05A24AE1BCE1D0606421C7C26C5D4FF2793F3075E00195B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 966B
SHA256 88c4f6245f53309a85cbfe0f35c6092614fb82e24f954f107f6de1f05d3d5412
MD5 b9137732550d1100da5170a5580a577e
SHA1 ab168b515da4a6f5c437f141c0f27d7e8d46f3c7
SHA512 e71d92f080715f8289c843411dad05f5bc220facba8890323c68d70532b1c7cf4c4b51f7ea1821143971d6b87588f53545bd9dd29b356f038cbd67ce09e97851
TLSH
T12F117DF387E5856EC91116F05A28EE2BDE2D0506421C7D6985D4FF67D3F3076E002A9B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 ce6c1b4f4a262fd87fe80ac2357bdfcfff98cb0c3f09c3beff1a3f53e88c4489
MD5 385241303dbf4bdb18e3832424ef5cdf
SHA1 3794102d128b5b116614710eb84f141c6edd4d1d
SHA512 f7e1e2e06d5b0db75ad262cd68af2e4eb3c2c98c7849539fd9cb411cc490d810f13ad89da5c816e9a654ead5e5b8c8c65e6e486d96acf7d129cc13788a4e42f7
SSDEEP 192:sxZmRCyM/jK1Ml8UQSka/fVsDUamQhxIdpHDHW6+WNGYHfHm+YIg5VJ:sxZmMqRa/fVsD9mQh6jHbGXbR
TLSH
T16452F715AA349D77CCCBD20DBA81BF53D6F55572E2900E44A9FCDA1C04E6AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 c8c334c1a8000f643eb3ce3c0f03cd08a80a428214c2dbb74edf3ee7ea0ef7a0
MD5 7c09ed8bfe4abfdb7babfde268d822b0
SHA1 e828eaf65bffc003859626b9246deb887984b971
SHA512 0676778c901a2cc3590ee3d7ed24be8f3be1058f25738cf1372f6cf033f9bee91b86ba29faa470654e73b0e0b5db3434c4b2d33331154ac22b7dbb378aecf4ce
SSDEEP 768:jOUZYTMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4RwroVS0z:jOUZYTMWvg0Pou1ja7eLZmRbjz
TLSH
T171D20A3F280CCB7E4F844E9DEC2A6F963ED801CB5A984D5447EA894C02C76EF512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\53f0f5bd-7408-47e8-b6a3-5aa7e69ac4b4\index-dir\the-real-index
Size 1KB
SHA256 98d130586ca8bfbc8013e4062429487b0abfb54a2c56a029dec38b132c01f544
MD5 93e45c5a726193520c172ae7c0fb768e
SHA1 ace3988378c23c1f652c952840f9dffd2d69d43c
SHA512 0846a27a39dbca9a7e331009570fe969d516566da958a6d80a8898238bc8219c06774c9784cb20e36016d0d08b014357bc6279cd4f820be15c5ebcb9dbe3cd4d
TLSH
T10A21EF8D9EA0898FF96441B61576B5A0B37098CD4F12A2139C3C31326E2635936575DD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d03eb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\53f0f5bd-7408-47e8-b6a3-5aa7e69ac4b4\index-dir\the-real-index~RFe5d03eb.TMP
Size 1KB
SHA256 08e359906a7f4c54fc90bfe2ade9ec886dd7e35bc5717e73112601dd5442c290
MD5 872bbbff1e11727db06c3dc728a873bd
SHA1 a9dbf55e6b3058c0ce50c56507e93d8b1949730f
SHA512 f625e0560dea8df58e8026d18694dc947db463de869da845977aa76f75bd1694bb001ce2d353de03b4533c705b47ce4581fa0e5345b3791b3eddfbeec95bcd18
TLSH
T1112114894AD18A1BF98450BB0D67B8F8737488009721B393A93C62795D25B8E1B4F0CD
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 da05141a02521e555874779b1c2116f5870f04efd830e5d08dcf3f8f55e3e0e2
MD5 e9b18c92201fbb5a26effbb9a2c9848c
SHA1 f3cf2140039e154495593b04790507c7d982b65b
SHA512 4465a30e2e263820204df087f6dac185753f33c5855a3fc9c8a7114e0e1cf3ad6979abb447a20aa5cf71f661c7bbf8378ada1517d05d273ef8c6b3caeef02b9e
TLSH
T1B1E068F32DFB1810AD6BC3D65471A4A4410138A8C64CAD8E00AAA2A310B23002806C22
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 4fc4b0da0ad92e770c6de25d57ec80c159363d6e8c219d16bddb2a6feb3c0ba8
MD5 b44cd9ee4ff1282b9d886c753ee37076
SHA1 784acaccf612a0648180fbbce785aa1fe972759a
SHA512 e21ebe08c83f7713c36ef585beea41eeb4b3b880802ae40f3845dbeeed4ea903fbd0142dab327dac6b37994644bb65c4e608369db08705379febc0e7f61fd8a9
SSDEEP 96:KA1eK2Aoz2Ksom9WB9v3Hm1XoNX+TKvKX4Tz8UDS6wqUti+sOSb1iTqXmbKviXQa:E0BFluVyZFjn
TLSH
T1B9B1140332BB12433C3D2908A2A9973B4B46F1937424A46B7FA944B25D67E741DFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

183ccd21-b4bb-4c71-a599-a6aaa957bcc5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\183ccd21-b4bb-4c71-a599-a6aaa957bcc5.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 fc27cb5f9d0e15a6c32b38b3d9582e055f3bd234aa33330b84783f971e0d9b37
MD5 a6f86a00baf4c41ffe1bce781753abfe
SHA1 141f91577ef25a52300d2d7fb90fb770bbb69647
SHA512 15a70f148e83011e42808041c402c933924b0699f37811170bdd2bfe51580d152a29d290f26121c965ac76148fca1f18d6b5c137b5ac4b0bd612183475700121
SSDEEP 384:KZcIhsNVUismIem1zX5od+KOraqXK9Li6Uq58bhP+2rHBuD:ohsQNOzOraqwLwjLBuD
TLSH
T1F9927C765828ACB35EA7E245F84732178FF8A177D7C46EC095ED6B1D01AA1AC131BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 b4b9e5df8623f3685bea932d6c1150637990156371fc32b22ac428106c090629
MD5 fe13baaed66834319e1d67be5486cd29
SHA1 1bad5675c476db23ccb8a7499dc364f3006daa2d
SHA512 2ec910a26b2968e30ce032da7d97a05c3dc8ccd130e72efcc65e450c2161b1da3e0659fde67bd982ca8f23e3a4ae5a8a2177c4a206f680d7e4a4a60f62bd679c
SSDEEP 384:FiFiZcIZzsNG8TUNTUlIl7smIem1zX5od+KOr6qXK9Li6Uq58bhP+2rHBuD:MFQZ/wgJQNOzOr6qwLwjLBuD
TLSH
T10CA27D77485898779EBBEA44F94A32178FF851B7C6C4AEC0D2DC5A1D01AB1EC130BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 b8daa73eeb7cdd711e517706c5a037eaf5b61e12e1983453a3c88e8cd24208f8
MD5 fd9c1c4d93f6067c55a0de4b93ab1501
SHA1 6ed2c6ee3c2558f55e2f02f3716be1a5b0c4a23d
SHA512 8e87850c46edb9b066a06db67c4db261d93b05caa7c2b956de4d38f72e9f831fe7a172e8bcb5c73580505063c6e4cf3de4aa36b009b2180af5823d37a0a6eeda
SSDEEP 384:rZcIhsNVU7smIem1zX5od+KOraqXK9Li6Uq58bhP+2rHBuD:zhpQNOzOraqwLwjLBuD
TLSH
T16E927C765828ACB35EE7E245F84732178FF8A177D7C46EC095EC6B1D01AA5AC130BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7a0c257b8b0b924c4a0ec6db860247c9dc1a2bcc10f088354de9553161a87c0c
MD5 70581b2c65110ef10a1d3d836f85fd49
SHA1 6f3bddcac2a78ba688db44e1eb3f7c1d8371657c
SHA512 fd2439ba45b49f64b82add1dc9e24d4c892bd31f6bda38b8ea178f5f3e0a1ffd0d9afa423bd4802a61d7a544624e69279025ddeff1476cf6e96799ad78792dd8
SSDEEP 192:yONc61VWQmiUy8bgGX5Obd+juOFmI/a53s5U6:yONc6WJgGX5od+KO665U6
TLSH
T14602E93568687C678EF2BE49F58737135FA4217BEA516F84D6E81B1C00D765C2306827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 eae8631b9f4a2ad95ef9cd7ad10c80c853e1260e451614dd3f3cff1ca486016f
MD5 47a2932556f1b2e0b24288ab4fe73c59
SHA1 51018510bc12f55781c5ba1242fc97b794c61012
SHA512 58c2b35a47c999df069cf6bb218dc5e993a8961858aef358a24fc789b35464c868183721d65723fbee9fccf80e5fbfb09c09fc5e2c96ed7f1b22beb7be355512
SSDEEP 192:eONn61zWQmiUyobHGX5Obd+juOFm0beAjJlqnU6:eONn6Y7HGX5od+KOrJqU6
TLSH
T15512E9366868AC779DE2B544F48731139FA56167DA857FC1D2EC2B2C01EB69C230BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

38d8daa1-2a6a-459a-9ec8-01c3423a009e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\38d8daa1-2a6a-459a-9ec8-01c3423a009e.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 9c7b21581a90cd553222cca3c11d53bf39c166401cc3bbf7ee03e2f4b84a6b7a
MD5 7b8b91d48de67ddeaa9cdf84b9a7b950
SHA1 4eadecaf2e10cf58f77a937ec318126d439af862
SHA512 ced98622de1e6cbfe822ccd86cd8828ddae5739d4be1b063cc81fe5b8ccbdef1e38d0dc5b080af542db45fd29acc6fd0f43b7634c9aabf7a26b3ecb0b209f7c3
TLSH
T159413A9CABF91058B3B7AF5AABF6A85D447BB9761F06C05D10110E4F0A62B00D971737
MD5 SHA1 SHA512 TLSH

Submit Download