hxxp://url2794[.]kapara[.]co[.]uk/ls/click?upn=u001[.]S7KutztvREgirT3SKT7oi7OS1hpUmpOJiSEhVwH6hpEmYtTaxgPJyWrCdG0QOqBNgZZpl-2FUZZklJg3-2FsVd9e1t148zX4ajhuzUbmABFHy8LRyiZKKZpQH3zRS63UhEsXd4Ofz5vAxVtfMHLiYVGzwTcbsInjqck-2FHr2hSvkiaMfsqdAPfYKQecqw-2Bt61JKXnHG90thy-2B-2BybGDNMI1WJRH75mBCvgXyI-2Bhdjz-2FaQwczPuF-2BNK0oAxMItDLbMLi6g4r7q-2BjPryUUAzcxjuZ8S-2BXwMtZ8WcmUCnN8CWzP-2FJJQN88fWTvtXBjDvsO-2Bm53sJ-2Bqt7jlB4awEe9zn6N-2F9JFihFH0jdW1M6UDk719seNa2OS6NXwKEPdYZe0zXPxByLnVD6mshHCYXpnlWgtxQy8waNIv1yz9wv1I-2BjtLD2L1DQbmejQgYcIv1rRLKxZwmPqy8EKOnXhs7oUzBjnXozSkf-2Fk4LXX2f5pLQQKTPiiUDTNXUqzXq4AogHXusjIZ0gy6v6obL-2BtKwZeUEEx3YvEDzhmRqukbwkdtggtu2ktUXUFUMRL0UIU-2BBQil3M3SZwXFQbt3c-2FybXT8hppU-2FqfM5A-3D-3DoNlA_lMBxMQPeETDiXD1A-2BwSyG8zy1Gc5kAPIaABf9TV2SUitE-2BLMSyrWU-2FP9hUetftGa6z7dphVkZPUZcEueuWcChyUEa1h4WQSyA0Ut6JIndG-2FiCbYGRnFQcNEOSCuLUsHUKWs8Fte5lT5pViNaZ-2FItxRMnxL6YUMJVejPnVEHByunImCanwMbukhU2thFkQz1HJef1Ib0HW9PVW5PHZ0sUgQ-3D-3D

Analysis

user interaction
yes
max time kernel
149s
max time network
132s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
06/08/2026, 02:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://url2794.kapara.co.uk/ls/click?upn=u001.S7KutztvREgirT3SKT7oi7OS1hpUmpOJiSEhVwH6hpEmYtTaxgPJyWrCdG0QOqBNgZZpl-2FUZZklJg3-2FsVd9e1t148zX4ajhuzUbmABFHy8LRyiZKKZpQH3zRS63UhEsXd4Ofz5vAxVtfMHLiYVGzwTcbsInjqck-2FHr2hSvkiaMfsqdAPfYKQecqw-2Bt61JKXnHG90thy-2B-2BybGDNMI1WJRH75mBCvgXyI-2Bhdjz-2FaQwczPuF-2BNK0oAxMItDLbMLi6g4r7q-2BjPryUUAzcxjuZ8S-2BXwMtZ8WcmUCnN8CWzP-2FJJQN88fWTvtXBjDvsO-2Bm53sJ-2Bqt7jlB4awEe9zn6N-2F9JFihFH0jdW1M6UDk719seNa2OS6NXwKEPdYZe0zXPxByLnVD6mshHCYXpnlWgtxQy8waNIv1yz9wv1I-2BjtLD2L1DQbmejQgYcIv1rRLKxZwmPqy8EKOnXhs7oUzBjnXozSkf-2Fk4LXX2f5pLQQKTPiiUDTNXUqzXq4AogHXusjIZ0gy6v6obL-2BtKwZeUEEx3YvEDzhmRqukbwkdtggtu2ktUXUFUMRL0UIU-2BBQil3M3SZwXFQbt3c-2FybXT8hppU-2FqfM5A-3D-3DoNlA_lMBxMQPeETDiXD1A-2BwSyG8zy1Gc5kAPIaABf9TV2SUitE-2BLMSyrWU-2FP9hUetftGa6z7dphVkZPUZcEueuWcChyUEa1h4WQSyA0Ut6JIndG-2FiCbYGRnFQcNEOSCuLUsHUKWs8Fte5lT5pViNaZ-2FItxRMnxL6YUMJVejPnVEHByunImCanwMbukhU2thFkQz1HJef1Ib0HW9PVW5PHZ0sUgQ-3D-3D
Sample260806-dadjgsxtcs

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4688	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134304580922099821"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2409539145-3342400454-2096821238-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2409539145-3342400454-2096821238-1000\{D5D16599-3380-4830-B0E5-89E027807102}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1232	msedge.exe
1232	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe
5224	msedge.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 5224 wrote to memory of 5232	5224	msedge.exe	80
PID 5224 wrote to memory of 4688	5224	msedge.exe	81
PID 5224 wrote to memory of 4032	5224	msedge.exe	83
PID 5224 wrote to memory of 4032	5224	msedge.exe	83
PID 5224 wrote to memory of 3344	5224	msedge.exe	82
PID 5224 wrote to memory of 3344	5224	msedge.exe	82
PID 5224 wrote to memory of 3344	5224	msedge.exe	82
PID 5224 wrote to memory of 3988	5224	msedge.exe	84
PID 5224 wrote to memory of 3988	5224	msedge.exe	84
PID 5224 wrote to memory of 3988	5224	msedge.exe	84
PID 5224 wrote to memory of 1632	5224	msedge.exe	85
PID 5224 wrote to memory of 1632	5224	msedge.exe	85
PID 5224 wrote to memory of 1632	5224	msedge.exe	85
PID 5224 wrote to memory of 4640	5224	msedge.exe	87
PID 5224 wrote to memory of 4640	5224	msedge.exe	87
PID 5224 wrote to memory of 4640	5224	msedge.exe	87
PID 5224 wrote to memory of 2528	5224	msedge.exe	88
PID 5224 wrote to memory of 968	5224	msedge.exe	89
PID 5224 wrote to memory of 1160	5224	msedge.exe	90
PID 5224 wrote to memory of 2528	5224	msedge.exe	88
PID 5224 wrote to memory of 2528	5224	msedge.exe	88
PID 5224 wrote to memory of 968	5224	msedge.exe	89
PID 5224 wrote to memory of 968	5224	msedge.exe	89
PID 5224 wrote to memory of 1160	5224	msedge.exe	90
PID 5224 wrote to memory of 1160	5224	msedge.exe	90
PID 5224 wrote to memory of 5896	5224	msedge.exe	93
PID 5224 wrote to memory of 5888	5224	msedge.exe	94
PID 5224 wrote to memory of 5896	5224	msedge.exe	93
PID 5224 wrote to memory of 5888	5224	msedge.exe	94
PID 5224 wrote to memory of 4656	5224	msedge.exe	96
PID 5224 wrote to memory of 3444	5224	msedge.exe	97
PID 3444 wrote to memory of 5044	3444	msedge.exe	98
PID 5224 wrote to memory of 5692	5224	msedge.exe	99
PID 5224 wrote to memory of 5692	5224	msedge.exe	99
PID 5224 wrote to memory of 5692	5224	msedge.exe	99
PID 5224 wrote to memory of 5796	5224	msedge.exe	100
PID 5224 wrote to memory of 5796	5224	msedge.exe	100
PID 5224 wrote to memory of 5796	5224	msedge.exe	100
PID 5224 wrote to memory of 5160	5224	msedge.exe	101
PID 5224 wrote to memory of 948	5224	msedge.exe	102
PID 5224 wrote to memory of 5176	5224	msedge.exe	103
PID 5224 wrote to memory of 5500	5224	msedge.exe	104
PID 5224 wrote to memory of 5500	5224	msedge.exe	104
PID 5224 wrote to memory of 1232	5224	msedge.exe	106

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://url2794.kapara.co.uk/ls/click?upn=u001.S7KutztvREgirT3SKT7oi7OS1hpUmpOJiSEhVwH6hpEmYtTaxgPJyWrCdG0QOqBNgZZpl-2FUZZklJg3-2FsVd9e1t148zX4ajhuzUbmABFHy8LRyiZKKZpQH3zRS63UhEsXd4Ofz5vAxVtfMHLiYVGzwTcbsInjqck-2FHr2hSvkiaMfsqdAPfYKQecqw-2Bt61JKXnHG90thy-2B-2BybGDNMI1WJRH75mBCvgXyI-2Bhdjz-2FaQwczPuF-2BNK0oAxMItDLbMLi6g4r7q-2BjPryUUAzcxjuZ8S-2BXwMtZ8WcmUCnN8CWzP-2FJJQN88fWTvtXBjDvsO-2Bm53sJ-2Bqt7jlB4awEe9zn6N-2F9JFihFH0jdW1M6UDk719seNa2OS6NXwKEPdYZe0zXPxByLnVD6mshHCYXpnlWgtxQy8waNIv1yz9wv1I-2BjtLD2L1DQbmejQgYcIv1rRLKxZwmPqy8EKOnXhs7oUzBjnXozSkf-2Fk4LXX2f5pLQQKTPiiUDTNXUqzXq4AogHXusjIZ0gy6v6obL-2BtKwZeUEEx3YvEDzhmRqukbwkdtggtu2ktUXUFUMRL0UIU-2BBQil3M3SZwXFQbt3c-2FybXT8hppU-2FqfM5A-3D-3DoNlA_lMBxMQPeETDiXD1A-2BwSyG8zy1Gc5kAPIaABf9TV2SUitE-2BLMSyrWU-2FP9hUetftGa6z7dphVkZPUZcEueuWcChyUEa1h4WQSyA0Ut6JIndG-2FiCbYGRnFQcNEOSCuLUsHUKWs8Fte5lT5pViNaZ-2FItxRMnxL6YUMJVejPnVEHByunImCanwMbukhU2thFkQz1HJef1Ib0HW9PVW5PHZ0sUgQ-3D-3D
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5224
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2b4,0x7ffd098cc188,0x7ffd098cc194,0x7ffd098cc1a0
  2⤵
  PID:5232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1816,i,14500263580935464961,11631708913420495664,524288 --field-trial-handle=2016,i,1642474829204820920,10695869579795255591,262144 --variations-seed-version --mojo-platform-channel-handle=2044 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1512,i,9425962769253643630,2507675359385675755,262144 --field-trial-handle=2016,i,1642474829204820920,10695869579795255591,262144 --variations-seed-version --mojo-platform-channel-handle=2012 /prefetch:2
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2408,i,10632122692073232062,3366131346397486531,524288 --field-trial-handle=2016,i,1642474829204820920,10695869579795255591,262144 --variations-seed-version --mojo-platform-channel-handle=2412 /prefetch:13
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,7771315980174134312,2918520586171558361,2097152 --field-trial-handle=2016,i,1642474829204820920,10695869579795255591,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:1
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,15557823131869573922,1696307152658792606,2097152 --field-trial-handle=2016,i,1642474829204820920,10695869579795255591,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4220,i,17704143358200275545,10520610798751589994,2097152 --field-trial-handle=2016,i,1642474829204820920,10695869579795255591,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:1
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4232,i,18164871975029355921,16075161546808273536,2097152 --field-trial-handle=2016,i,1642474829204820920,10695869579795255591,262144 --variations-seed-version --mojo-platform-channel-handle=4376 /prefetch:9
  2⤵
  PID:2528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4248,i,7060436600221036643,15341889175860296844,2097152 --field-trial-handle=2016,i,1642474829204820920,10695869579795255591,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:1
  2⤵
  PID:968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=4260,i,4511551958800453383,4260601099862606642,2097152 --field-trial-handle=2016,i,1642474829204820920,10695869579795255591,262144 --variations-seed-version --mojo-platform-channel-handle=4384 /prefetch:9
  2⤵
  PID:1160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3472,i,1727220860024755063,5302579198503280430,524288 --field-trial-handle=2016,i,1642474829204820920,10695869579795255591,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:14
  2⤵
  PID:5896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3468,i,2355517059880749138,4849217498097756941,524288 --field-trial-handle=2016,i,1642474829204820920,10695869579795255591,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:14
  2⤵
  PID:5888
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,14759858550532572730,10564002674177473640,524288 --field-trial-handle=2016,i,1642474829204820920,10695869579795255591,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:14
  2⤵
  PID:6004
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,14759858550532572730,10564002674177473640,524288 --field-trial-handle=2016,i,1642474829204820920,10695869579795255591,262144 --variations-seed-version --mojo-platform-channel-handle=5960 /prefetch:14
  2⤵
  PID:4656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.ProfileImport --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6212,i,12894042047093331403,286516905993004043,524288 --field-trial-handle=2016,i,1642474829204820920,10695869579795255591,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:14
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3444
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\cookie_exporter.exe
    cookie_exporter.exe --cookie-json=1104
    3⤵
    PID:5044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4380,i,16577492096172818192,6084277868356050530,2097152 --field-trial-handle=2016,i,1642474829204820920,10695869579795255591,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:1
  2⤵
  PID:5692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4572,i,15303111125006867078,4235263657343565094,2097152 --field-trial-handle=2016,i,1642474829204820920,10695869579795255591,262144 --variations-seed-version --mojo-platform-channel-handle=4560 /prefetch:1
  2⤵
  PID:5796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4344,i,5221566011652305244,9944626510752044096,524288 --field-trial-handle=2016,i,1642474829204820920,10695869579795255591,262144 --variations-seed-version --mojo-platform-channel-handle=4372 /prefetch:14
  2⤵
  PID:5160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4652,i,13950372888413278679,13577996572760912664,524288 --field-trial-handle=2016,i,1642474829204820920,10695869579795255591,262144 --variations-seed-version --mojo-platform-channel-handle=4684 /prefetch:14
  2⤵
  PID:948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4700,i,16180585040915982479,10969962659279409590,524288 --field-trial-handle=2016,i,1642474829204820920,10695869579795255591,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:14
  2⤵
  PID:5176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3652,i,11752931697353853921,822393423625604097,524288 --field-trial-handle=2016,i,1642474829204820920,10695869579795255591,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:14
  2⤵
  PID:5500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.22000.1 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5088,i,666500479313971976,688022762341932226,262144 --field-trial-handle=2016,i,1642474829204820920,10695869579795255591,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1232

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4436

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

490307f3-396d-4327-971c-ff368927637e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\490307f3-396d-4327-971c-ff368927637e.tmp
Size 105KB
SHA256 6ac1610274f1a1fe7efb487499493de9e02abb0353ede585200d27e7d566ceb2
MD5 9aafd3c6a631d23d2fc5d16d5786b9fd
SHA1 10c1e74766f4f28594e9176e3314d0468398b076
SHA512 ef9b3fe910d4bf60d05f218e85bed9b85b78b05fbdbf92c9c4ca899b3f0468f7fedaaaa159758ab5ed7e1b6e7be9bbf9c3bfa7b175e3267150fc3e925ed76223
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7S:fwUQC5VwBIiElEd2K57P7S
TLSH
T182B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0b5dc1bf65a27f8ea20844919d7db192caf7a54fd791434a1304a7df2e9b496f
MD5 5de7bfd3f869f48e7255b6bdc532c4bc
SHA1 c26027eb70bc9887bf69c2b22be60226b685dbae
SHA512 0e6af8c455f57dc816a2c01366f46a0d069e8f41cccb1f7565e2afd873b71ffd5f135649fb4bf44d1a15a9efd68dc59696dc74a971b3483ec9d87a4323b2b4f2
TLSH
T112D08032FB5D6052E7455230D893DF10276644A12C974B41E325C84CD5B80D493C3282
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e3c932e879f8a7071362a654b47cd73c05f90d7fe66be785d811b84b86743e1b
MD5 8c92d931ed33c3d779a020ae7e111fb4
SHA1 de123f6d92bf24747affe820aaa8be3785388fae
SHA512 5be895d6a61eacf4f3117293636fb4890abbe186ddcbfbb3c8d3aa0fd1aa59519bbdd86e552732d2ded27aae5be1ffb0d6d9f6ccaac824d1b13ed03a12a438dc
TLSH
T13BD08032BB9D6452E7455230D893DF10276644A12C978B42E325C84CD5B90D493C3282
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 2b8f195b75419339acade49926ea45505258df0cfa6e820eb316f847c3678d34
MD5 893237b5e27fd20b2fc374c2a4a9640f
SHA1 525e254575cef32b71f07972bd87b95cca2ce061
SHA512 0dc2e75005bfdb07c2dad5e37b596f5d4ea8296c52c950f12bab186abd7cdf4e34ee0bb0eb41c771677f7741ea65dbd17d16d28505f9eb4d21b5a9f17099b9cf
TLSH
T1D3712C2C04615093DF792D72A4D216CAB0B181A7C9030E152F48BBB5971A72EDD667F9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 201fccf44afe2a5cba0c047300deae9f9e096ac67c8a36830301a8fb0671b1e7
MD5 fceb0751722d544913b9099097027128
SHA1 7336fd1b423d87fb844516e0cd5cb4ae6dcc42f4
SHA512 ccff1d9acb7b27a7a2615d02eab6b9c74be5bb0edd70168de2954a6fb533c43e01a0a1c38ffd1209eb454d0c2ba119b70d7a70da6319554bac0e246f68f4afaf
TLSH
T1A5811C1D14A150A3DF791D7256C21AC6B0B280B7C9031E161F68BFB1D71A75ECDA23E9
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5881be.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5881be.TMP
Size 3KB
SHA256 a2ac739539e026aed86be511c90b60e46583923e896fcc79f322e2b359248dd9
MD5 6904b3c2cf0a786c2f29025757f51d53
SHA1 8b3a71a105dc4a6ce9c9bea07047f27569a2e910
SHA512 c5352d216ff3017b01d7c5a2e115d2491aa741a9b1985eda30845b0d52300ee58072f780da86d1dc256704531b22f19dfb411089e474f7331769224bcd79e44b
TLSH
T1E5713D2C04625093DF7A2D73A4D216CAB0B181A7C9030E152F88BBB5971A72EDD767FD
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 f5d01c18b7bdc45bac6c21dfb1e0da261a5ee94a8d1d201f918a0b701cd7c386
MD5 ae5838599dab75ae5fff4e20cd3177c0
SHA1 a20efc9736bb43b3bea017fafef370aa46563e94
SHA512 4ae9dab36aa8f49f869dfd14de3e79a108bbeb5522912afffdf67a251fcd50537e36280e5dfc857c031ef7b39c31533ccf3ef3cc2285500a0ae8944657fec573
TLSH
T1265148F7C2E4866DC90152F0AA18AE27CE2D0568436D7C25C8D8EF5F93F2161F64264F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 8a4fe7536625f165f6e28dea59efe9129466fa2e1fb8599f39c12cc42a6e5b4b
MD5 c86fbd8f043f66bf45ac51117c688331
SHA1 8494644624ef9f79075a1010a2ba4441fa4d0295
SHA512 26828846e05d950c17977e9c127c3baf44e60ac933a0dbd0bab92235c5902b3f2a539f63613fe1a9dde25626c9d02f7a89e8e66c5519038cb5bb370962fcf9d1
SSDEEP 192:sxZM/yM/jK1Ml8UQRF9/flsSbVIdp0Y10n/DZt/6+WN//1TiW/Y0o4Fh+EIg58J:sxZM7qX9/flsSbmU/1t81/5rh2
TLSH
T1A062E616AA346D77CCDBD209F941BB53D2F9156292901E44EAFCDA1C00E6BED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 a867bd493fed66f9ea9795fbec67ccc4b52633a2d31b03c152869ec9cf6fb130
MD5 ddb27b1e3f5f9e7f48a682e93436ac4f
SHA1 76651d382c95aa5c2b69d3fa292409eb821b6773
SHA512 f6aaa53d0dd39b12e6babb208c3a1c97c422c18805b84c93b2b34c09f74eef7030589ae99f006072a6aa0a2b0ff2df3146dffa15663915b5857b668ecac7b7f9
SSDEEP 192:sxZM/yM/jK1Ml8MF9/flsU8TIdpM/DZt/6+WNGY0oEOe+EIgrJ:sxZM5d9/flsU8MM/1t8G5Dh9
TLSH
T149420802AA346977CCCBD209FA55BF43D6F91572A2901D44E9FCDA1C00E6AED2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 c5ba54521d11e6b6a2f97a3006f26593081c96ca9543c76c1dfe2f4605483a54
MD5 3a9f399662cf9680a9d334c3871ee4b4
SHA1 1fac6e0b8b2592dd91f5ea45e4d6a28894790ae5
SHA512 8b09f615d2f40c915b9e81aaa7c5f913f9a2b90196dbe5ab9273fe89daf6b7d5a0741d874191379b25f790fa738ad32cdc639b52bbdc522df635593068086d36
SSDEEP 192:sxZM/yM/jK1Ml8MF9/flsSbVIdpOY10n/DZt/6+WN//1TiW/Y0of2e+EIg58J:sxZM7d9/flsSbmC/1t81/5Yh2
TLSH
T15052F616AA346D77CCDBD209F941BB53D2F9156292901E44EAFCDA1C00E6BED2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 9f3560e65acb67af9da47eaadcae47bb3a2d6747aaf519ffa5f54812e84f6654
MD5 f38eed695497d012e7de9f294b70195b
SHA1 b30b1637f7289a23f5eae9dee7a412f1e35ac8bb
SHA512 04314023af79df798ab0bfcbee7052a098de2e00f976302e3a3edda9ad42fe75b65758089bb0b082ec75d170e346fcecba28d4e1cb1f9fd0d0e23a49506f29ea
SSDEEP 48:KgCI/K3qQ7yF5IpKK0EdpIFKq4w/yJAILKJ:KgCUK3q2u5mKK0CpuKq466AAKJ
TLSH
T154A1515532BA06113C7E690D95A8CE176A8333B73054F42B77A958A24E6BE202DFDCCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aee2fe8b-758e-485a-984f-05dfeb659ea1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\aee2fe8b-758e-485a-984f-05dfeb659ea1.tmp
Size 31KB
SHA256 1fa81f4a735300835515f925d0f9007dd18b627e7feefb167fa0991a71473ad5
MD5 3aaa89a12444b739893bbb9e04ca6b30
SHA1 0701976b09f7f7de7abd453b746c08a9e66b11a2
SHA512 a25a44507143545f28cb69b51ca7d3eabe19341b3fa7626dd916147f99be3a2a3e0850efaa096949e3f2f47962ccb9e5e03badf0322b7e82a243a1fd6a8c803a
SSDEEP 768:Lxc0s8Ww2YfWRm/JQg18F1+UoAYDCx9Tuqh0VfUC9xbog/OV3BOLl/TB0ONIroPt:Lxc0s8Ww2YfWRm/JQg1u1jaKBOLpTuOT
TLSH
T1C1E21B3B284CCB7E4F840E9DEC26AF966ED802CB66584D5447FE494C03C77EA521A49F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 c6b6e4fcbeeb0aa26c9cb50c97ce85fd38ab58cbd804898616a882085c4310e4
MD5 58a6e29b3add8df797a4520328fe77b0
SHA1 97480afbfef71f95a535217ed455de04c0f71a7b
SHA512 efb083187ab9145e5a4b9e189578360231c0d4fc42c9858f412fe22513c4efad4cec437dec822ee55486d90a0f4f0873fee0561d86cf9c03ee4b76ce0e71bf2e
SSDEEP 192:uTL8NWUUQ1aUC93HFQmiU11ya4JSufoPxzYh1oBvnFhnqBU8:C8NWUUxUgzWFUu8YhWBvHSU8
TLSH
T18E3239316868AC775DA396A1F14B36139FB4512BDA883F54D6EC6F1C01DF1EC630AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 faea50efbb6054d52a6d8008216f04f3c5df37010b508250d39835433d0a9fff
MD5 b12e7d52a126ff626b5643fd3b828947
SHA1 fa0cac27382ac3f43337e256844710ebbe9d6ca3
SHA512 c64eb253254e0c84fd7c887071bbd6c3109c88d832715232f983d0e240753271f1d0a647869c49e1bfb6379c0da93b5092884a291463a3fcf043f709aefb6795
SSDEEP 384:cZcIs8NWUFxUgzfFUu8YhWBvW7SnTKwBODNZOCPgp:Ks+diCsZW7SnewBKZOVp
TLSH
T1D7C217F018EB6836D99E5347A73E2E034E7CD127B5842A04B7E86B1CCC991BFD306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 27105ab17ef28685e4d2e6e460611f19848781a2a27e82b0e07dfdcde52bb7a1
MD5 adf12802a29e0a2d7f305f3051401281
SHA1 6e5ad46c52e8206ae5e2d1c1496cc7b692e7bb1b
SHA512 a5aa70e7d2d62c9c56b65716cbbf03bbf94650b463346a92f463d98c687c8b46225089a2b6450fe825b0db88ef63e489f60a7055ea3e6172385f95353fc740ec
SSDEEP 384:NZcIh8NWUFxUgzWFUu8YhWBvHSnTKwBODNZOCPgp:Vh+8iCsZHSnewBKZOVp
TLSH
T1F8929D716C3CAC775DE2A555F94632138FB8A167EAC43F54D6EDAF1C00AD598230BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 cfc16df2ffd8bda2d243308adc649d8c59bbc2f24da3763d7754c22963bb913c
MD5 c9d34651efd6ee5d88fbac1e691cdba7
SHA1 136a97c132aaeb8428d9c1b49fe7b8e85483a755
SHA512 c87bc943fbc99ca17b7cce7724e29e09e1608533fce9a525a062288cb52539b03e8da5e1663c4d7a53be04bc8cae1bacae7782e0ac1fe6055f75024c16c52b9d
SSDEEP 192:XGNf6jCQmiUy/I8f4SufoPxzYh1olSnxrEWU6:XGNf6q8jfju8YhWWpPU6
TLSH
T1AE02E935AC687C7B9EA3AE55F58737139FA4212BD9852F44DAF81F1C00D768C2346836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 455b698ecc501c45aad6f2e47291dd0ddcdc350f5b58ffaa9da525efce14dca5
MD5 f0603cd49f0cece2c133db0e195985d2
SHA1 53362e7acfcaa18c36cbc7400b7b3a4ffa0d989a
SHA512 c441267859f375c33999e128bf46a0591d23b378fe68f980fef1b0c302fb1b2ee348f3505d79f067816296a6dc296f3c903a7f098a10ae0ac513c1e40abf2437
SSDEEP 192:gGNU6jGQmiUyq834SufoPxzYh1oBvjOMnqBU6:gGNU62A3ju8YhWBv7SU6
TLSH
T138122A71A868BC3B5DA395A1F54736138F64522BDE853F40D6FC2F1C01EF59C630A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download