hxxps://q[.]me-qr[.]com/d59imjv2

Analysis

user interaction
yes
max time kernel
299s
max time network
299s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/08/2026, 12:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://q.me-qr.com/d59imjv2
Sample260805-pb8a2axaqa

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4704	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134304054371538925"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{AD7F0296-7716-4EE8-A63D-A15D0C1F6BCF}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2388	msedge.exe
2388	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe
1788	msedge.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 1788 wrote to memory of 1688	1788	msedge.exe	85
PID 1788 wrote to memory of 4704	1788	msedge.exe	86
PID 1788 wrote to memory of 3704	1788	msedge.exe	87
PID 1788 wrote to memory of 3704	1788	msedge.exe	87
PID 1788 wrote to memory of 3704	1788	msedge.exe	87
PID 1788 wrote to memory of 3352	1788	msedge.exe	89
PID 1788 wrote to memory of 3352	1788	msedge.exe	89
PID 1788 wrote to memory of 1908	1788	msedge.exe	90
PID 1788 wrote to memory of 1964	1788	msedge.exe	91
PID 1788 wrote to memory of 1908	1788	msedge.exe	90
PID 1788 wrote to memory of 1908	1788	msedge.exe	90
PID 1788 wrote to memory of 1964	1788	msedge.exe	91
PID 1788 wrote to memory of 1964	1788	msedge.exe	91
PID 1788 wrote to memory of 3092	1788	msedge.exe	92
PID 1788 wrote to memory of 3440	1788	msedge.exe	93
PID 1788 wrote to memory of 3092	1788	msedge.exe	92
PID 1788 wrote to memory of 3092	1788	msedge.exe	92
PID 1788 wrote to memory of 3440	1788	msedge.exe	93
PID 1788 wrote to memory of 3440	1788	msedge.exe	93
PID 1788 wrote to memory of 1940	1788	msedge.exe	97
PID 1788 wrote to memory of 1940	1788	msedge.exe	97
PID 1788 wrote to memory of 1940	1788	msedge.exe	97
PID 1788 wrote to memory of 3336	1788	msedge.exe	98
PID 1788 wrote to memory of 1708	1788	msedge.exe	99
PID 1788 wrote to memory of 3336	1788	msedge.exe	98
PID 1788 wrote to memory of 1708	1788	msedge.exe	99
PID 1788 wrote to memory of 4276	1788	msedge.exe	101
PID 1788 wrote to memory of 3968	1788	msedge.exe	102
PID 1788 wrote to memory of 3968	1788	msedge.exe	102
PID 1788 wrote to memory of 3968	1788	msedge.exe	102
PID 1788 wrote to memory of 1808	1788	msedge.exe	105
PID 1788 wrote to memory of 1808	1788	msedge.exe	105
PID 1788 wrote to memory of 1808	1788	msedge.exe	105
PID 1788 wrote to memory of 4728	1788	msedge.exe	106
PID 1788 wrote to memory of 4728	1788	msedge.exe	106
PID 1788 wrote to memory of 5000	1788	msedge.exe	109
PID 1788 wrote to memory of 4720	1788	msedge.exe	110
PID 1788 wrote to memory of 3736	1788	msedge.exe	111
PID 1788 wrote to memory of 3628	1788	msedge.exe	112
PID 1788 wrote to memory of 3628	1788	msedge.exe	112
PID 1788 wrote to memory of 3628	1788	msedge.exe	112
PID 1788 wrote to memory of 2396	1788	msedge.exe	120
PID 1788 wrote to memory of 2396	1788	msedge.exe	120
PID 1788 wrote to memory of 3508	1788	msedge.exe	121
PID 1788 wrote to memory of 3508	1788	msedge.exe	121
PID 1788 wrote to memory of 2388	1788	msedge.exe	122
PID 1788 wrote to memory of 2136	1788	msedge.exe	123
PID 1788 wrote to memory of 2136	1788	msedge.exe	123
PID 1788 wrote to memory of 2984	1788	msedge.exe	124
PID 1788 wrote to memory of 2984	1788	msedge.exe	124
PID 1788 wrote to memory of 4160	1788	msedge.exe	125
PID 1788 wrote to memory of 4160	1788	msedge.exe	125

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://q.me-qr.com/d59imjv2
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1788
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffaa793c188,0x7ffaa793c194,0x7ffaa793c1a0
  2⤵
  PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1776,i,11214075507114888452,1108601861714014409,524288 --field-trial-handle=2256,i,6307941800354979679,10948275337611793915,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1660,i,9878182668078537287,14689158170863650010,262144 --field-trial-handle=2256,i,6307941800354979679,10948275337611793915,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:2
  2⤵
  PID:3704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2564,i,8028841083705741036,13131676257990268370,524288 --field-trial-handle=2256,i,6307941800354979679,10948275337611793915,262144 --variations-seed-version --mojo-platform-channel-handle=2136 /prefetch:8
  2⤵
  PID:3352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3476,i,4010407903860056632,1386438452580183535,2097152 --field-trial-handle=2256,i,6307941800354979679,10948275337611793915,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,16517647569391295234,9580718258601022283,2097152 --field-trial-handle=2256,i,6307941800354979679,10948275337611793915,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:1
  2⤵
  PID:1964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4292,i,7882879916462178808,2906295094187376497,2097152 --field-trial-handle=2256,i,6307941800354979679,10948275337611793915,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:1
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4312,i,12022485237793434072,13723983859626054338,2097152 --field-trial-handle=2256,i,6307941800354979679,10948275337611793915,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:2
  2⤵
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=1652,i,12746891360700091455,13100611681358469270,2097152 --field-trial-handle=2256,i,6307941800354979679,10948275337611793915,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:1
  2⤵
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5316,i,3774699957700057542,6546164904114569510,524288 --field-trial-handle=2256,i,6307941800354979679,10948275337611793915,262144 --variations-seed-version --mojo-platform-channel-handle=5348 /prefetch:8
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5320,i,8461994066934942589,1824054097542365612,524288 --field-trial-handle=2256,i,6307941800354979679,10948275337611793915,262144 --variations-seed-version --mojo-platform-channel-handle=5388 /prefetch:8
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,4426135738560210101,12140104338018526918,524288 --field-trial-handle=2256,i,6307941800354979679,10948275337611793915,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:8
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,4426135738560210101,12140104338018526918,524288 --field-trial-handle=2256,i,6307941800354979679,10948275337611793915,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:8
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6388,i,16003719616639201407,7659170096488193828,2097152 --field-trial-handle=2256,i,6307941800354979679,10948275337611793915,262144 --variations-seed-version --mojo-platform-channel-handle=6344 /prefetch:1
  2⤵
  PID:3968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=7096,i,5109641220984247368,8762113612004269908,2097152 --field-trial-handle=2256,i,6307941800354979679,10948275337611793915,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:1
  2⤵
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4508,i,7856658570620112701,16829361980667989239,524288 --field-trial-handle=2256,i,6307941800354979679,10948275337611793915,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:8
  2⤵
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7100,i,8900114055984456938,12922590532718515750,524288 --field-trial-handle=2256,i,6307941800354979679,10948275337611793915,262144 --variations-seed-version --mojo-platform-channel-handle=5088 /prefetch:8
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6864,i,16296105538617980198,12179981443934684438,524288 --field-trial-handle=2256,i,6307941800354979679,10948275337611793915,262144 --variations-seed-version --mojo-platform-channel-handle=6032 /prefetch:8
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7164,i,12721078761539849616,137563023469704112,524288 --field-trial-handle=2256,i,6307941800354979679,10948275337611793915,262144 --variations-seed-version --mojo-platform-channel-handle=6824 /prefetch:8
  2⤵
  PID:3736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=6824,i,18383396836739233048,300558825907504137,2097152 --field-trial-handle=2256,i,6307941800354979679,10948275337611793915,262144 --variations-seed-version --mojo-platform-channel-handle=6808 /prefetch:1
  2⤵
  PID:3628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6748,i,17590795062360562402,5770439079973293841,524288 --field-trial-handle=2256,i,6307941800354979679,10948275337611793915,262144 --variations-seed-version --mojo-platform-channel-handle=6744 /prefetch:8
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6876,i,5416831140794339226,6856242176338678084,524288 --field-trial-handle=2256,i,6307941800354979679,10948275337611793915,262144 --variations-seed-version --mojo-platform-channel-handle=6892 /prefetch:8
  2⤵
  PID:3508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5388,i,955288832837265006,13916043930277745320,262144 --field-trial-handle=2256,i,6307941800354979679,10948275337611793915,262144 --variations-seed-version --mojo-platform-channel-handle=6508 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3440,i,12223449994276372311,14189796079753083694,524288 --field-trial-handle=2256,i,6307941800354979679,10948275337611793915,262144 --variations-seed-version --mojo-platform-channel-handle=3104 /prefetch:8
  2⤵
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3408,i,12776024832165007489,15976456708344728857,524288 --field-trial-handle=2256,i,6307941800354979679,10948275337611793915,262144 --variations-seed-version --mojo-platform-channel-handle=5248 /prefetch:8
  2⤵
  PID:2984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5568,i,15861179060097591259,379777712405884045,524288 --field-trial-handle=2256,i,6307941800354979679,10948275337611793915,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:8
  2⤵
  PID:4160

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5060

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 acf2ca2fd979c7d8ae7b74bb0af4308e4abd3e42e1f32fd1a04b0ca1a2b166c8
MD5 80eaf72bc0ff9c89a5c23f07f38ee8f5
SHA1 cbf109666417a1db022b3f49a91481b9755a1b8e
SHA512 b21d0ebff096128eae96a603cc0e96af95cbca34e613c40faa0cc8c5c17961106d997b66011c3051ead599494bd80939479f2526a2e65ff25600b04b19065afd
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7T:fwUQC5VwBIiElEd2K57P7T
TLSH
T15EB3B931457E36BF26E93EE828CF1511B84F3912624895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e2b315c59b1bfe8e547b0017a92548af7c81e08409e987a2628ad74667b4fec
MD5 7ab616f55807e9de5195a40c50f65e5b
SHA1 917a7797f800e5f30a1b9b8125127968246d7ce9
SHA512 da10f29803a072f42a2c102da0bee745cf1b1d47836e3d30e38b1e66beeb1abeaf2eb47b6c07b23682098f70fe2a4b29a0777eefa1380d0fff2509ff32d9b356
TLSH
T171D08023771D7182F35B41759053D7025A1680756463B701B325D41C9A740C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b976ac8901ffd41ec02a04aa583bc9d11350f0f9f714fb92d3341bb0bde4629f
MD5 504ce80b644a85a7e68d85bd24169289
SHA1 1f740a722dfa97fc8fb30626b0e3d6217e4a9864
SHA512 9406464a4f6becd85591c12af8a97fdecfa2208649138f347fb50d3e28f1583adec061050924fa0405e46eb75af7e299e6564c2ed039db9d82c50326da32a3c5
TLSH
T19ED08023371D7582F75B41759053D7025A1680756463F701B325D41C9A750C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 6KB
SHA256 396a865b39615e482e46a043347363283261085af2c27d625ea91dd7585ac3d8
MD5 8812111049640c2053a9b14ff6b76805
SHA1 613dffffe46a8bd250f38f7fd4a6037fe626bb9f
SHA512 0b28e6d8e2722ce5c4585fcf8b5fddd7b7a172da3e5959130b29d3e10e5537215a63e5ac0609a30f495bcb74be4bed1a6d7edf6bb85bfe32926f30da9c394bc2
SSDEEP 192:Qj0GwGgGAGYGuGoGLGRpGWGWGIGuGuGPG1GnGnGmGVGJG3GIGJGJGHGHGmGmGVG0:QjnjTzrh7KRgppbhhOMGG5sAWbAAmm57
TLSH
T1AEE13F4782E5C79ADF0910CB59A0A39C51B43F0AEBECDA08174C8EDD344E49BA5A1EE5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 9ce7bdebd29f7aa226534dd1f74991c4be6a9116f8998921a22f1850eb3f5825
MD5 39c963acb1d7c0099455a2db64e83a24
SHA1 27bd0e3b7a3281a31117787cd5bd898656f96998
SHA512 bba3372a03c59112ca4d4175be9477c1b2cc98407ff00e3eff2a2f805d246b6c49771172e4b09dd89577b6901530f5ea7fd533f3dcafb1f3b4888ae3c513477d
SSDEEP 96:LX7QRMR4tmVzdpj46xiufCv/UibhiQSRaKy30Il:LXJR4tmVzddiaEkR9g
TLSH
T104B1B73712E12CE2CBA0B7BF70E90DFC757289C6FD5A0E9E1220BA31391B3A491155A4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58fe31.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58fe31.TMP
Size 3KB
SHA256 a6ef46e30cb0d5836b4c6e148335c014866bb80ee8ea66a96421a1f05d841b17
MD5 54f6a4a431d3a498f5488dfd681fc77a
SHA1 fbe4f53916492a31625b7c96faaba78cc8851703
SHA512 2c958f2e8ce3952c7f12c01fad29f71388d263fcdc744e902f29e716455d201e135314affe5d8299823848a9797b09bcc2c368e4d0d28c153050e2d1bab721cf
TLSH
T1DF71C53B06E26CD2E39047FD74EE1AF5747349DBFD8F5EAD12209A3036237528229568
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 13KB
SHA256 dda963e8abf53794c8c5867a6bcdad5ba3a0352b355c62db8df4bfa4bc0a1e4d
MD5 4e6f86e6ad9ee11ae83947b202d9a9f2
SHA1 8a6b80af8ac13354c9dcd0967d4dd4166abb48fa
SHA512 2c06b6b6ad722e43d3f544bb2472778de525eede2c9bab269a6721bc5247576c63e9039be308642f274d44daef1b8cb165315a0cca019acbc449e94f6e74cd99
SSDEEP 384:DfUWeQ4Y1HAFvDurNoPJHJRieLAXB1MvmJbPZF+HQMGMIm2JeqQbqhZjJYjzokvu:zs9lP1v/CN
TLSH
T1F95260F7D3E9556D8C2253F0DA187E1FCE5E1629832C7E2989E4AE0693D1071E202B4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 f6be09913b297787a8cfbebab4c9c903e32f4ac9a820fb2fda788b7daf75f5e8
MD5 94d5d75e3d10cd1d421ed128b18b2b1e
SHA1 d3cf7c26c71bcb6ea9019137dbcffd06ac65ff0e
SHA512 d9613bfa03456d96073e2337a4ee018ad4b4176b56676b2dfd272e52c30ef3eecfb025a86f3394ea5b0b70c71bdca1393e8023293e5b99cb7f474bbe6002b07f
SSDEEP 192:sxZvRgyM/jK1Ml8MkZ/ffs7UrS9IdpSFHW6+WNx6R/YICmgJIgrJ:sxZvKMZ/ffsQrS+WHbq/s9
TLSH
T1F152F8526A34A977CCDBD209FA45BF53D6F90562A2900E54A9FCDA1C05E2AEC320781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 a76d940dfb99d7683d1d2a82eb15ee640f73e7cf2a308e3aa6a9e29ea16eba9d
MD5 50ecc5c89edade7cf24a7c832007e38a
SHA1 0bdd87b1bb81ebc5416a4ff5f8b2e709b4ac3cf5
SHA512 8b6e5532806653dd6de75d2b779961700f28fc6ec364756e913ab177a32ac565e3c9f47797dfd85862e747092fabbf49dfaf50ee50110cd63fdf6ecd7efb8a4a
SSDEEP 192:sxZqRgyM/jK1Ml8UQbkZ/ffshUlSPNIdpqPVN4HW6+WN9mfMej4ZYIL3VbJIg5qW:sxZqKqwZ/ffsalSGVHbHpZV74W
TLSH
T10F62F852AA345977CCD7D209F944BF67E2F8056291901E48AAFCDE1C05E2BED320781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 d12b9882a0e73522b441a9a4e68eb5f05afd96cc1a04ef06a98f7e7b47530081
MD5 0969d7c943eecea913ff6bc08d4c5527
SHA1 55dd0d12c47189bedb63fd97ffa8c0c3676de0f8
SHA512 45b51ff281883dba39f5a79051c4674fb963c699d6fda3402b744c272b0d7af1cd4cd111d7ed49b8f3da6c5e8e67b7d968e6142009bbe5f90b9d0dfe63b8ee66
SSDEEP 192:sxZqRgyM/jK1Ml8MkZ/ffshUlSPNIdpgPVN4HW6+WN9mfMej4ZYIr3igJIg5qaJ:sxZqKMZ/ffsalSGnHbHpZFt4W
TLSH
T1546209526A346977CCDBD209F944BF67E2F8056292901E54AAFCDE1C05E2BEC320781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 2b941c1c3f7b46bea64df80e2ce218fa27cdfb39712f2191ea391a0cc9a93062
MD5 552112f3f152e1a37ffbad17200e9880
SHA1 493fc4615067deb7d5bf2d7b3015eef8c92db29a
SHA512 4f82d2f9ff2c3dc9a209ddf26998f8bffe0649efc1bda1c29acbbd1096777d370479da212cad575cf3164f4e083d3639375afcdef4b3d4190c9a243c318fbd4f
SSDEEP 768:+0sqxXlWvJD0T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR99rocqC:+0sqxXlWvJD0Tu1ja54LAs92cB
TLSH
T175E21B3B694CC77E4F840E5DEC2AAFD76ED801CB66988D5447FA880C03CB2EA51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 132a1fc59a50d6a2bb5303264e345998306dd258c295ccd92634653017aa4f64
MD5 5ed23cb7c58b8ee631c36a99464cf486
SHA1 fcda15fb849c4c491838b68054bc8dbc80e66661
SHA512 5b4e8d962da23742977fdd08e18cde3eebe199369fd3a4a85b54fb5e08b884972c2aacf3e26310c406369ecbdc5db8118e8cdd6823e45010e917258cf662a4bc
TLSH
T18CA002E185A35E53F1151776608241403362CD1109A3835143A17055C8F0AA4E327000
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 7739deee6425081130adcafee051ad672c43e00e6cf0d59f245c31f6646d7c8b
MD5 b786363fb89eadfe3c8d457ad6acb4b8
SHA1 59db74e768736f68b0d6dcf9d69d6288183f36fa
SHA512 208c8b93e240674e844a4742a48eb1400e8f8ac293de49c37ff79edbffafcb88c02dc9649005c9986f7d29f65589d99f54c328fa506b1f6d8fe090b9e2c05493
SSDEEP 96:KYbaKYIKOBOKyw6aEAKdieH6KYUOWb+KoEt:ExthXc5h0
TLSH
T18DE10726737B0342787E290CA2EA95378E4137633818A56F3BB840E50E67E615DFD9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe58def1.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe58def1.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 45952365d10b889791d6964ecbd383e59ed6616e19bd07a62778bceba8a6dd13
MD5 bb613755a945eda876b60dcd672f8cff
SHA1 317d509c6d3595096220ac031d10ed6b791299c2
SHA512 368f930685f4af418a47106581c652c0083fabc3e2143b0a57b1ff6795dea7236da6c9e036aff7118f12352a993a50fceae9b6e926bc6cbcc9e84c0f12856781
SSDEEP 192:uk1LsNgdQtC+kRbErQmiU1fGBf4VRNwOm9Om3l9UiKSRAqXM7XBv:tpsNgdZbWNaQVRNwOqp9UiZK5
TLSH
T1AF42293569389C279EE3A145F54B3A138EF85167D6882F94C6DD6F0C06DB6DC230BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 046327178b020845a28c9da88f32f7981571e00cef60acf0bf681fb33258eafa
MD5 0625f8e596f52718128f2db3bed28505
SHA1 39dc0aef58989934d9d85c9ac8d83a018ad8e94f
SHA512 05d22290883f9b81d2f6a00e8c2d3049e51884345573a99b61dca123bbe029418d55a98bd1510e14c4ff94da523daa2423a48652be5a84545c4aab975dd04574
SSDEEP 192:ut1m+xasuheOwQxMGsNgiQtC+kRbErQmiU1fTBB8BVRNwOm9Om3l9UiKSRAqXM7x:cmZcIhsNgiZbWN9B2VRNwOqp9UiZKl
TLSH
T1C7726D716D345C379EF7A545F98B3A178EF89127E6C82F9485EC6B0C02E659C130BC29
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 ec42f832131d1059541a762758a3198c43b256ca7b4475d60572d1c6256a0d26
MD5 dfe20fbf6dc58af38dc8b49975e6a08e
SHA1 c11450e777d22f4a32378053be4318a04f5a332d
SHA512 707e6aad38ccf2a5ac7a9f339d0db61007485409cbff094d62b896bbdf852e262c12bb298b5f9963c8243277646a9489350c7929ad1b55b2f37b324446502670
SSDEEP 384:00iFiZcIqzsNg8TUNTUlIliZbWNcB2VRNwOqp9UiQKl:0PFQi1wg9cBUHwOS9UiQKl
TLSH
T107B219F218D7883AD9AE5747A77E2D138EBCC063F5846A50B3985A0CCD961BFD306C15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9efae2fed10c5efef6e4d20f8ee2afa7005df675b3a78791d96303b944fbed1d
MD5 402e15839ec4194b8b09675f0ec13ade
SHA1 d1ef777072e129578be10dc2392ce9b805d630a1
SHA512 df53cafe208eb7f482afced78165f10a8d14eb90f6e1370d1c235fa4f71e443a81c056df50fb21b3e1066ee58e56c6d2c1cf71e99af23605f12fbf2914eaba1c
SSDEEP 192:tONA6JkRtQmiUy6mW+RNwOm9OmGh3cRMU6:tONA6UrcW+RNwOq6jU6
TLSH
T14902F9347C382C7B9EF2AD49F98B27175FA8202BA9952F84DAD81B1C01D765C2347C36
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 bdd8d207dd8ed0a3de0ddbcdbfdbb50d7cefb6f0f33bc67331c941f2db21da3a
MD5 777def80fd2da5fb529d84fe8057f8f0
SHA1 dadd81dd4e808c319cd43b0bdc76888be847dce2
SHA512 b97e008e2f68f3b410fe2a5a2dd042ad6ca3e43fd89e81d592264e652582e90bf6e987f715c3649ba62fce4f475aa83de520f65a52782ddd86da4c502f95dfe4
SSDEEP 192:O3ONB6JkRdQmiUyrCmQ+RNwOm9Om3l9UiSVcAqXMU6:O3ONB6UbEPQ+RNwOqp9Ui1KU6
TLSH
T16A122B317C385C775EE2A945F54B36178EA85127EA896F90D5DC2F1C02DF69C230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 01854e0e312d95e3473a578ee1135c68436084af0b9fb0b89cbe0907f08ce196
MD5 5e3f0962a45194f0b52a52e10dc78190
SHA1 7cb1754b3a01a213eed743e99e4534b8941f544d
SHA512 f82e53d0ebd8ff656a3addb75f2572c11c5430c6d71b84a244e3e67d7fe7cc93bc4714e907054815f34a9aabcaa5956cd49d150db11091a03529d7194c765b55
TLSH
T1DFE002015300005AE054433001835F202FA5C010129243474730156C2C313007E10980
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 7720246f5429c583846fdd417650e682789ef1d76a257452e8f4576aee7f4864
MD5 7b02b0d478ceb93039dab72a30afb6f1
SHA1 86ad67141613ace184de2b4b05da538e43a0f214
SHA512 dab8b17acb5543a89361a4c9be951209c88f404928124436870b372f1c2361454b7933479ea5a7ad080b96442361a77d246d759b5e69bf1717dbfe208c3acfd4
TLSH
T1ADE00202A30440AEE178433001D35F303F96C020119543474B30195C3C713007F109D0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5863e5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5863e5.TMP
Size 392B
SHA256 a8f719c4a645bca6077ee0e1e13bae2c8be97b4326880dfae4c9d1f801fdd9f5
MD5 e6b40b381ca5f3ae9eb47e611e970981
SHA1 c4df14eeae5afe5886bb8cf24f28a6a38f56854a
SHA512 5fe2a5293731298948072c1a2964a869110f1aa71f0fe2dfe133b6d38d8f6271eb5938285d076ae3d872db3b2aa69894119be5693bdba3d80f555275ba4f1c17
MD5 SHA1 SHA512

Submit Download

deeaf5dc-b745-492e-a786-0b7ad36a9d4e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\deeaf5dc-b745-492e-a786-0b7ad36a9d4e.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 364178f11623c546157a3eea43cdb809937718cbd08b737ac40852add4859669
MD5 07995e6e35c86766d2e186335b4da197
SHA1 efdc21864c41d2d28061b930397a8bec0f53b62d
SHA512 3797fe731f70a529d31f050d2549c8196733c9ad5ef1775ba53b54c5cd738e983181617336b74a63e59e50f61ff17286cf9941b16d7abae44690b4882bd07993
TLSH
T19F41F858B6F91148B3776E5AAFF6A86D847A78372F47C45E00110D8F0B23A41C871737
MD5 SHA1 SHA512 TLSH

Submit Download