hxxps://archive[.]org/details/essentialsoffina0000brig_v8i7/page/n1/mode/2up

Analysis

user interaction
yes
max time kernel
898s
max time network
870s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/08/2026, 03:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://archive.org/details/essentialsoffina0000brig_v8i7/page/n1/mode/2up
Sample260805-djsprsxala

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2052	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303725761948931"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{AB5B87A7-E3B8-4BEE-819F-C6F362324C76}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2488	msedge.exe
2488	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe
4452	msedge.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 4452 wrote to memory of 4460	4452	msedge.exe	87
PID 4452 wrote to memory of 2052	4452	msedge.exe	88
PID 4452 wrote to memory of 1768	4452	msedge.exe	89
PID 4452 wrote to memory of 1768	4452	msedge.exe	89
PID 4452 wrote to memory of 1768	4452	msedge.exe	89
PID 4452 wrote to memory of 3240	4452	msedge.exe	90
PID 4452 wrote to memory of 3240	4452	msedge.exe	90
PID 4452 wrote to memory of 1064	4452	msedge.exe	93
PID 4452 wrote to memory of 4776	4452	msedge.exe	92
PID 4452 wrote to memory of 1064	4452	msedge.exe	93
PID 4452 wrote to memory of 1064	4452	msedge.exe	93
PID 4452 wrote to memory of 4776	4452	msedge.exe	92
PID 4452 wrote to memory of 4776	4452	msedge.exe	92
PID 4452 wrote to memory of 1928	4452	msedge.exe	94
PID 4452 wrote to memory of 1928	4452	msedge.exe	94
PID 4452 wrote to memory of 1928	4452	msedge.exe	94
PID 4452 wrote to memory of 5024	4452	msedge.exe	95
PID 4452 wrote to memory of 5024	4452	msedge.exe	95
PID 4452 wrote to memory of 5024	4452	msedge.exe	95
PID 4452 wrote to memory of 3100	4452	msedge.exe	98
PID 4452 wrote to memory of 3748	4452	msedge.exe	99
PID 4452 wrote to memory of 3100	4452	msedge.exe	98
PID 4452 wrote to memory of 3748	4452	msedge.exe	99
PID 4452 wrote to memory of 3340	4452	msedge.exe	101
PID 4452 wrote to memory of 1364	4452	msedge.exe	107
PID 4452 wrote to memory of 988	4452	msedge.exe	108
PID 4452 wrote to memory of 3248	4452	msedge.exe	109
PID 4452 wrote to memory of 4040	4452	msedge.exe	110
PID 4452 wrote to memory of 4040	4452	msedge.exe	110
PID 4452 wrote to memory of 1300	4452	msedge.exe	111
PID 4452 wrote to memory of 1300	4452	msedge.exe	111
PID 4452 wrote to memory of 2488	4452	msedge.exe	119
PID 4452 wrote to memory of 1208	4452	msedge.exe	121
PID 4452 wrote to memory of 1208	4452	msedge.exe	121
PID 4452 wrote to memory of 2152	4452	msedge.exe	122
PID 4452 wrote to memory of 2152	4452	msedge.exe	122
PID 4452 wrote to memory of 4328	4452	msedge.exe	123
PID 4452 wrote to memory of 4328	4452	msedge.exe	123
PID 4452 wrote to memory of 992	4452	msedge.exe	127
PID 4452 wrote to memory of 992	4452	msedge.exe	127
PID 4452 wrote to memory of 220	4452	msedge.exe	128
PID 4452 wrote to memory of 220	4452	msedge.exe	128
PID 4452 wrote to memory of 3220	4452	msedge.exe	131
PID 4452 wrote to memory of 3220	4452	msedge.exe	131

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://archive.org/details/essentialsoffina0000brig_v8i7/page/n1/mode/2up
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ff81ad6c188,0x7ff81ad6c194,0x7ff81ad6c1a0
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,8931944093465551318,14521274799528558329,524288 --field-trial-handle=1972,i,15620318208168074438,15765114927378073275,262144 --variations-seed-version --mojo-platform-channel-handle=2108 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,9650435916208409177,9501709358721019653,262144 --field-trial-handle=1972,i,15620318208168074438,15765114927378073275,262144 --variations-seed-version --mojo-platform-channel-handle=1960 /prefetch:2
  2⤵
  PID:1768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2636,i,14106589529433244553,6535276962841440517,524288 --field-trial-handle=1972,i,15620318208168074438,15765114927378073275,262144 --variations-seed-version --mojo-platform-channel-handle=2768 /prefetch:8
  2⤵
  PID:3240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,18369924629777524265,7692770791330100393,2097152 --field-trial-handle=1972,i,15620318208168074438,15765114927378073275,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,15322737981355124120,5657276625322278188,2097152 --field-trial-handle=1972,i,15620318208168074438,15765114927378073275,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4232,i,16007485378563362924,7625392590535741205,2097152 --field-trial-handle=1972,i,15620318208168074438,15765114927378073275,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:1928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,17906666113402235016,272792839431942928,2097152 --field-trial-handle=1972,i,15620318208168074438,15765114927378073275,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:2
  2⤵
  PID:5024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3704,i,10262834745150489988,17320325147042786226,524288 --field-trial-handle=1972,i,15620318208168074438,15765114927378073275,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:3100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,3797838060964793470,10840755826926012988,524288 --field-trial-handle=1972,i,15620318208168074438,15765114927378073275,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:3748
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,5565385115169743882,9323982776703477118,524288 --field-trial-handle=1972,i,15620318208168074438,15765114927378073275,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:8
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,5565385115169743882,9323982776703477118,524288 --field-trial-handle=1972,i,15620318208168074438,15765114927378073275,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:8
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4592,i,4962299770308457898,14954946384370245126,524288 --field-trial-handle=1972,i,15620318208168074438,15765114927378073275,262144 --variations-seed-version --mojo-platform-channel-handle=4588 /prefetch:8
  2⤵
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4576,i,16723769359885737886,10286237856421988188,524288 --field-trial-handle=1972,i,15620318208168074438,15765114927378073275,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:8
  2⤵
  PID:988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4580,i,5858276842736093049,12003576949972185248,524288 --field-trial-handle=1972,i,15620318208168074438,15765114927378073275,262144 --variations-seed-version --mojo-platform-channel-handle=4584 /prefetch:8
  2⤵
  PID:3248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,14517837724301755427,16639073592155930549,524288 --field-trial-handle=1972,i,15620318208168074438,15765114927378073275,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:8
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5212,i,5334575015739807883,12283238322203091888,524288 --field-trial-handle=1972,i,15620318208168074438,15765114927378073275,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  PID:1300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6112,i,14262173581716793212,4064927153198493762,262144 --field-trial-handle=1972,i,15620318208168074438,15765114927378073275,262144 --variations-seed-version --mojo-platform-channel-handle=5252 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1316,i,12255316996577941887,11388632105378977339,524288 --field-trial-handle=1972,i,15620318208168074438,15765114927378073275,262144 --variations-seed-version --mojo-platform-channel-handle=5944 /prefetch:8
  2⤵
  PID:1208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1320,i,16158751176654051025,9829844185185892800,524288 --field-trial-handle=1972,i,15620318208168074438,15765114927378073275,262144 --variations-seed-version --mojo-platform-channel-handle=3988 /prefetch:8
  2⤵
  PID:2152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,3827886201974677559,16515631930785733562,524288 --field-trial-handle=1972,i,15620318208168074438,15765114927378073275,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5340,i,8244762976297530704,9834493626413153858,524288 --field-trial-handle=1972,i,15620318208168074438,15765114927378073275,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:8
  2⤵
  PID:992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6404,i,18159449592171034186,11277558888018383894,524288 --field-trial-handle=1972,i,15620318208168074438,15765114927378073275,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:8
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4060,i,6273516693989383058,2235896750855135671,524288 --field-trial-handle=1972,i,15620318208168074438,15765114927378073275,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:8
  2⤵
  PID:3220

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2380

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 92b83a0e542b7bb3ed324c35b5f2a40c47a6351981065b804e4d9d80ddd6d7ee
MD5 9ea20a12d0c030ae7f84014f382662b7
SHA1 7912569189cf07c1ce092a268e67e9f391b7c8c7
SHA512 39ca414f13163c8479fe7650ae0dd1607b267fe3f319c09aec7bd5f68448e9ac604351069bf6b166b3f897d3afb5d7f35e609b9fc72b9debbcb05bad8fad7d81
TLSH
T132D02B20FF04E002D1072172540047100E0848902093C140E030441CDCEC804D395307
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 6KB
SHA256 c3783085593dc3277344e51aea965cb102e54daef598d799d6d7e7876407a76a
MD5 2201c63340dde2b563aab28d27da9589
SHA1 6ac0f1131b17109486fcd49b28687c49ccd7dbb2
SHA512 ea7ca835844d9b74fc0e5d276e8761f97af1c4663d05c7b2e05a25e3d5749d6045ac80fa77ec329f342ecd822e14a8c5a0fda4663ed68dd7459769d510e2595b
SSDEEP 192:gjYi6T33333333333333333333333333yyyMuLO:gjYi6T3333333333333333333333333t
TLSH
T11DE14D5786E4C7BA8F0560CB4DA0535D10B07709EBECE628579DCEDE304F5EAA4A1FA0
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 6KB
SHA256 af6e7b0541ec7ce59a91571646c921c7bb9383a849f9e700f99453f42e7fdb8a
MD5 dc82cb4b80e01fce4c914cebba344580
SHA1 fae6f02d3afa4954b095c8132da1023ad61f8c14
SHA512 20451cf747477c88ce7ed8e4ecefd1853b73f26cabf365a098ad7d79c60e19fd5aad222c2f795be8e7f28fe424c1824ad294ac5fd2b7481690d2e922ac60775e
SSDEEP 192:5jcP6okkkkkkkkkkkkkkkkkkkffffffffffM1LO:5jcP6okkkkkkkkkkkkkkkkkkkffffff/
TLSH
T1F4E13E5386D4C2DA8F1610CB89A1635E10F13B0DEBDCD70813DECADD354E49EA8B5EA2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 6KB
SHA256 eaebc84e744ff01de70a636df9cd83174eb094dc338920a91a86f481dfb4180d
MD5 3a8583f8767a7b06bd81bb95c0366c2f
SHA1 a098534198c85ce9c91382174cce423a4da57209
SHA512 299a5bebfd8d0f1fff8cfc85e6c81dc100c81ce26a2a403f3e4d8903e40d04f2522fc921616f92fa9be873bde2862923107f7de2b8e2e3c7a3f42553a898cd58
SSDEEP 192:njg86R4BssyyLLUUFFftt8FFuXXXQQv5v566zMtLO:njg86R4BssyyLLUUFFftt8FFuXXXQQB5
TLSH
T1B2E1556682D4D39ECF0650CA4AA4535D11B03709FFDCDA08139DCEDD308E49EE9A9FA8
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 e36c963ae27772a15a88459124137f4d49490aa1d2a0a0e007750a8c43d4fc45
MD5 91a992625e74840dc11b2cfe01b1c5b3
SHA1 6e4ca534af686fe9bdb051a55244942c80e7d029
SHA512 ab7008bffbbe13f44985e4809888242f8c3a7a18cbc11109466cc4c995101dad61175039330a31f2018d0417b2144665edfc09d1f6ce68ca6e659181208e0847
TLSH
T1F1711AB4016E269CE7925F31C0DE46903771AAFAFD7B1FD7DC9265BED901760482A034
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 f04431e83fa5c7af650e43f60f043512c43fe7124e8ec7ac7eb04075128a2e10
MD5 eac7d826b919a31aad97b135e1ae591d
SHA1 f84a70e392b0a5484a8fb6f51e0d9f178d497d83
SHA512 09f7d3d782ae80bc4b1f73b91355b51f65482c956ffa824eff0d67b41d40757597e3bc0278cf63f445e9b6fce0a0af1bf9cca23a83061dc69e836be3be4b9106
TLSH
T1EE316AF387B4856EDA0156F0AA199F1FCE1C0522472C7C3586D0AF1B93E29B5E10164B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 af0a79ac019c33c9e4455c2acfc7b3815fc382726b4093e13bbe2063e5b5bea5
MD5 73041f25904d2f5282c79a0d1eac771f
SHA1 3722d433533567ce1d0aa48e877ed6c8209c16c8
SHA512 19df5eebb67a2a28cad5fac4fe883fddea7a7d0b5dbe484a4ac571dd530ba3461999c2e2814a10c5c83640a2350090c18017022447cb1de277791dbed85a6351
TLSH
T1A8418AF797B4856EEA1156F0EA09AF1FCE1C0522472C7C7986D0AF17A3E24B1E001B5B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 15413bff779455fc758aac7a6703baeda0f118161570066c3c97d56291250575
MD5 688dfb93996db61fda2a0d6f71616611
SHA1 bcf2152850a43b8c206bcb2d56ace901bfff38df
SHA512 f30c3fe34293973bdba85ba47562031ee8b58d97b71bba910f011bb206a9821cd798aa29705bb63f6ae55e9949981eac01205a73369e412c4a9cf633802e200a
SSDEEP 192:sxZndRu6PyM/jK1Ml8UQJkl/fWsy6cSaVnIdpP3HW6+WNaRI/YvwgKuXIg55J:sxZnddqKl/fWsyvSVPHbv/TAV
TLSH
T1B152F811AA385977CCDBD20DFA41BF53D6F91476A2900E44A9FCDA1C04E6BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 09ca8d76f0abf43f893da74464f484aee715d5827e65f75e0856d4b9cab2bcb0
MD5 ca259e8af662a042db3050b2b9389776
SHA1 4182a4459b0108ad3dc176e9cbfd779903b9c333
SHA512 367538f1d282330106569ac43d25047badf02c506264d90acd96eb4625a0a9a604f3eeff74350a30aadb574c0cbb6bc2d09a19b5dd71d23c2246fa8d286ab0b7
SSDEEP 192:sxZndRu6PyM/jK1Ml8Mkl/fWsN6jaVnIdp13HW6+WNaRI/Yvhx7uXIgrJ:sxZnddMl/fWsNMVFHbv/sA9
TLSH
T1BF52E811AA386977CCDBD209FA45BF53D6F91472A2900E54E9FCDA1C04E6BED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 5de944c6db78561a3cf2d216f052579a11a3369901d8b71fec1ce7a36a66fe6f
MD5 725548238880fd90e03ac07ae42e64c4
SHA1 6135d1db120fb23c6f238f76141e3286889d7230
SHA512 2c7f6a1b8217a4eaf3ee1f7fba445b85a5a27b3f28b31d19d726bdee64e04db025165ec11c4e568d774a8ce5f579b91426d47b808874de6d98965cc0d54fe7c2
SSDEEP 768:W8seJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0ppJroQw:W8seJ3xWvhfynu1jaVcL88piX
TLSH
T16CD20B2B280CCB7E4F844E6CEC266F966EE801CB67984D5487EA984C02C77EB51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c41e8016-acfe-4596-96f4-a749f543712c\index-dir\the-real-index
Size 624B
SHA256 37a1c3f1ff569e42a1f5a5f0acfc3f62236fc2dfd1737e8a52ec17f18f1c8286
MD5 5b61763ad5d3d9794095cfad6dfaf0ed
SHA1 9f3f72c355bec83e6a8fb4523cbb47dd4795347e
SHA512 7ff68d182c6d517ee494d5ab6b336b229800a4538c6cccaef489bae6391834d2df5b711e0fdd31ae821d5ece4f9950f95f1fefaff84b3c8cf6e9c8097c9bb82d
TLSH
T191F0D4544E800C26E928457726F6A0E463704DDCB3219977285C5C7F2D613CC74563EC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5cde42.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\c41e8016-acfe-4596-96f4-a749f543712c\index-dir\the-real-index~RFe5cde42.TMP
Size 624B
SHA256 77287ff5739a245c842704006631c81b3203dca26f119748b2107674d55c5a73
MD5 5260ed2aef82c94debb7c03a950153df
SHA1 d26aa08ca679b0e7b7fe55dcd4ec7ab309a96521
SHA512 e8107753ab5f41dd238a11e07773e9716e188498476fcecc4d598938a6796651b6a5ec8fdca84ee11159e3125214fdf533ac3ad2e1aa7222bbdc6c5f775d9107
TLSH
T144F0A3554BD14D11D4200A7B3EEA94E8F3308C507632FAE7745C682E5C717C959063DC
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 f3b664a0a179efb6c9f37679410fbfcc6912c3357db955c20d3bab14cbb43e09
MD5 3df8d306b0a736722c8da2c4df60c427
SHA1 7532f3a6f6e72241bb40a611eae2a9c7a1a8759f
SHA512 3acabd25aa71fc0a9d1fd3138a6b5eb214ddb37995baf331ea8856fce059a2dcbdda274cdfadb5a52f8734726ef823b4e59b7f91bae953852e416488432cf6bd
TLSH
T140E0C0B62DD72450BEAFC3D120308090060A749EE941FC0E541FF6C310B231530D7C35
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 be83a0273b3de549d9a5dae4e6b528b713e020e1dab2da66ae861aa018850099
MD5 d884e626ec4e09eff10f3d22ac075229
SHA1 27a6789e4fd81c39c74a54dd2a6e66a70678d21d
SHA512 b4f5f8eadba104a80312181008b4327c6daa01e9fdd9706245055702dd3a8b3c7331bfb48f9b9c73e6cc1b3e5647fd7b511f46706bf6328e577b8e5bfdb6b323
SSDEEP 96:KYH+KggmC8gKZWiKK0KrCq2JyKSc+1iT/lPrnOjg+w3nKYw:49TT33ph1iT/lPrOjgv3Nw
TLSH
T13DD13546303F02023C7E295CA2A7993A8E4275937454A4FFBBB904A54E67E151EFCCDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5ee8c3a9-7e1f-4a17-a287-e67a9e3a58b5.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\5ee8c3a9-7e1f-4a17-a287-e67a9e3a58b5.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 53082919801c26452cb3e78d0838b9359f97cefcea90bfb0de4da18fa5c9c3b7
MD5 7bf52b7b1becf617a027ef6fd2bb6bc4
SHA1 67243d118900e15f7407d205dc516141bbcbc391
SHA512 0fedde326acaef4c1767abfe70bd5280a8c1bbddf4a46aaea50f564fda8ae37d89bc0d7eaa1f6f3f5aff4602e88257f169f1384057deaadc2e2ab070c176263f
SSDEEP 192:uMLsNWcQhRM7CgWQmiU1hAm4MTZS+FdLK7Fd3E78z1Oq0g3:JsNWcIq7byApGdwdUYAg3
TLSH
T11D422A71AC785D3B9AB3B145F04A36039FB4917B9AC42F54E6ED6F1C01DA6AC130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 c80d0acbdd1f8a22d91163e1f7fd93aa1d493b9955d55750c68656fcb0344a96
MD5 e16b8a4d5c4d8a2349bf7d7192354da4
SHA1 92f29e5a20bc710f11a44d42e057c5717133804d
SHA512 8b3c8ee8b2bf4db495ff69246d2ae09b8299ae566150679554f10429a3ca06c44b43ddc6def8b4f685078e52232458a790764eba75f7febfa3a5fc0d466a361f
SSDEEP 384:2iFpzsNq8TUNTUlIR95q7byZpGdwdU9LAg3:dFJrwg0aIUUhAg3
TLSH
T19492C5F258D7883AD9AE9747A37D2E038EBCD167B9805A50B7D85A0CCD861BFC306C05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 5fe88e89a9107c5ba831f01bbf2ed99fada21db6f70631534751db8bb6408dbd
MD5 7b3c9f44504e92134dec85ba1732aede
SHA1 ef217f492abbc78cc33ed848251e275d93f9b222
SHA512 5ea69c03acf0a055a3ef03a7c7e99f20c2a87637fdb5a2a43cc208f8c201d755032c44d2c302b434063d2d903c025ff45ba18b284406459f0739b66aa09fab89
SSDEEP 384:2iFpzsNZ8TUNTUlIl9Iq7byZpGdwdU9LAg3:dFJuwgZaIUUhAg3
TLSH
T1F192C6F258D7883AD9AE9747A77D2E038EBCD167B5805A50B7C85A0CCD861BFC306C05
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 6975481aa09bdea207c11b4a114b100b7469b82aaf7ae9dd4cb8aedc8838ab41
MD5 d4ebc9e853710592713d0b81b4f953c6
SHA1 3fa0ca5ea40c8a15598534de767c45e7581946d9
SHA512 a39758562347f4adc211961c4db04568f9e098574dfe68a9f038e2410876b73cd6ca3dd67b2eb40cbd4b109c0bc1c6cee94d0c0671964409081d17eec8de2e0e
SSDEEP 384:2iFpzsNW8TUNTUlIl9Iq7byZpGdwdU6Ag3:dFJ/wgZaIUU6Ag3
TLSH
T19492B5F258D7893AD9AE9747A73D2E038EBCD167B9805A50B7C85A0CCD861BFC306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 eedaf7c6d9432122818e4a49045868773ac4dd23501cacb8ba4ffb5a33c99943
MD5 b3130ff7e6b6db5896330c291ab97a9c
SHA1 f3317fbed10c22b1847e791f9fa1baac4cf7d958
SHA512 ab08a5945c444e6b9a6dde192057db63bbac7df803995a29a98b5494e359ad7bf94ff85c5a5a13746e736bf8a13ab0421254d825c46a23cdc1483bb63dcdd89e
SSDEEP 384:2iFiZcIdzsNq8TUNTUlIRo5q7byZpGdwdU9LA0C:dFQlrwgraIUUhA0C
TLSH
T1BCB208F248D7883AE9AE9747A77D2E034EBCD167B5849A50B3D85A0CCC961BFC306C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 be2d67ad87bdd52d9f490fb5e9fa283feeaddb73bd1d0225d67a5e9f2c63368b
MD5 c7e7598a589d67f8c99e793e3dccc030
SHA1 eab91c1bc7d6c7997e3b73acd6e353d02ea681f6
SHA512 4e85455d055448e2ce98e5049c3c764e793ae7e9528d2d5c21bdd423355607ddbfd9e4a16abbaa04f47858043b668ff826ad648a850a61ac3610aea93ba723fa
SSDEEP 192:lONnZ6vMtPQmiUy7JThTZS+FdLF8472SU/u:lONnZ6UtRaTFdJ9U/u
TLSH
T1C2021835ACB86C6BDAA3AD46F48A37175FE4117FAAD01B50EAE82F1C00D765C1303827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 c673f68db5f864df6bc62c9473b4d859282581eb4c0bb63677182701698a06c9
MD5 7792cd2110fefb17ca67a56181bab3e7
SHA1 9bed25bd67ff7ab79efbcb5d96661b613e7a5051
SHA512 fd9edf47fa0a993019b8a1fdd7512b147972490ff8c1bf66dbce1e65740ed1077052ea06aa644483ef413879573c057c0379a4b61d80a62a2b8b803d922eb96c
SSDEEP 192:uGLsNW9QhRM7CgWQmiU1hAm4MTZS+FdLK7Fd3E78z1Oq0g3:/sNW9Iq7byApGdwdUYAg3
TLSH
T11C422A71AC785D2B9AB3B145F14A36039FB4913B9AC42F54E6EC6F1C01CA6AC130BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 83ecc27cbb228db1b8b2fa5ea3ff4dfeb5139dc1512ee0f02050897681600228
MD5 fc822bcc634662981386aaf11ee3a2d6
SHA1 f6cfed55168413b901b5c3d94536516f7ad4f383
SHA512 34b0d7b21b63a3afdbfa5dbec2c24db2032c616e150bd5bc67f68b51fff80b4a5d41c9dcfaff923540b5f5ca43b30cdecb0db44d88c01de7534a9688327ae60e
SSDEEP 192:DONX6vM+PQmiUyGJLhTZS+FdLK7Fd3EU80IOq0U/u:DONX6U+RZLFdwdU5AU/u
TLSH
T1F7121B31AC646C2BAEA3B585F48636175EB4917BEAC46B50F6DC3F1C01DA66C1307C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VariationsRuntimeSeedV1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsRuntimeSeedV1
Size 484B
SHA256 9fd2b7fae87c2d863b486a425834283f19b1444749c84650d5a48c9eadb12e2b
MD5 e9289cc1f579fdfa9d46acfae9b38330
SHA1 7eac8e241d8c35d873280d6b9dbc1cca7a9b2231
SHA512 b1f37da50e387c8408a960ef5276a51336510286c1db7eaea4cde65af4efc343f8ac1d9de65df1fd0818513823a485733e5c155da615344bc044f46021ecf586
TLSH
T134F0543C33D821A4F08C46B23596ED8B88BF313247DC2631CA50F550315387701B5095
MD5 SHA1 SHA512 TLSH

Submit Download

69b2f46e-27de-47e6-8dfc-a341c424c695.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\69b2f46e-27de-47e6-8dfc-a341c424c695.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 41b25b62eda697412d36009360e6446e4f3a8ef7192b6925a10e8cb957cf50bf
MD5 15ea5f78ca57ad369a02952d8d083f31
SHA1 024b43a4a9ac09bb28c50d7af4df17d62385638d
SHA512 6c500cd332ff98ccc07c1db88a38ce7464687ac4a4636add16ed527c144a40db8ccd0fb38df49cf966010ba88d7a7c27e07cbaf46d8445c2904582151d217006
TLSH
T12041245CB6F91148B3B76E4A9FF6A86D487FB9372F47945D00110D8E0A62B40C872737
MD5 SHA1 SHA512 TLSH

Submit Download