d311a4f486e2f81d1ffb11b37782d8bc1325b1df96ff21ab3b3de818ae3d5d84

Analysis

user interaction
yes
max time kernel
1048s
max time network
727s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
05/08/2026, 19:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
LwBuBf.html
Size 11KB
Sample260805-xpmv9aem21
SHA256 d311a4f486e2f81d1ffb11b37782d8bc1325b1df96ff21ab3b3de818ae3d5d84
MD5 c229b9d23420402bdea979bae2d31dde
SHA1 cf5cb6cd0c16a3cd252c792a13907df48fa2f0d4
SHA512 bdabdc88c2c5f8c1b6e4730801ad263d8f0172f9cbc19d80de98acaec7d06218f830366b5c10a63cf589de17ed23dd3b84542ab2183f93fe383f9fa3bd6f6fb8
SSDEEP 192:zMilLhIJhKYX5kerCNRupjQ4vYJkTcOHsU:zNOJhda4s4vYJk4OF
TLSH
T1BF32764A1EF280E701E785A97DF2FD0DAD85864BD219FC4832BC80A90FD7D468DC7995
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
520	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134304301186512136"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{10B8EE05-5163-4504-B2DD-F69858C49E3A}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4100	msedge.exe
4100	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe
3320	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 3320 wrote to memory of 2912	3320	msedge.exe	86
PID 3320 wrote to memory of 520	3320	msedge.exe	88
PID 3320 wrote to memory of 1824	3320	msedge.exe	89
PID 3320 wrote to memory of 1824	3320	msedge.exe	89
PID 3320 wrote to memory of 1824	3320	msedge.exe	89
PID 3320 wrote to memory of 3744	3320	msedge.exe	90
PID 3320 wrote to memory of 3744	3320	msedge.exe	90
PID 3320 wrote to memory of 4652	3320	msedge.exe	91
PID 3320 wrote to memory of 2352	3320	msedge.exe	92
PID 3320 wrote to memory of 4652	3320	msedge.exe	91
PID 3320 wrote to memory of 4652	3320	msedge.exe	91
PID 3320 wrote to memory of 2352	3320	msedge.exe	92
PID 3320 wrote to memory of 2352	3320	msedge.exe	92
PID 3320 wrote to memory of 4276	3320	msedge.exe	93
PID 3320 wrote to memory of 3332	3320	msedge.exe	94
PID 3320 wrote to memory of 4276	3320	msedge.exe	93
PID 3320 wrote to memory of 4276	3320	msedge.exe	93
PID 3320 wrote to memory of 3332	3320	msedge.exe	94
PID 3320 wrote to memory of 3332	3320	msedge.exe	94
PID 3320 wrote to memory of 5016	3320	msedge.exe	99
PID 3320 wrote to memory of 5016	3320	msedge.exe	99
PID 3320 wrote to memory of 1564	3320	msedge.exe	100
PID 3320 wrote to memory of 1564	3320	msedge.exe	100
PID 3320 wrote to memory of 4144	3320	msedge.exe	102
PID 3320 wrote to memory of 1004	3320	msedge.exe	114
PID 3320 wrote to memory of 2096	3320	msedge.exe	115
PID 3320 wrote to memory of 948	3320	msedge.exe	116
PID 3320 wrote to memory of 1436	3320	msedge.exe	117
PID 3320 wrote to memory of 1436	3320	msedge.exe	117
PID 3320 wrote to memory of 824	3320	msedge.exe	118
PID 3320 wrote to memory of 824	3320	msedge.exe	118
PID 3320 wrote to memory of 4100	3320	msedge.exe	121
PID 3320 wrote to memory of 5116	3320	msedge.exe	122
PID 3320 wrote to memory of 596	3320	msedge.exe	123
PID 3320 wrote to memory of 5116	3320	msedge.exe	122
PID 3320 wrote to memory of 596	3320	msedge.exe	123
PID 3320 wrote to memory of 3552	3320	msedge.exe	124
PID 3320 wrote to memory of 3552	3320	msedge.exe	124
PID 3320 wrote to memory of 3656	3320	msedge.exe	127
PID 3320 wrote to memory of 3656	3320	msedge.exe	127
PID 3320 wrote to memory of 4396	3320	msedge.exe	128
PID 3320 wrote to memory of 4396	3320	msedge.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\LwBuBf.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffcaaaac188,0x7ffcaaaac194,0x7ffcaaaac1a0
  2⤵
  PID:2912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1900,i,344509341985788288,5163725941631075613,524288 --field-trial-handle=2860,i,15809030701211914150,4614930902110717155,262144 --variations-seed-version --mojo-platform-channel-handle=2904 /prefetch:3
  2⤵
  - System Time Discovery
  PID:520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1776,i,6726211487322689673,2275083567698905464,262144 --field-trial-handle=2860,i,15809030701211914150,4614930902110717155,262144 --variations-seed-version --mojo-platform-channel-handle=2856 /prefetch:2
  2⤵
  PID:1824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2240,i,2819769168001552248,5167977967064459718,524288 --field-trial-handle=2860,i,15809030701211914150,4614930902110717155,262144 --variations-seed-version --mojo-platform-channel-handle=2912 /prefetch:8
  2⤵
  PID:3744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,2781150649350418299,15680969964606258548,2097152 --field-trial-handle=2860,i,15809030701211914150,4614930902110717155,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:4652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,2569645032380962075,17709086545443228561,2097152 --field-trial-handle=2860,i,15809030701211914150,4614930902110717155,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4136,i,10690755211415880024,700869689657227798,2097152 --field-trial-handle=2860,i,15809030701211914150,4614930902110717155,262144 --variations-seed-version --mojo-platform-channel-handle=4168 /prefetch:1
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4148,i,11854551395601731178,3874196399820686860,2097152 --field-trial-handle=2860,i,15809030701211914150,4614930902110717155,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:2
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3604,i,10166760407817403850,915248469690369997,524288 --field-trial-handle=2860,i,15809030701211914150,4614930902110717155,262144 --variations-seed-version --mojo-platform-channel-handle=5144 /prefetch:8
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3672,i,3654337041416867772,14537444200837614974,524288 --field-trial-handle=2860,i,15809030701211914150,4614930902110717155,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,10959581703057214696,17243716018301423899,524288 --field-trial-handle=2860,i,15809030701211914150,4614930902110717155,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,10959581703057214696,17243716018301423899,524288 --field-trial-handle=2860,i,15809030701211914150,4614930902110717155,262144 --variations-seed-version --mojo-platform-channel-handle=5904 /prefetch:8
  2⤵
  PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4536,i,11809483728969896582,11588952464784926587,524288 --field-trial-handle=2860,i,15809030701211914150,4614930902110717155,262144 --variations-seed-version --mojo-platform-channel-handle=4156 /prefetch:8
  2⤵
  PID:1004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5104,i,15469856883872025053,14775144636370746595,524288 --field-trial-handle=2860,i,15809030701211914150,4614930902110717155,262144 --variations-seed-version --mojo-platform-channel-handle=4512 /prefetch:8
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4160,i,6176135015694084513,12941809149323199841,524288 --field-trial-handle=2860,i,15809030701211914150,4614930902110717155,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2412,i,14314507120016215979,17926054360877685298,524288 --field-trial-handle=2860,i,15809030701211914150,4614930902110717155,262144 --variations-seed-version --mojo-platform-channel-handle=2024 /prefetch:8
  2⤵
  PID:1436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5212,i,7205611039656543358,10594421809786071031,524288 --field-trial-handle=2860,i,15809030701211914150,4614930902110717155,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:8
  2⤵
  PID:824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6184,i,5891995091659490056,6863784961034916868,262144 --field-trial-handle=2860,i,15809030701211914150,4614930902110717155,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3996,i,11615227743532918852,12977839544526620439,524288 --field-trial-handle=2860,i,15809030701211914150,4614930902110717155,262144 --variations-seed-version --mojo-platform-channel-handle=3768 /prefetch:8
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5460,i,1880328782860097611,12563383265735027316,524288 --field-trial-handle=2860,i,15809030701211914150,4614930902110717155,262144 --variations-seed-version --mojo-platform-channel-handle=756 /prefetch:8
  2⤵
  PID:596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6196,i,2008149600013410239,13260707784735525975,524288 --field-trial-handle=2860,i,15809030701211914150,4614930902110717155,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:8
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4000,i,15923660235040366623,12342665263233438141,524288 --field-trial-handle=2860,i,15809030701211914150,4614930902110717155,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:8
  2⤵
  PID:3656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6564,i,14082720121140440198,14373910718988816585,524288 --field-trial-handle=2860,i,15809030701211914150,4614930902110717155,262144 --variations-seed-version --mojo-platform-channel-handle=6572 /prefetch:8
  2⤵
  PID:4396

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2692

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 537B
SHA256 ea0c550fd4f5d0c07cbf05bb698b94b64058837be91e13d45cf44dbb3a16ceb0
MD5 e79cefd26cfebbede8e77b01aadf178e
SHA1 6089fb652886b1937509f13eabc3b12aa4e059ea
SHA512 fd7f87c1d692d7e1ec6a72652e293fa89526c5afc20d705f6205adad1f17ea19ae9284a870b9e761bdc8116a99326ad0809ca8ae90f42db8ac31651f9b5fce93
TLSH
T195F0508546C4C37E9E02618793AC638D81E0774BDFD8EE0A37084D8574010D4F5D2EF9
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 537B
SHA256 fee386bb7dae031233adbbb81927f844c8ee5fa048c9046e2d83a01b40b6b0e4
MD5 b93d5e4350a943ca28246eb3b74bfde8
SHA1 dd470ad443073a6c85e1bae01c3243911c1638cc
SHA512 24d44f3b5035172011e4d3e929fa4fc110a653aef3314b7f9e079b08ba17d98b7216855c04874866209b2561d44eeefc9554432ab488479a191103b848d4a881
TLSH
T13EF0F6D545C4C32EDB206187566C634D51E0B71ADBC8A92DA704AA847803480E5D2AF5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 541B
SHA256 143f90464fe7c882426677b249452e8ab6292ff4ed8a37930930e95449cfc3ba
MD5 e4aa692d9886e6bd546dfdba8dfd88bd
SHA1 71156cea61ac6812b20652fff6c08f41f9611e5f
SHA512 3ed9328e1565d0bc1c39238d4ed21acc882228361ee2591c16ecebe8666f1734dd033467caf572095abafb9fd0df3b2274f498e839324811373457dcadfd8b6c
TLSH
T192F0599445CDC36FAB2161C7526C538CC5E0371EEBC8E95E67088A84740E1A4F2E2EF5
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 7e2788e07f7bd265dcc335eb9cd442e4e77befdaa346992f07b0a1c7d9db7969
MD5 1ffe0344623591e2daa26ef58e0f1eba
SHA1 eed26e6cafe3fb95439f6b43dcb0bb09668b1f44
SHA512 27b9a5588fcfb0b76074036c5d292a777f5f85b4541265008aeab0f53689762ceff768ff981207e29bb2598088b9910d8fe788c340f413c82d217d5da1082faa
TLSH
T11261E7BD0592EDF6E3D13A3190C03A8738F190E8FD63FD5D01E348B5640AB114A6A4CD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588b91.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe588b91.TMP
Size 3KB
SHA256 9b3c14a17948106efc4fd6a737baf3860148143d7bf93f314585742e2dd46bea
MD5 2530ccc1308d9db2d67c7c9191084074
SHA1 dab6a080be2673367b6d40783ddc52bea96eb1e2
SHA512 1a0b4d9933860b6e7bf345275204e760036fcfd4faa7f72f2fe0695b50917d3b6e8e07b1c960f38ed5fd523afdda3f426e8d76b1c654079c2d9eb7a1acf34746
TLSH
T10461C3BE0582EDF6E3D13A3190C03A8738F190E8F823BD5E01E348B5640AB114A6A8CD
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 db71e97d61d1a668836d51331c207a89761cd968e7fdb7428898e4f7ae28ead7
MD5 aa35db32be9213a56a32dd97812ec7aa
SHA1 57530ef9e63c80d58014a3db550711ece1e185b6
SHA512 eb5ef4ec4c296cdfcb55bc57141bddc84fdbd229b558415c7632f96023fad4b398ad4feb4c865f4c671dc9f038b84b4f033a1f4915e17b45df5a4339fff99572
TLSH
T111117DF3C3D585AE890156F05A24EE1BDE2D0606421C7C1585D4FF2793F3075E10255F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 966B
SHA256 4eec9f1cff9a63a8cc9e07292be861a9d2f71840d062652283110b0704dd0445
MD5 496f0cd58c7668956e8ca6229a07dd41
SHA1 bdd3495283a1002120d3cae05926854145953171
SHA512 a457ca9cde7b9ee3dfb080144c38b8256fec781af1fa5720dd6cdd97880f5d94adae88c7c47c3a83d1b81466326b594991212fba7f71ca8f50bb160704d5e4ac
TLSH
T184119BF383E5855EC91116F05A28EE2BCE2C0506821C7C6989D4FF67C3E3035E102A9B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 f42c0758084114fca3e046a3cd1578a446f40f84b67a262a8b8d30797301d05e
MD5 cacf47a7357f383b53882b2978769f98
SHA1 9d1df6b83c3f27b516800bdb4f6c95c6282ae242
SHA512 45262b8425b774ad4f7434447fc212a555606ed5b19f85d6c79656d770c2a74f89e14d06de970312e6ea7488791e33fd16ebea32ef1d4f606ee6a676f0470e19
SSDEEP 192:sxZyRwyM/jK1Ml8Mkl/fds7gm1Idpd4HW6+WNGY9IKrmgIgrJ:sxZyKMl/fds7gJSHbGu9
TLSH
T1AA42E801AB3469B7CCCBD209FA557F53D6F9057392940E58AAFCDA0C00E6AEC221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 f660cbe8c7cfa4819e77db4dc781435ecbf9e54920806a0892e603d45dc150ef
MD5 1310d80553f8a1e68d137c73616e7d36
SHA1 296f6ebb72ab4f62afb430c1ac397a9b59560032
SHA512 89271ff95b6122acda817406a3dc51f8282f350b77cbbf6998bbd3de233fe3e80dd44310b1f002739c712c7210e7fd1790a23878b4c335fa05544a705735cf24
SSDEEP 192:sxZyRwyM/jK1Ml8UQ9kl/fdstbm1IdpH4HW6+WNGY9InCmgIg5MJ:sxZyKqWl/fdstbJYHbGke
TLSH
T18052F912AA3459B7CCCBD209FA517F53E6F5057392900E58AAFCDA0C01E6AEC221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 ef040336150051ed5584d69260c3904b8f44131acf39ec27cb86f15f89912025
MD5 79c116b6c79c817b4418f22edc4e7122
SHA1 caad2a5cf5dc3c41e81547f00f3ba68089d43094
SHA512 d635b8ca44ae43cb6889bd511b05278417135a645bd38d538e6c99848056c66fe07ae414ac91da26a0255b3a56c8c5e446028da55a0b50a15eda924acea2b9b0
SSDEEP 768:bMcv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWNMroxg6V:bMcv21wWvu+Z+u1jaeFLeRNXxl
TLSH
T15CD20B2B280CCB7E4F841E9CED2A6F966DD801CB57988D5447FA884C03C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\3de769c1-1a74-4f2a-8383-bb3211a296d8\index-dir\the-real-index
Size 600B
SHA256 4a125d6d1b8313583b9369d6af0340585a668759add4b42527dcdd51533d5502
MD5 8824838d204055e124d4d2746a8d6b47
SHA1 7708771ea6a32b41b7ab353ea43889e01ade0ca4
SHA512 88d0bae05cdb7a2b11578ee19284572f6a423926a61e7ebfd30e30c8bc5c308eb3977425dc1c1923b431a6babbe2f81205f0e356de99275c390976de8496e159
TLSH
T1E7F02B288EE28E1BE85102372AF6A0F8B1700FECA321C433942C02A57E06308288A1DC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5cd1bf.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\3de769c1-1a74-4f2a-8383-bb3211a296d8\index-dir\the-real-index~RFe5cd1bf.TMP
Size 624B
SHA256 3ed240f6ff5530308ac55de7acb33bfbb1d9ffd8c2b28648ef3bcc6d0b090419
MD5 db2ef1429dbb7091a90721048d6db121
SHA1 48972b4e1398e4d3ea408e5bc812795131ada96f
SHA512 6200fbd6aaa5bbb889f6bf9ead78ea294a1bed1849f7043002ae36843614d45c7339a14fb512e8aba15db2cd0f96f8f8db6418d26798fbb24f6836a883202c12
TLSH
T1ABF02327CBD18D91E444153B2DF990BCF3200C005322F1B3502C552E5C367CC0A020CC
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 c4c1f36f9c5d11fca9e47371eaabf44086ae74522b0934699a55ccf59501486e
MD5 9757d2877a747fb52b7d650eb498af7f
SHA1 ecf5954587cb41883063b5105d022ef036d9e325
SHA512 e318a56a4e83f86351898946c6499c87a0758ab1c4d24d995985d091925949de1b32214c0347e4dae15e6987cf1777fda2e48daecd1a08340858470d918aaa89
TLSH
T17BE068F61FE719A0AD3F97DA1C7191A404427A5C8D00FC4F102A61CB20B17123069CA5
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 944d68f4591322f87634c4153511ec75760604c757896d169877e8dc4c2394c5
MD5 a950ccd82c8c5fcb193884f4c2d320c8
SHA1 15283b8ecbe9bd122e4868a3be7e3075151045ab
SHA512 2dab71edbeb1943d1d17b50f9405f62f07971e29964586dca7ccb56407b199125a32e993a18e919b3d4391a3c0b612dca6830eae91a35807ea41a2199f88f6ee
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDCygKTyaaEAK1y2+6:mTfHHrb
TLSH
T170916112317F02D2397E294CA7B685265F4230A67418E57F7BB900920B6BE226CFCCDC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4d6cfac1-1098-4dd7-9d5a-0a37ff6bfb93.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\4d6cfac1-1098-4dd7-9d5a-0a37ff6bfb93.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 37059170c3b283a80f29747b3cbfb8b207e377c707eef7a2956d6a5971bb9870
MD5 2eae12cd02f16fed4e2c9bcf657eb936
SHA1 553f9b6aaa105d69d826d0657f88b3875f19c311
SHA512 d91cd8470aeab02e84bfb4479ac6df248d358252e7ff4c27948daf2d4933337e07bfc17de080645702c6438e72da77f18f90ab6f423e5537a8d52b1b40b35f2a
SSDEEP 384:lZcIhsN65QYziarze+CXOmep3JrOUsBeRs9JKgqijUzU:dhYk7SvO9p3hOUsTjKgqmUzU
TLSH
T148929D3158385DBA9EEBA581F48736139FF89127E6C52F90D1EC7F0C02CB69C230A916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 b4e43f0d7389159b715c444c667b173ba706d3a08b718545d93eeb7db51ca899
MD5 ece1a9665c931703c9b66e5f6efbb96f
SHA1 55dbf3233f1c4bbcfecda00e6b088905b9fb30c0
SHA512 b4dc90dcc2c65de498a334fc97789557c1a9c97206b951869ce72b77cd3b1fac1196cf3866905eedeecc78ba7ebe906793e8b17130424580684a00085d9abfd8
SSDEEP 384:+iFiZcIUUzsNC8TUNTUlIlyQYziarze+CXOmep3JrjUsBeRs9JKgqijUzU:VFQdXwgZk7SvO9p3hjUsTjKgqmUzU
TLSH
T14CA28D325864897BEEFBAA80F54A32138FF44167D6C56FA0E2DC6E0C019B59C230AD15
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 488a4d863956178d31693499a991f81c1ae33e7d2f15efbb4c2b6a06564a1da5
MD5 c2600e207bc877a9ae91c0bfcc226145
SHA1 c13972e254bbc823c953be20ea52d62d648ee1c5
SHA512 5de1956e35c02857d78869e86e513273544b6d80596083e69c8cf21e68d7f652edf26d1dfc5382cf2ee643220f8c83585c830c7a1887fce68e591368ea539639
SSDEEP 384:IZcIhsN6yQYziarze+CXOmep3JrOUsBeRs9JKgqijUzU:2hhk7SvO9p3hOUsTjKgqmUzU
TLSH
T1A9929E3158385D7A9EEBA581F48736139FF89127D6C52F94D1EC7F0D02CBA5C230A916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3e1f754e71773c574cc2da405c31146757bff0cdf970fe29c7f0b9bb8f6e6b52
MD5 de3f85a8959e4e8d42356b3361794596
SHA1 1dab66c487b33274d472fced20b1405320a1703b
SHA512 f25eb861487971fd727e4e8832b73cea277426d122f0ce972b9ba542109741a5b4c2d2ace98aea67139ac1be999ed49baf20e9e5b58a413995df7571d351279f
SSDEEP 192:DONxV6v+YLWQmiUyBphh+CG6Om9opwSJrHWCHUbqvU6:DONj6vz+Ahh+CXOmep3Jr3UsU6
TLSH
T132122B3579385C7B5EE3A991F48736139EA85167DA8A3F80D5DC3E1C02EF75C230A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a4e98bfda917a1b9fc3033a4ff5bee716f7a1f2faef19371be8fc84fcb77b72c
MD5 ba5c2924e7bbee6ae94f76c78c830661
SHA1 10539e7da689f991d29d8a970d4a0675c5b21825
SHA512 14acf644c90165e7c8f5a4041e69fb7c041125f4ac695955b7ff71278a19b6e886cf59b87b8c31320dac73e72b9fc08260d18a8881688ff92291df48f9dbe668
SSDEEP 192:JONO6v+YLNQmiUyapZh+CG6Om9oEusVlU6:JONO6vz/9Zh+CXOme6fU6
TLSH
T16802FA35BD281CBB9FF25E45F58737275FA8217BE9952F80D9E82E0C01D765C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

907af596-512f-4747-8413-3742f324ae60.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\907af596-512f-4747-8413-3742f324ae60.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 07e26978feed838e8327820f0b49ad0870a403ddc45b88ec2f75881dcc5c11f5
MD5 4b73121263580e2ff18c41c330f52676
SHA1 c6f7adce5805845e68664f6a63a2c8a518cd1bac
SHA512 e0f610c33f0abf081499aa0de1d3254156c1a30d83dabbf5a0bfe4bd478c9b8c630c01792dec2ae4e6f6bef18f1485a1f359e04d15d3508c365b5b5443c4e398
TLSH
T1CF41F8986AFA1148B3B76F5AABF7986D447FBC371F06D46D10110D4E0B62A04C972737
MD5 SHA1 SHA512 TLSH

Submit Download