hxxp://google[.]com

Analysis

user interaction
yes
max time kernel
140s
max time network
144s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
05/08/2026, 16:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://google.com
Sample260805-vcdqpscm81

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2836	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134304222543466908"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4045429996-2364296335-1634900306-1000\{4C25C568-70C3-470B-9218-BDC3782CDB82}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
544	msedge.exe
544	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe
1564	msedge.exe

Suspicious use of WriteProcessMemory 49 IoCs

description	pid	Process	procid_target
PID 1564 wrote to memory of 4592	1564	msedge.exe	82
PID 1564 wrote to memory of 4124	1564	msedge.exe	84
PID 1564 wrote to memory of 2836	1564	msedge.exe	83
PID 1564 wrote to memory of 4124	1564	msedge.exe	84
PID 1564 wrote to memory of 4124	1564	msedge.exe	84
PID 1564 wrote to memory of 4584	1564	msedge.exe	85
PID 1564 wrote to memory of 4584	1564	msedge.exe	85
PID 1564 wrote to memory of 6008	1564	msedge.exe	86
PID 1564 wrote to memory of 6008	1564	msedge.exe	86
PID 1564 wrote to memory of 6008	1564	msedge.exe	86
PID 1564 wrote to memory of 4948	1564	msedge.exe	87
PID 1564 wrote to memory of 4948	1564	msedge.exe	87
PID 1564 wrote to memory of 4948	1564	msedge.exe	87
PID 1564 wrote to memory of 2084	1564	msedge.exe	91
PID 1564 wrote to memory of 2084	1564	msedge.exe	91
PID 1564 wrote to memory of 2084	1564	msedge.exe	91
PID 1564 wrote to memory of 3832	1564	msedge.exe	92
PID 1564 wrote to memory of 3116	1564	msedge.exe	93
PID 1564 wrote to memory of 3832	1564	msedge.exe	92
PID 1564 wrote to memory of 3116	1564	msedge.exe	93
PID 1564 wrote to memory of 3044	1564	msedge.exe	95
PID 1564 wrote to memory of 5324	1564	msedge.exe	107
PID 1564 wrote to memory of 3648	1564	msedge.exe	108
PID 1564 wrote to memory of 3820	1564	msedge.exe	109
PID 1564 wrote to memory of 4504	1564	msedge.exe	110
PID 1564 wrote to memory of 4504	1564	msedge.exe	110
PID 1564 wrote to memory of 3000	1564	msedge.exe	111
PID 1564 wrote to memory of 3000	1564	msedge.exe	111
PID 1564 wrote to memory of 2728	1564	msedge.exe	112
PID 1564 wrote to memory of 2728	1564	msedge.exe	112
PID 1564 wrote to memory of 2728	1564	msedge.exe	112
PID 1564 wrote to memory of 3252	1564	msedge.exe	113
PID 1564 wrote to memory of 3252	1564	msedge.exe	113
PID 1564 wrote to memory of 3252	1564	msedge.exe	113
PID 1564 wrote to memory of 1304	1564	msedge.exe	114
PID 1564 wrote to memory of 1304	1564	msedge.exe	114
PID 1564 wrote to memory of 1304	1564	msedge.exe	114
PID 1564 wrote to memory of 1412	1564	msedge.exe	115
PID 1564 wrote to memory of 1412	1564	msedge.exe	115
PID 1564 wrote to memory of 1412	1564	msedge.exe	115
PID 1564 wrote to memory of 5868	1564	msedge.exe	116
PID 1564 wrote to memory of 5868	1564	msedge.exe	116
PID 1564 wrote to memory of 5868	1564	msedge.exe	116
PID 1564 wrote to memory of 1924	1564	msedge.exe	117
PID 1564 wrote to memory of 1924	1564	msedge.exe	117
PID 1564 wrote to memory of 1924	1564	msedge.exe	117
PID 1564 wrote to memory of 5908	1564	msedge.exe	118
PID 1564 wrote to memory of 5908	1564	msedge.exe	118
PID 1564 wrote to memory of 544	1564	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://google.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffe6f16c188,0x7ffe6f16c194,0x7ffe6f16c1a0
  2⤵
  PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1960,i,18031208747243014116,5540745041287746264,524288 --field-trial-handle=3052,i,4696879133782778639,4095601301793190031,262144 --variations-seed-version --mojo-platform-channel-handle=3100 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1780,i,14793387008206192515,6050836233272876919,262144 --field-trial-handle=3052,i,4696879133782778639,4095601301793190031,262144 --variations-seed-version --mojo-platform-channel-handle=3040 /prefetch:2
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2360,i,8523985051827739180,8385467299187489509,524288 --field-trial-handle=3052,i,4696879133782778639,4095601301793190031,262144 --variations-seed-version --mojo-platform-channel-handle=3000 /prefetch:8
  2⤵
  PID:4584
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3412,i,17114769927109787270,17847508742649633178,2097152 --field-trial-handle=3052,i,4696879133782778639,4095601301793190031,262144 --variations-seed-version --mojo-platform-channel-handle=3428 /prefetch:1
  2⤵
  PID:6008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3420,i,11579370317974930680,11363212567451450891,2097152 --field-trial-handle=3052,i,4696879133782778639,4095601301793190031,262144 --variations-seed-version --mojo-platform-channel-handle=3452 /prefetch:1
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4944,i,968056018970493872,2177484488208378219,2097152 --field-trial-handle=3052,i,4696879133782778639,4095601301793190031,262144 --variations-seed-version --mojo-platform-channel-handle=4980 /prefetch:1
  2⤵
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3500,i,13327955780616349328,3037105083114716007,524288 --field-trial-handle=3052,i,4696879133782778639,4095601301793190031,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:8
  2⤵
  PID:3832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3416,i,1308604283850165321,9718713495897784286,524288 --field-trial-handle=3052,i,4696879133782778639,4095601301793190031,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:3116
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5728,i,10808852186062641598,13941861591915021611,524288 --field-trial-handle=3052,i,4696879133782778639,4095601301793190031,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:8
  2⤵
  PID:3636
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5728,i,10808852186062641598,13941861591915021611,524288 --field-trial-handle=3052,i,4696879133782778639,4095601301793190031,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:8
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,4835137611299694017,18362240266614798830,524288 --field-trial-handle=3052,i,4696879133782778639,4095601301793190031,262144 --variations-seed-version --mojo-platform-channel-handle=136 /prefetch:8
  2⤵
  PID:5324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5792,i,9248822061957563549,13001948095997727389,524288 --field-trial-handle=3052,i,4696879133782778639,4095601301793190031,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:8
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5780,i,4282812355137915089,16632758901976283141,524288 --field-trial-handle=3052,i,4696879133782778639,4095601301793190031,262144 --variations-seed-version --mojo-platform-channel-handle=6040 /prefetch:8
  2⤵
  PID:3820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5184,i,4744338191376475692,6759856805346944521,524288 --field-trial-handle=3052,i,4696879133782778639,4095601301793190031,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:8
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5696,i,9967306891800957641,4458822326453385826,524288 --field-trial-handle=3052,i,4696879133782778639,4095601301793190031,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:8
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6348,i,10805434769766703332,11666079413422032336,2097152 --field-trial-handle=3052,i,4696879133782778639,4095601301793190031,262144 --variations-seed-version --mojo-platform-channel-handle=6364 /prefetch:1
  2⤵
  PID:2728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6380,i,11249439983860753465,13596295314509819605,2097152 --field-trial-handle=3052,i,4696879133782778639,4095601301793190031,262144 --variations-seed-version --mojo-platform-channel-handle=6448 /prefetch:1
  2⤵
  PID:3252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4944,i,11998800963753798132,5723558991405005713,2097152 --field-trial-handle=3052,i,4696879133782778639,4095601301793190031,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:1
  2⤵
  PID:1304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6540,i,7721556420078553572,11594469965706670372,2097152 --field-trial-handle=3052,i,4696879133782778639,4095601301793190031,262144 --variations-seed-version --mojo-platform-channel-handle=6544 /prefetch:1
  2⤵
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=6632,i,14669528592449528733,13840976431609586465,2097152 --field-trial-handle=3052,i,4696879133782778639,4095601301793190031,262144 --variations-seed-version --mojo-platform-channel-handle=6636 /prefetch:1
  2⤵
  PID:5868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=4976,i,17584002942218960445,7036731675499497189,2097152 --field-trial-handle=3052,i,4696879133782778639,4095601301793190031,262144 --variations-seed-version --mojo-platform-channel-handle=5020 /prefetch:1
  2⤵
  PID:1924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6324,i,715692677889354813,1645357239021715915,524288 --field-trial-handle=3052,i,4696879133782778639,4095601301793190031,262144 --variations-seed-version --mojo-platform-channel-handle=6308 /prefetch:8
  2⤵
  PID:5908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3976,i,4141591075961696147,5228537033268428264,262144 --field-trial-handle=3052,i,4696879133782778639,4095601301793190031,262144 --variations-seed-version --mojo-platform-channel-handle=6644 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:544

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1332

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fc69248227d1b80ff41106426895bcd599abcddfbfe7fdbeabc0fcc2aca903ae
MD5 be6741080fa256162cf6b0264133ca7c
SHA1 4914334b0edd1e4c3a470920450bdee63ee2f5b6
SHA512 8d42ac6412ff316aaa68e317e92c2167dbcac331381aec8d8be8410c5bfab4657127a0601dfc90f771660e393667d62af5e917155d6fcc5c7aa6a8ca1e03f903
TLSH
T149D08037394D7015E35D5175A463C7152B664C611497DF01F166CA7CD9B61C462C71C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 44e095af7ccad1927602b4b935aae3524939df30218011b877b59c782e6c6106
MD5 3c1bf221dd0438f719ae47a265c3e436
SHA1 b382689171539f473d331bdcef3739b0fa0b1062
SHA512 b7f8bf66ea12f9b37e5f8d1af222c106c1dfa377331d2153d9380edcc3af7381e9c3490378c0b160e05f5c4fd2e1590d5cb8ed07cdeb7b74fb7b38b0e8e1e57f
TLSH
T18ED080333D4D7015E35D5175A463C7153B7648611497DF01F166CA7CD9F61C466C71C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 fc9d1de7a412cf50086fef04391b642db195c34aae6957b2ab98cb0e6f3e2acc
MD5 8d52b25196540f9410fd9ec11ca368cb
SHA1 ea84fd058c4bf46750c14b46020fce72717654fa
SHA512 611af807751b278806f9618f7f01d2a733a6b2c232a201bf438da470bfe0442ab505d6bec910fee3a874f6c910adcd8ec13e2b7a4b3748214aca3f4850dfaac9
TLSH
T112E022E9CD31EC3708FD0B1851A10B4AE785139B2B814D9F3B3C920D8FB1637428682C
MD5 SHA1 SHA512 TLSH

Submit Download

f_000093

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000093
Size 29KB
SHA256 1008502584478605e2e85ef161a7eead29024600fa6b308591143d7f067fe7c0
MD5 f969cac8b08129b39506bd531e7bab8d
SHA1 1e2648f941be58ec3b676de9429271e776995e4e
SHA512 78f1935c6410e915c4857b6b0f4833fb8c25d5ebf7b37bf2cfaf921c29642a840198138787546fa182356a47a60c4bb1213f562a81682fe988b295e31639036a
SSDEEP 768:j6iyu2hDfD/LR0kScc410sUuXQqa2UOUtXxSSVltCThSj:Hy/FL7U410IX1aP1VME
TLSH
T16CD2E11C14A8D17925EEF0DBDA216F05B3AD22B573F811293B4CD26C9DFEE90BC85119
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000098

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000098
Size 32KB
SHA256 ad18ee055f6097b937831552b9bdccd5f1c974d1e188ce83c9d302f35a6e7240
MD5 0c9147805225eb217f274f951ab59c25
SHA1 d6a4af39d772f43699ed7b54839009d8bf3b5224
SHA512 1de91340076d83eca20ac40a2c921b6a4e7ef71bd339693931aab58fa431dbbc939a4fc8e0950abe039406b1678d2023a00b4735fa6ad2687a9d5e3f685c9812
SSDEEP 768:KUx8cd5skhctbADF9Ec9xh7PX4OhKK9G63CzIoCZTgEiGN7:Ke5bhctbixrdW6SzcZTg1e7
TLSH
T116E2F164667B4322C4D1AB78AD0D54B08B35CBA2CCB0CAAB61FA4B1C99D14D3D8ED224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 0fcca27c5da8c974c5293d636e5a6e90b059d9ac04de7c0e4b6fa41f57384ee9
MD5 6c08a340819836fa7be73cab0cd9def6
SHA1 dc05c8c90fcb67088f008586075aa4f33351120f
SHA512 edef203e5cf02984ea0d27423dd2bed0fcde6d55a89474a7ecd0ad4a96ae08a69c58d0d8bf6c2348e16db5d7ce712bf719528d8137ad12b9b4ee491705028edc
TLSH
T1BE71199A030275AFE36D42B095E102F275B395CABEE3CD493314A9B5330EFAF4857924
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 29bdd7c0c6464bc3ced4fc17f1469a6ac48262e41844faae0efe587fb7379b57
MD5 5275b66852ec6bc3197a5dac048e981c
SHA1 ff0453050cca172de960da887a063adbb4f72bdf
SHA512 dcc380f43fe9f30fb353a7b6e790729cd19352746d0bf88161794ece9aabbbabb5c1716c16640a375538904fc9496383eacae6d65917d4a9d0995fa3abe5feee
SSDEEP 96:T/z0h6O9HFvJx5Y8waS+sEb6wnMF0D937Ua1M:7AhhJxS8wCsmt8M93Ya1M
TLSH
T1E5B1914E0AA1319BDB69427849A129F635B355D47AE3CB4E730829BF331FF9F4847810
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58439c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58439c.TMP
Size 3KB
SHA256 66927eee30abbcd3169e3347c0c13f01db135b303ae970b3cd4594a5b33628ee
MD5 94652619e72d0e36043b84a0a3ef8fc3
SHA1 8a2f4c94d5e2dd24f5c006d188ee1af401c5ab5e
SHA512 434e12dc633701cd502dff7cd1990f70a9465cfe6cdc6c8d329c6189f01fd46eee89b5a8f6a400869108cba3891d8cc0f8968a33f1a0cc5471207d5ee5103be1
TLSH
T16E61609A0302749FE35D027095E102F074B385C5BDD3CD41332469B5330EF6F4857920
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 11KB
SHA256 baae01ebba2e9ad9557424349a98b7489f799c8461240eb6d29c58667c371d3f
MD5 e53d226d10ed723fc7170117abc1f7b5
SHA1 b439940b44732e39c4b106c21a4b311328d7faf3
SHA512 64046d3e236b9a8e40c22c93cc47a3eab1a07364dc56c5d8f495b57275982d13da623cb6543c7327f15f87261841a7c72b9624033ec936862feefadf6deb25a6
SSDEEP 192:D1FNS4/Q8EWB7LxJThe+eCTnAYaaij6eGwuypbNt41eG+RkxsNx/xM8TxVRxHHcf:D1FNS4/Q8EWB7LxJThe+eCTnAYaaiGe6
TLSH
T1A6425DE7C7E4D62DCC5296F4A715AE2FCE190914932C3C2AC9D99F9B93E2470E10178E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 9f0bf90c577e4c27d8ed1ce75e9fba934b30807c4673ff7730408cc99191caf7
MD5 7ccee53eb5e4be98c6e7975d24287777
SHA1 8ec3f0185aeafefdaa8608d8fbf7694c83f8e250
SHA512 4e2b7ec14c2329a542afb6fb668ae21a146c53e8f4d9025b85739fc57fc8d92641e6d9daaccdfcc948ced3ad49732e16dfb023351794e2f2864c3dec7cd41990
SSDEEP 48:YALlgyDPNEOhHhshuhBh2afo7gmgj6AsGrsh1zEsYu0EsLcsVBsoFsTVC7wEsJla:D1mONS4/Maaij6eGzsu0npb2GwNE
TLSH
T140819CF7C3E9812DC94156F4AB15AF1FCE2E0624432C3D6A88D8AF5B93E2471E10565E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 16KB
SHA256 b1fea8a9571b9db24664949c761065392c46dc40558fc30d4daeda6407bab140
MD5 0a7389b77474cdad353771943403b1a2
SHA1 7c60626c3535130aeb32cf322983bd1902920dbf
SHA512 2bbb8cacf6236e54095ad358cb7bbb5094fbc2d632d8f7b4bfedd9262b98bb6c09eae0b0047b15f2152a17c710712e0191d24e3c7cd0f35e62ecb402335e9949
SSDEEP 192:sxZJRwyMqZjK1Ml8UQIkK/f/sk8YZZyazodpoL/XXHHo6+WNrTbJ+dTXYBhuk1Gb:sxZJtqrK/f/sk8mZgqHRF8XgNUtV
TLSH
T1DA72E7166A345E77CCDBD219FA45BB63D6F95162D1904E58A9FC8E1C00E7AEC320382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 4ecf4f399905dbbecfabc4ecf0b41476a27323db7dbff6dad326b23e1105d2f1
MD5 6eb8d6b7967cd10ff475393945c550ef
SHA1 fca80c6c23270327085e63ab2a03881c715b3202
SHA512 6f516221d719d3bf04a148debc22d1bfa68eb86ca9653366408d3541bdde53f1f0dee80f9d500d464ab3b3ec3bfbc92e27fe86300922a6e0a2a19a4099e5d89e
SSDEEP 192:sxZJRwyMqZjK1Ml8MkK/f/skxYZZyzzodpoFXHW6+WNrvE/YBOu01GaIgjtjJ:sxZJtMK/f/skxmZ9+HbA/JNjtV
TLSH
T1CD62E8166A385E77CCDBD209FA45BB53D2F95573D2904E4899FC8A0C00E7AEC221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 4a5db2156eb4fef5daa5096bff3f90657bd3e3f7e4afca552041515b3bb00ef9
MD5 d8fc0d9ea27f21fb344721ee644926d8
SHA1 13d74fb1b76636436ea648ef0842d2db1c86ea2f
SHA512 6e20274faa19d10d87a4ce06ab63f89516038cb2f97b7aac380d044960e3c29640ac920260a09b885f4ab19ece0927ab3c06e980b145b56014170d5af7d4cccd
SSDEEP 768:P4E/aX6WvCuFO8F1+UoAYDCx9Tuqh0VfUC9xbog/OVDVLlFX6BaroVNm5Pa:P4E/aX6WvCuFOu1jayVLfqBRVMha
TLSH
T18FD20A3B280CCB7E4F844E9CEC266F976DD801C796988D5447EA884C03CB7EE511A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

1126fc489bba84fe_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\1126fc489bba84fe_0
Size 191KB
SHA256 ed185083ae75243dd9dffe92176c3ee92ee63f13b36d4c9b1dd2a32eb8983214
MD5 7a9142b2e206165a71614ec92a252dd1
SHA1 f62fc75c3ebac68f392e7deea320c669dd6e5da2
SHA512 60f1ffaf7b1e064172863d4690659108d71e2584d2330ce5ff821d8eda6a07d8bbd80664a01d3ea1b0677951749e847e55071687437e499758db1e3c348f9408
SSDEEP 1536:Uo/ANGJTtVk4iGmUBDznBChn/jSIClB/wCULnq2W3670mRovNarJUuB6sIncU8XO:pSXUVzB2SICY10HobVIP8XrjvyPP5
TLSH
T1BC146B715200F47BB913DE60A67E7F4E3C39A16BDD0686FCA5D4E870AAD2DF20521B48
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 96B
SHA256 5e61134068e893591dd8b618dc4aab63b802a3ce01a0f5e4fbfff472ba87371b
MD5 4d5e93ea23836689bd5e5037cbc0da1f
SHA1 80f92dd48275c0a0cc82a1bced79de64b095a142
SHA512 a2d3125b1339e51ad595b3e12fd1c4f4d508b2f94b91298d02089a1d17c9d09921b76c72cf846d5d37614755e083b19d28232519b6b627b3fea03ecd02294a6d
TLSH
T1BBB0240C13400C03DC40137011C1D005F1300D41F517C10F50D004F0F41134F074F150
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 54fc28b06e261f4be52c96ee0d2feaab761e202e20cf15b12679ce07f091a0cf
MD5 51ff39c6279d786b35c1e33d78d488d1
SHA1 928f1f944c9d12ff2ce802d5266209f866c221ce
SHA512 1f1ac8752daac2d97e3d705e2c34ae607ef2d3fc59e3b8c266dc13ed990dd1ae77b7a0c180b528512d07ae5bc1546d7bc0f907ec162f03a52f18596cc4664321
SSDEEP 192:OotE42aG3iLEAs1AOvQA7uItfg1MhlfznKzO5tZBBHaFlufF5XYP7cNBv3dR5LA9:8ptDYDcfvNR1ANAJ/XnW
TLSH
T10BB25816713B065238BF250CA69399368E4231A33418E4EF7BB914A61F67E225DFDCCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 4a0779380dfd13f47879da35d992a34c53501c885412efa6863110d1c5a4a161
MD5 d1cee8790f5f11b64568aede232e1936
SHA1 dbef42408d7c8cf1e93042a6413945daecbd1897
SHA512 e4234fce9f69ccd2e7867b3173297ef637e9d6af7be6a22ff77fdf667fbeebf9a90ee93c1f76ca719356f740ef142055e74690567a2f346d91f9780526390cb5
SSDEEP 384:n5iFiZcIE3sNz8TUNTUlI4kYDcYXHJJBfpGR/vMsXKIBlfBeRs9JKgqijUUhOGSI:QFQE30wgsNLGJvZffTjKgqmUUhOGb
TLSH
T1DCD25B31E8A4DABBEDEA9EC5A74A3A07DEF04163D6CC9AD4E6DC6D0D008719D030BC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 28KB
SHA256 fcd621e441d3344d533dad5e44fa7ff07c19715dfc492b49b17a0c74f68ca053
MD5 231681ad9aa70068530811cdf6b8550a
SHA1 b47cc63965a90ab6725418324ccb6f05eb8e37bf
SHA512 09129a6d94f32f1719022a35bc63b1e85488b80dbb27c239b56bd6b55d77198709a367c020cdf083a63a7b109be94c5e8d96dbda7373d093f1bdf4f48945574d
SSDEEP 384:njiFiZcIE3sNz8TUNTUlI4kYDcYkHJJBfpGR/vMsXKIBlfBeRs9JKgqijUUhOGSI:OFQE30wgsILGJvZffTjKgqmUUhOGb
TLSH
T124D25B31E8A4DABBEDEA9EC5A74A3A07DEF04163D6CC9AD4E6DC6D0C008719D030BC15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 666715c2629caeee953a7a333ff7943fde091e26555772c7b8b4cf3fd426bde7
MD5 6bfdf8b678b3e73a02f6c28cec393720
SHA1 5954845bcd588d248280c0299dfe667244f7623a
SHA512 dbd28900145abe08cc597298ddaad5a3207adba41304ee79a8218047e395c5abfb32e52b29877df1f2eeca4af46589d11efa5ea4979fa980173e80e7f56e6410
SSDEEP 384:npiF9CcmyWCs3sNMt8TUNTUlImkrDcYhx9JBfpGR/vMz6hkP+lFYS/QfIHy/7Igp:AFccps3twgxtfGJv86hkoFYS/wiy
TLSH
T161B25B35ECA8CABBEDE64FD9E74E7A13DEE0016385885AD4EAD81D0D00C719D134BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 ac1c33be02d767313373dad30370dbe0bc9cc99cabcfb6c87258eb9ac242c822
MD5 06daf38f76da1ea7b0c01a427b8dfbbd
SHA1 8e0ffda6d270632063fd1eef49f5a60607c4f92a
SHA512 72ac42ccd07d3656129b0d8ca5a6fc33453180e954d4bfd664b3f9e5b184bfc89f286384e388c6f0e77a19a93c8a23b01fa38668eef365e31045ec1216433575
SSDEEP 384:ndiF9CcmyWCs3sN38TUNTUlImkrDcYlSaJBfpGR/vMsXKIBWfhkP+lFYS/QfIHyL:UFccps3EwgxOYGJvZofhkoFYS/wiy
TLSH
T1F9C24B36E894CABBEDE64BD9A74E3A43DEE04163C68C9AD4DADC1D1C00DB19D434BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 33KB
SHA256 89b3e9bff9fa440838cd0faef91a4041a84fbd51d771489974483095de023478
MD5 88b0748388f868194e028e614b78497a
SHA1 d538658c6c72770a4771bf69179f890b50efc8b0
SHA512 3bec156d1184650db13d8b3b93d1e68cb22771176b1bd286b947a8264e16173bff990faf142d704247492a6cd803b766c437eb4c3a4220f0413345379b13529f
SSDEEP 384:nRiFiZcIz+3sNz8TUNTUlI4kYDcYk3JJBfpGR/vMsXKIBhfBeRs9JKgqijUUhOGb:4FQC30wgscLGJvZ/fTjKgqmUUhOGb
TLSH
T1D1F2C4F198D789B7E9AE5B87637D2E0299FCC113B5885A94B7D81D0CCC861BFC30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 2661a57cbec141fb57531095db7e71afcc0023f8292f7d63fbb04541397ce8c4
MD5 c1e57f3c9c0276fbc8e79d88434be57b
SHA1 bc2c9de4126773bad31b5af1a4c8f3ad24a4fd05
SHA512 352f9ecbd70a25edad6de0ed79f91fbd1849b13571c481e7feb74883ffd29e2a2e770a5e6bf63cb59d819a391bbdbff81506cf0da42ab7266b0979dfeab697c8
TLSH
T1B541165DA6F91148B3776E16ABF7A86D447EB8762F0795AE00010E4F0A23B41C9B1B37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/3044-248-0x000002470E3E0000-0x000002470F3E0000-memory.dmp

Download