hxxps://pastebin[.]com/fGqweuXy

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/08/2026, 06:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://pastebin.com/fGqweuXy
Sample260805-hhz5nsbr21

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 4 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
28	pastebin.com
5	pastebin.com
6	pastebin.com
14	pastebin.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2056	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134303859132034401"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{3DB7ADB2-E670-4E7D-8B6A-C94B45E0C224}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3792	msedge.exe
3792	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe
4864	msedge.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 4864 wrote to memory of 2216	4864	msedge.exe	85
PID 4864 wrote to memory of 2056	4864	msedge.exe	86
PID 4864 wrote to memory of 2504	4864	msedge.exe	87
PID 4864 wrote to memory of 2504	4864	msedge.exe	87
PID 4864 wrote to memory of 4812	4864	msedge.exe	88
PID 4864 wrote to memory of 2504	4864	msedge.exe	87
PID 4864 wrote to memory of 4812	4864	msedge.exe	88
PID 4864 wrote to memory of 1948	4864	msedge.exe	89
PID 4864 wrote to memory of 1948	4864	msedge.exe	89
PID 4864 wrote to memory of 1948	4864	msedge.exe	89
PID 4864 wrote to memory of 4280	4864	msedge.exe	90
PID 4864 wrote to memory of 4280	4864	msedge.exe	90
PID 4864 wrote to memory of 4280	4864	msedge.exe	90
PID 4864 wrote to memory of 3012	4864	msedge.exe	92
PID 4864 wrote to memory of 3012	4864	msedge.exe	92
PID 4864 wrote to memory of 2924	4864	msedge.exe	93
PID 4864 wrote to memory of 3012	4864	msedge.exe	92
PID 4864 wrote to memory of 2924	4864	msedge.exe	93
PID 4864 wrote to memory of 2924	4864	msedge.exe	93
PID 4864 wrote to memory of 3204	4864	msedge.exe	97
PID 4864 wrote to memory of 1116	4864	msedge.exe	98
PID 4864 wrote to memory of 3204	4864	msedge.exe	97
PID 4864 wrote to memory of 1116	4864	msedge.exe	98
PID 4864 wrote to memory of 4268	4864	msedge.exe	100
PID 4864 wrote to memory of 3060	4864	msedge.exe	103
PID 4864 wrote to memory of 3060	4864	msedge.exe	103
PID 4864 wrote to memory of 3060	4864	msedge.exe	103
PID 4864 wrote to memory of 4276	4864	msedge.exe	104
PID 4864 wrote to memory of 4276	4864	msedge.exe	104
PID 4864 wrote to memory of 4276	4864	msedge.exe	104
PID 4864 wrote to memory of 4500	4864	msedge.exe	105
PID 4864 wrote to memory of 4500	4864	msedge.exe	105
PID 4864 wrote to memory of 4500	4864	msedge.exe	105
PID 4864 wrote to memory of 820	4864	msedge.exe	108
PID 4864 wrote to memory of 3912	4864	msedge.exe	109
PID 4864 wrote to memory of 228	4864	msedge.exe	110
PID 4864 wrote to memory of 3984	4864	msedge.exe	111
PID 4864 wrote to memory of 3984	4864	msedge.exe	111
PID 4864 wrote to memory of 3984	4864	msedge.exe	111
PID 4864 wrote to memory of 3980	4864	msedge.exe	112
PID 4864 wrote to memory of 3980	4864	msedge.exe	112
PID 4864 wrote to memory of 3980	4864	msedge.exe	112
PID 4864 wrote to memory of 1696	4864	msedge.exe	113
PID 4864 wrote to memory of 1696	4864	msedge.exe	113
PID 4864 wrote to memory of 1696	4864	msedge.exe	113
PID 4864 wrote to memory of 928	4864	msedge.exe	118
PID 4864 wrote to memory of 928	4864	msedge.exe	118
PID 4864 wrote to memory of 1224	4864	msedge.exe	121
PID 4864 wrote to memory of 1224	4864	msedge.exe	121
PID 4864 wrote to memory of 3792	4864	msedge.exe	122
PID 4864 wrote to memory of 980	4864	msedge.exe	123
PID 4864 wrote to memory of 980	4864	msedge.exe	123
PID 4864 wrote to memory of 980	4864	msedge.exe	123
PID 4864 wrote to memory of 1908	4864	msedge.exe	124
PID 4864 wrote to memory of 1908	4864	msedge.exe	124
PID 4864 wrote to memory of 1908	4864	msedge.exe	124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://pastebin.com/fGqweuXy
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x264,0x7ffa6017c188,0x7ffa6017c194,0x7ffa6017c1a0
  2⤵
  PID:2216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1972,i,12123177937026855925,4410133214731927240,524288 --field-trial-handle=2348,i,11202268598198792988,5696942463371262030,262144 --variations-seed-version --mojo-platform-channel-handle=2908 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1856,i,192641195109682408,5176269973240582828,262144 --field-trial-handle=2348,i,11202268598198792988,5696942463371262030,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:2
  2⤵
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2356,i,8586837205036398049,4318379678826294616,524288 --field-trial-handle=2348,i,11202268598198792988,5696942463371262030,262144 --variations-seed-version --mojo-platform-channel-handle=2916 /prefetch:8
  2⤵
  PID:4812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,11995316303258774798,6050320467895910516,2097152 --field-trial-handle=2348,i,11202268598198792988,5696942463371262030,262144 --variations-seed-version --mojo-platform-channel-handle=3488 /prefetch:1
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,11990761830500756453,669829987569563473,2097152 --field-trial-handle=2348,i,11202268598198792988,5696942463371262030,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4172,i,1178046020185801358,1616863358039848914,2097152 --field-trial-handle=2348,i,11202268598198792988,5696942463371262030,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:1
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4204,i,1969605719796194295,6785274175798916860,2097152 --field-trial-handle=2348,i,11202268598198792988,5696942463371262030,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:2
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4924,i,7861715919039416376,1142597117816084816,524288 --field-trial-handle=2348,i,11202268598198792988,5696942463371262030,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,1881447947096244370,16477191283467071520,524288 --field-trial-handle=2348,i,11202268598198792988,5696942463371262030,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:1116
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,12315911246414672116,506814891484480366,524288 --field-trial-handle=2348,i,11202268598198792988,5696942463371262030,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:8
  2⤵
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5860,i,12315911246414672116,506814891484480366,524288 --field-trial-handle=2348,i,11202268598198792988,5696942463371262030,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:8
  2⤵
  PID:4268
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6292,i,5776823068882219996,18009076410299049419,2097152 --field-trial-handle=2348,i,11202268598198792988,5696942463371262030,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:1
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6424,i,1881274179982160999,7980499387754971067,2097152 --field-trial-handle=2348,i,11202268598198792988,5696942463371262030,262144 --variations-seed-version --mojo-platform-channel-handle=6496 /prefetch:1
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6652,i,1875794367252778978,5180608173415631944,2097152 --field-trial-handle=2348,i,11202268598198792988,5696942463371262030,262144 --variations-seed-version --mojo-platform-channel-handle=6576 /prefetch:1
  2⤵
  PID:4500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3424,i,6082662750485110489,5793058502253747006,524288 --field-trial-handle=2348,i,11202268598198792988,5696942463371262030,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:8
  2⤵
  PID:820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4852,i,10882512343822231766,5036055595109796170,524288 --field-trial-handle=2348,i,11202268598198792988,5696942463371262030,262144 --variations-seed-version --mojo-platform-channel-handle=6812 /prefetch:8
  2⤵
  PID:3912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4976,i,12735232665252061009,3216096757643778822,524288 --field-trial-handle=2348,i,11202268598198792988,5696942463371262030,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:8
  2⤵
  PID:228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5236,i,17568246841507689037,3006753183614269606,2097152 --field-trial-handle=2348,i,11202268598198792988,5696942463371262030,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:1
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5912,i,15332304947048766107,17963563887043045804,2097152 --field-trial-handle=2348,i,11202268598198792988,5696942463371262030,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:1
  2⤵
  PID:3980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5384,i,5678599468463264302,9596343499291338624,2097152 --field-trial-handle=2348,i,11202268598198792988,5696942463371262030,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:1
  2⤵
  PID:1696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6956,i,17537637670283694020,7552759323515843343,524288 --field-trial-handle=2348,i,11202268598198792988,5696942463371262030,262144 --variations-seed-version --mojo-platform-channel-handle=7036 /prefetch:8
  2⤵
  PID:928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7228,i,1943334554833553707,5779243840146870288,524288 --field-trial-handle=2348,i,11202268598198792988,5696942463371262030,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:8
  2⤵
  PID:1224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5256,i,11622056323294783751,7840199270203416232,262144 --field-trial-handle=2348,i,11202268598198792988,5696942463371262030,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=7400,i,263423171588489069,3920864762322500324,2097152 --field-trial-handle=2348,i,11202268598198792988,5696942463371262030,262144 --variations-seed-version --mojo-platform-channel-handle=7412 /prefetch:1
  2⤵
  PID:980
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=25 --always-read-main-dll --metrics-shmem-handle=5324,i,211663562788858318,3587204304034843986,2097152 --field-trial-handle=2348,i,11202268598198792988,5696942463371262030,262144 --variations-seed-version --mojo-platform-channel-handle=5332 /prefetch:1
  2⤵
  PID:1908

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2164

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 12104dd3c2fda03eed8e9fe97d1c8c331237df73b825255f2c8a4424f9eee8fc
MD5 0272cacbbb6ed8ce74e6c664a085e187
SHA1 e18e3d395cae9ca66345f804f048f752074420a7
SHA512 d7df299a22bf1ed1d6757011261fcc585bb9aee7db699aa7f37cf58e7bd5302ee7ae45218f61624dc842a99548b44160f0e1bd6af1382db157a77eea1ddef3c1
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7e:fwUQC5VwBIiElEd2K57P7e
TLSH
T175B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 7c14cbc47e10010aa0748334b5f8191dad6a0c1bb7680b23122c164cc87e7bd5
MD5 1508d7cc01a2f6e28259f1603ea1063a
SHA1 827506e5ab65ff8eee4b46c3d879430192719f76
SHA512 fd5daf1e0d52af5a8f76e22d5a1e6a26b8010579b700ccdf08edfd43b08c7278d43f727d935ad94dfae01d134f61baccce83f661bb7bab2ab5d3e79b60ee13cb
SSDEEP 48:bwr2Xk9PrJVDupGuKxBB3Dqnwpegwo22gr495rGFmtGjQWp3KfqpLgUgWmlI8+2j:kaXm9IDyjzVLDRO49UYMtx+lBVVV
TLSH
T158911B1441BAC0D4EBE99DF0E5F16BDDBD7B04E42B1B8E43086CE43CA58ABA2E095153
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 72e0b9bf39a3e33acfe334bd85bc287dbf1688dfba3e496fbb4761a38f0fdb83
MD5 d15b570a3e053d0e862d2ba40c8acce6
SHA1 8a32757dc91caf0d97ebdc526d82353637cc8bf9
SHA512 72ec23d107d60f28c547ad65b92b50fdd9dd3b520c64c65f497e3811ef2f1751aee3c6bd9972dfe70baa8b91bd24e7a88d4b06e24d05aba7b7b71551d54f69a2
SSDEEP 48:NcGwr2ik9vrJVDuTGuKxBB3Dqnwpegwo22gr495rGFmtG3utQWp3KfqpLgUgWmlv:Ofai+9IJyjzVLDRO49UYttx+lBVVN
TLSH
T1F7910C1441BA80D4EBE8DDF0E0F16BDD7D7B04E41B1B8E830C6CD43CA58ABA2E055153
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe594caf.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe594caf.TMP
Size 3KB
SHA256 d3f4e2e7dc985099b9d522b5cf6ad88052cefda574060922bbd56ba9fc414f5a
MD5 b20b3d281ac91b4a0fbfffef229666f2
SHA1 a641799d977cef6621dd84696ff9ae2865bee39f
SHA512 2fe030fbdaaf472fa71e3171181e2636eae023d3f7ccba61a5d3ae61acca1b2d77052441a31c5afb15b7b4a76d8e5b3c4e1fa307eb6fe8c238c92f528d688a7f
TLSH
T1D87150184579C4D0E7ED0DF0E8F103DDBE7745C82A679E03006CD83CE686BA2E0A9197
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 16KB
SHA256 fa21bd2a287063155f509710ad17fe0555860134c7390c267c670b0cc2832d62
MD5 ef2d8527de1b1d5269877134a7eafe66
SHA1 22b2192da26bfeb3cf98013c0f1b5d6ef5772c18
SHA512 8ec710e9c3a7567e2b551eed992ec6c3f2276bbbd9d89f0332b7e7c6e9b51084e2767bce989cbbe7cf706936f5350bd3528abf3e5544b4267c0736d4abe82243
SSDEEP 384:DbaLt83DUEMbLBepxzq1k/EIqvv0Btd94U02YI8BHrYB48iYcIBU+kzKVJqhftA1:arVaSQ3JzCRl+
TLSH
T131727AB387F45D2CCD3191F0EB162E1FCE690920976C387E85D87E56A7E5462F201A8E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 bf1fac138155daa1ea2ab51c036f73600757123d0a079d3f7e419c062b0dcfda
MD5 7ed5fd25cd16fec2c1cdf03466eafdc0
SHA1 f1cd61cf58231a823fd54b9bb2410938b58eb466
SHA512 33c5d92c2d5efa2eefac7ea0b52d5ba02d8a53cf15f623f134c9af0b5422e8071aa05157197f5d5a7acce3150e423972ba0fbda63be7aa64495d88a56c09dde4
SSDEEP 192:sxZmRhyM/jK1Ml8Mky/fhsnyNIdpk3HW6+WNT2o/YHnu3pIgrJ:sxZmXMy/fhsnyuGHbr/z9
TLSH
T1B452F7126A346977CCDBD20DFA45BF53D6F95472A2900E58ADFCDA1C04E6AED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 c1eff7b79fdc3e09f609d9963c3591c44da0df6328d53f9ee95794af150ecbb6
MD5 6a16ba9cbeab742cccec8cac4b1ae207
SHA1 03d2e017581201df818adf978e75e7b715484208
SHA512 51038074f659415382da0d9a25910c1e82228b63573b9cf6716fa44960e16933d9ee2f91724a42f39bead06ed10d00310bdae91804bcc49b997f53ed7c923e0a
SSDEEP 192:sxZmRhyM/jK1Ml8UQvky/fhsvoNIdpm3HW6+WNTfsdYHDJopIg5KJ:sxZmXqcy/fhsvouMHbod3E
TLSH
T13A52E7126A3469B7CCDBD20DBA417F53D6F95472A1900E48ADFCDA1C04E7AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 315a50f905f7da08a87d20d8f6ee5a2e08955f9db0b76c614faf57edeac1cb29
MD5 3eb68bf9e63509edb05a92fa4f526dde
SHA1 bf4db990954d5fa5be2a447145b1dc88d0e9c3ca
SHA512 72ded90f59a112025cd48880f0bdb40996733fd1be12ae99007bab59750db332f1d425c4fa2177c5e5730d81090b9585e8cb69f5460e9def4fca7c801798a7eb
SSDEEP 768:3eUZYTMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4RgroV+0R:3eUZYTMWvg0Pou1ja7eLZmRrzR
TLSH
T15DD20B2F280CCB7E4F844E9DEC266F863ED801CB5A584D5447EA894C03CB7EB512B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 50126a89d452c30f93765e6ccaaa229589ed79925339616242c7557af28c189c
MD5 09341b1c7e56254921e8b3bc8e4c681f
SHA1 9bddc6b06b4a6e4f91bf75ac1507860e4127c125
SHA512 ae4614e9f1b872723309ee6a8e89811a5983234d58eff8d8ca9d57eb4f1e981672bc13b6550e0bdf4c786b9e57ce4d9ffff615f4e0471bed78c06563b615f89c
TLSH
T1C9A0029402A30959E5955BB4248172426A31DC309663872742B111469DE0995E649001
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 a048d8925f5e50bbc6224ed12fb9db8146e7189833972ace30b501302d4af11b
MD5 033ac04c31a3d1782a5c2d339dc90310
SHA1 969dd33976039d6e5418f8c3bf86cb86df8deda2
SHA512 657d85337d8afa647a5219e1287aaf03ebf381a77f1e3bf171c323b4ed24ca80e3bcc5b5cd198e25a786b4486c233170c85d75131bd1603a482c67b612a84a4c
SSDEEP 96:KA1eK2AZqgKLqquv+KYIeeEKbC+2ZSKycnzK3zdl:EJnlMbpn
TLSH
T15DD1E14272BB06013DBE2A0D9354976B474271633018B52F7BE820B64E6EE385DFE9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe592699.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe592699.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 9384f9cd5d536f7e0b99ac18452432dbe67c7b57c358d3b37d87c07e75e4a476
MD5 c447c8df3946d659800ea41cec897cf1
SHA1 a38638be8335e361bb96f9881a6be3fb5aab53f2
SHA512 5f6bbf5bf1d49fabf03a24a568819fc5a87174f169be18ad2a9e1b1d08680b9653c0eb64b468ec20e3fa15a606fc27134a203790cc387b44424250867cc5fa2b
SSDEEP 384:yZcIhsNeDuvdPkNzX5od+WAXLd+2eGBeRs9JKgqijUk9:AhY+lOeBleGTjKgqmUk9
TLSH
T158928C319824AC7A9DF7F585F48B36134FF8902BD7D06FD492EC6F1C019A998231AD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 f2d0d7623b9ddbef1564fa9fe49781d57edd8e22c0b52551d29137d167adbe21
MD5 f089fbe2b70b9d7d6e6d5ad9ecdbfeef
SHA1 97dd1bf03424fb15a967772eef4c4d787cd689b4
SHA512 995f4e9ef6abd629e45cad1950cb53eeefdfcb98d7fb9ba34a3315c6e53698ab614ead161178f0f7dd77fbc1c22712167d1b153d9658df70b1906b8d3d5cab86
SSDEEP 384:1iFiZcITzsNu8TUNTUlIlWuvdPFNzX5od+WAXLd+2iGBeRs9JKgqijUk9:8FQ3bwgxnlOeBliGTjKgqmUk9
TLSH
T1E3D23BF248D7947AD9AEA743A77E2D024EBCD057F590AA90B3DC5A0CCC560BFD306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d7c7a8fd3aab2d6c392efd5da060f201a5c8645211d29610056da298f6600c20
MD5 8485c49350110700d28a206be7ffa2e4
SHA1 11ab3ad9a2f3e021fd383d8b5a4951c456cc8b73
SHA512 fd6984f7c23874a6b4cd22f68986af6e01ce809f009daba1dc0db4096e2ee57ac3404ce3b7556c5d1f0313ce791853fc8dae7a3b397904c5409ca417c1373cb0
SSDEEP 192:yONdW61VWQmiUyvagGX5Obd+jVMjzoBU/ao3bsGU6:yONdW6WbgGX5od+WA0/U6
TLSH
T1CB02C83568287CAB8EF3BE49B48737135F98206BEA556F84D6EC1F1C009765C2356827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 3aa5506b8e1240a99f3d3e34587a62152ed9d675827a41928bcbbe3e84e43add
MD5 e9cce8ddf786af4e476c410195370773
SHA1 72aab738d0785938101852c66f82de95a687ed91
SHA512 e95e465b847654b3f70bba035cdcb43da6b9cb8b97bde6ce8b1ccf2bf8b60534af0e75f379bb0744c7fbaa679bd334ece1336e3b70ad6717ab6bf96f7b9a5414
SSDEEP 384:zZcIhsNeWuvdPkNzX5od+WAXLd+2eGBeRs9JKgqijUk9:rhN+lOeBleGTjKgqmUk9
TLSH
T1B0928D319824AC7A9DF7F585F48B36034FF8902BD7D06FD492EC6F1C019A998231AD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5bf6eeaedb9ea0542485aea3e062f713ebcd0b12dd1b930fe42de29be657b4b9
MD5 dc61e28fe8b3f8afd183162f8f7c213e
SHA1 32b1553ea16a0fed5dc2e8a418f014a34d6fa615
SHA512 5f9210984e7ff3c259a1cf11861f306dec332a5258b4fbcaec5733c4258ed3a5fa1ec47cb124909b3ed4a38727741eb9e97b81ba87c5d11fd8479486d3d13f6c
SSDEEP 192:PON/61mWQmiUyPaPGX5Obd+jVMjzoBlzXVFd+23RjJfcq4U6:PON/6TNPGX5od+WAXLd+2DGU6
TLSH
T1CA120932A428AC674DE2B584B44B36139FA55167EA897FC0D6EC2F1C01DB69C235BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 b4f44c1cd614a348af722979512f9efe70bb293f6bfc27dd0b3cf74b19a19084
MD5 0fe25d7c85620bf602408dc3e4044b61
SHA1 036ef36752cb2fe13a893aadbe45bed489b2aec7
SHA512 cb19ba24625c03f8ea0b254bbc3c28bd039f76f5868f1050ebf3bce1f350ce2f6d83bf61e5083c56fa9f4731110fce4436ce4c19b410686e574f75837e0c62e8
TLSH
T1EE411C88A6E91148B7B77E5AABF6696E487A78372F07D45E00110E4F0A72A40CCB1737
MD5 SHA1 SHA512 TLSH

Submit Download