Overview
overview
8Static
static
509e1ce79-3...7e.eml
windows10-2004-x64
109e1ce79-3...7e.eml
windows11-ltsc_2024-x64
1attachment-3.eml
windows10-2004-x64
1attachment-3.eml
windows11-ltsc_2024-x64
8PLAY_Voice...65.svg
windows10-2004-x64
3PLAY_Voice...65.svg
windows11-ltsc_2024-x64
7PLAY_Voice...39.svg
windows10-2004-x64
3PLAY_Voice...39.svg
windows11-ltsc_2024-x64
7attachment-4.eml
windows10-2004-x64
1attachment-4.eml
windows11-ltsc_2024-x64
8PLAY_Voice...83.svg
windows10-2004-x64
3PLAY_Voice...83.svg
windows11-ltsc_2024-x64
7PLAY_Voice...03.svg
windows10-2004-x64
3PLAY_Voice...03.svg
windows11-ltsc_2024-x64
7attachment-5.eml
windows10-2004-x64
1attachment-5.eml
windows11-ltsc_2024-x64
8PLAY_Voice...18.svg
windows10-2004-x64
3PLAY_Voice...18.svg
windows11-ltsc_2024-x64
7PLAY_Voice...81.svg
windows10-2004-x64
3PLAY_Voice...81.svg
windows11-ltsc_2024-x64
7attachment-6.eml
windows10-2004-x64
1attachment-6.eml
windows11-ltsc_2024-x64
1email-html-2.html
windows10-2004-x64
3email-html-2.html
windows11-ltsc_2024-x64
3email-plain-1.txt
windows10-2004-x64
1email-plain-1.txt
windows11-ltsc_2024-x64
1image001.png
windows10-2004-x64
1image001.png
windows11-ltsc_2024-x64
1Analysis
- max time kernel
598s - max time network
536s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
06/08/2026, 09:48
Behavioral task
behavioral1
Sample
09e1ce79-3069-3aba-b463-22b50343337e.eml
Resource
win10v2004-20260513-en
Behavioral task
behavioral2
Sample
09e1ce79-3069-3aba-b463-22b50343337e.eml
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral3
Sample
attachment-3.eml
Resource
win10v2004-20260513-en
Behavioral task
behavioral4
Sample
attachment-3.eml
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral5
Sample
PLAY_Voice-+65-360-3928135865.svg
Resource
win10v2004-20260513-en
Behavioral task
behavioral6
Sample
PLAY_Voice-+65-360-3928135865.svg
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral7
Sample
PLAY_Voice-+65-360-9788480939.svg
Resource
win10v2004-20260513-en
Behavioral task
behavioral8
Sample
PLAY_Voice-+65-360-9788480939.svg
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral9
Sample
attachment-4.eml
Resource
win10v2004-20260513-en
Behavioral task
behavioral10
Sample
attachment-4.eml
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral11
Sample
PLAY_Voice-+65-360-2895206583.svg
Resource
win10v2004-20260513-en
Behavioral task
behavioral12
Sample
PLAY_Voice-+65-360-2895206583.svg
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral13
Sample
PLAY_Voice-+65-360-6835153703.svg
Resource
win10v2004-20260513-en
Behavioral task
behavioral14
Sample
PLAY_Voice-+65-360-6835153703.svg
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral15
Sample
attachment-5.eml
Resource
win10v2004-20260513-en
Behavioral task
behavioral16
Sample
attachment-5.eml
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral17
Sample
PLAY_Voice-+65-360-6062651018.svg
Resource
win10v2004-20260513-en
Behavioral task
behavioral18
Sample
PLAY_Voice-+65-360-6062651018.svg
Resource
win11ltsc2024-20260710-en
Behavioral task
behavioral19
Sample
PLAY_Voice-+65-360-8145634681.svg
Resource
win10v2004-20260513-en
Behavioral task
behavioral20
Sample
PLAY_Voice-+65-360-8145634681.svg
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral21
Sample
attachment-6.eml
Resource
win10v2004-20260513-en
Behavioral task
behavioral22
Sample
attachment-6.eml
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral23
Sample
email-html-2.html
Resource
win10v2004-20260513-en
Behavioral task
behavioral24
Sample
email-html-2.html
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral25
Sample
email-plain-1.txt
Resource
win10v2004-20260513-en
Behavioral task
behavioral26
Sample
email-plain-1.txt
Resource
win11ltsc2024-20260709-en
Behavioral task
behavioral27
Sample
image001.png
Resource
win10v2004-20260513-en
Behavioral task
behavioral28
Sample
image001.png
Resource
win11ltsc2024-20260709-en
General
- Target email-html-2.html
- Size 8KB
- Sample260806-ls2m2aybnb
- SHA256 5eacce0201fdad363cc361808aab4d5ae3a648a09a24aae3d14642277fa4048e
- MD5 911000d6d52bd6e3a33eec09d3acf84f
- SHA1 35c88394eebf6cba5412afd4a53189f79f1f2ce8
- SHA512 dfac4d7f611cd85f6eda57e3a180dbb7496ae7a31d9836310d5ff063c907f660671ed06e945c93f670a3dc7a92ff598310885cc8680865c866aa0cef0a4a0cbf
- SSDEEP 96:VuD1kmBK5ucMKRHNoOroTSKiSriSqiSriS9iSrKSziSniShiShiShOS9vHS1nxh2:EKRHuOY67G7zZxzllx8HmnL3+wq8cUOx
- TLSH T11D02E303D5240D4B65FB90F0A06B2B64C085C74ED3196AE4B39A63B3EDCA6766FC3349
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- System Time Discovery 1 TTPs 1 IoCs
Adversary may gather the system time and/or time zone settings from a local or remote system.
pid Process 4964 msedge.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier msedge.exe - Enumerates system info in registry 2 TTPs 3 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName msedge.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer msedge.exe - Modifies data under HKEY_USERS 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry msedge.exe Set value (int) \REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134304833329603235" msedge.exe - Modifies registry class 10 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ msedge.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902 msedge.exe Set value (str) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox" msedge.exe Set value (str) \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe" msedge.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children msedge.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage msedge.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children msedge.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ msedge.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{2401932B-6953-442C-A367-FA16BC259649} msedge.exe Key created \REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe msedge.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2712 msedge.exe 2712 msedge.exe - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs
pid Process 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe - Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe - Suspicious use of SendNotifyMessage 32 IoCs
pid Process 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe 2024 msedge.exe - Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 2024 wrote to memory of 400 2024 msedge.exe 85 PID 2024 wrote to memory of 4964 2024 msedge.exe 87 PID 2024 wrote to memory of 932 2024 msedge.exe 88 PID 2024 wrote to memory of 932 2024 msedge.exe 88 PID 2024 wrote to memory of 932 2024 msedge.exe 88 PID 2024 wrote to memory of 4640 2024 msedge.exe 89 PID 2024 wrote to memory of 4640 2024 msedge.exe 89 PID 2024 wrote to memory of 4168 2024 msedge.exe 90 PID 2024 wrote to memory of 4168 2024 msedge.exe 90 PID 2024 wrote to memory of 876 2024 msedge.exe 91 PID 2024 wrote to memory of 4168 2024 msedge.exe 90 PID 2024 wrote to memory of 876 2024 msedge.exe 91 PID 2024 wrote to memory of 876 2024 msedge.exe 91 PID 2024 wrote to memory of 3828 2024 msedge.exe 92 PID 2024 wrote to memory of 3828 2024 msedge.exe 92 PID 2024 wrote to memory of 3828 2024 msedge.exe 92 PID 2024 wrote to memory of 376 2024 msedge.exe 93 PID 2024 wrote to memory of 376 2024 msedge.exe 93 PID 2024 wrote to memory of 376 2024 msedge.exe 93 PID 2024 wrote to memory of 2732 2024 msedge.exe 97 PID 2024 wrote to memory of 1228 2024 msedge.exe 98 PID 2024 wrote to memory of 2732 2024 msedge.exe 97 PID 2024 wrote to memory of 1228 2024 msedge.exe 98 PID 2024 wrote to memory of 3584 2024 msedge.exe 100 PID 2024 wrote to memory of 4416 2024 msedge.exe 109 PID 2024 wrote to memory of 5000 2024 msedge.exe 110 PID 2024 wrote to memory of 2560 2024 msedge.exe 111 PID 2024 wrote to memory of 3584 2024 msedge.exe 113 PID 2024 wrote to memory of 3584 2024 msedge.exe 113 PID 2024 wrote to memory of 2712 2024 msedge.exe 114 PID 2024 wrote to memory of 548 2024 msedge.exe 116 PID 2024 wrote to memory of 4920 2024 msedge.exe 115 PID 2024 wrote to memory of 548 2024 msedge.exe 116 PID 2024 wrote to memory of 4920 2024 msedge.exe 115 PID 2024 wrote to memory of 2748 2024 msedge.exe 117 PID 2024 wrote to memory of 2748 2024 msedge.exe 117 PID 2024 wrote to memory of 2700 2024 msedge.exe 118 PID 2024 wrote to memory of 2700 2024 msedge.exe 118
Processes
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\email-html-2.html1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2024 -
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x254,0x7ffa34f9c188,0x7ffa34f9c194,0x7ffa34f9c1a02⤵PID:400
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1904,i,14623574546871978557,13415872232368755223,524288 --field-trial-handle=2432,i,12363102618212228762,18335399689789536160,262144 --variations-seed-version --mojo-platform-channel-handle=2464 /prefetch:32⤵
- System Time Discovery
PID:4964
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1796,i,8344068600661404912,1694811459165538969,262144 --field-trial-handle=2432,i,12363102618212228762,18335399689789536160,262144 --variations-seed-version --mojo-platform-channel-handle=2428 /prefetch:22⤵PID:932
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2500,i,14029606669136180805,12845900111097204925,524288 --field-trial-handle=2432,i,12363102618212228762,18335399689789536160,262144 --variations-seed-version --mojo-platform-channel-handle=2648 /prefetch:82⤵PID:4640
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3532,i,4151849862261424532,7554252556963051519,2097152 --field-trial-handle=2432,i,12363102618212228762,18335399689789536160,262144 --variations-seed-version --mojo-platform-channel-handle=3544 /prefetch:12⤵PID:4168
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3528,i,10839954025164377370,14612216690468882472,2097152 --field-trial-handle=2432,i,12363102618212228762,18335399689789536160,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:12⤵PID:876
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4276,i,16226596129923410737,17364930923863318985,2097152 --field-trial-handle=2432,i,12363102618212228762,18335399689789536160,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:12⤵PID:3828
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4296,i,424037642616318512,5695215567631283491,2097152 --field-trial-handle=2432,i,12363102618212228762,18335399689789536160,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:22⤵PID:376
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5136,i,11815300771592069039,11594782054254543359,524288 --field-trial-handle=2432,i,12363102618212228762,18335399689789536160,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:82⤵PID:2732
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,11989712220460221015,9161947085624883938,524288 --field-trial-handle=2432,i,12363102618212228762,18335399689789536160,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:82⤵PID:1228
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5748,i,17043994061261103192,10777832672725769039,524288 --field-trial-handle=2432,i,12363102618212228762,18335399689789536160,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:82⤵PID:4660
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5748,i,17043994061261103192,10777832672725769039,524288 --field-trial-handle=2432,i,12363102618212228762,18335399689789536160,262144 --variations-seed-version --mojo-platform-channel-handle=5764 /prefetch:82⤵PID:3584
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4548,i,16861304200961690658,16631180161174434207,524288 --field-trial-handle=2432,i,12363102618212228762,18335399689789536160,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:82⤵PID:4416
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4552,i,4186673967556827354,5169181309213097774,524288 --field-trial-handle=2432,i,12363102618212228762,18335399689789536160,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:82⤵PID:5000
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4536,i,11264089408089758844,13453857772902868877,524288 --field-trial-handle=2432,i,12363102618212228762,18335399689789536160,262144 --variations-seed-version --mojo-platform-channel-handle=5812 /prefetch:82⤵PID:2560
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4524,i,10204252196723884823,16432815297715153354,524288 --field-trial-handle=2432,i,12363102618212228762,18335399689789536160,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:82⤵PID:3584
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5220,i,2398543973039782165,16497080907539335115,262144 --field-trial-handle=2432,i,12363102618212228762,18335399689789536160,262144 --variations-seed-version --mojo-platform-channel-handle=5928 /prefetch:82⤵
- Suspicious behavior: EnumeratesProcesses
PID:2712
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2796,i,10090829142430589581,14686390160384415846,524288 --field-trial-handle=2432,i,12363102618212228762,18335399689789536160,262144 --variations-seed-version --mojo-platform-channel-handle=3304 /prefetch:82⤵PID:4920
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5540,i,10309497311847509024,12956224511526671526,524288 --field-trial-handle=2432,i,12363102618212228762,18335399689789536160,262144 --variations-seed-version --mojo-platform-channel-handle=5680 /prefetch:82⤵PID:548
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5392,i,7661508257745285321,3539823549648688734,524288 --field-trial-handle=2432,i,12363102618212228762,18335399689789536160,262144 --variations-seed-version --mojo-platform-channel-handle=1512 /prefetch:82⤵PID:2748
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3472,i,14799088938317107385,5578518101107326397,524288 --field-trial-handle=2432,i,12363102618212228762,18335399689789536160,262144 --variations-seed-version --mojo-platform-channel-handle=3600 /prefetch:82⤵PID:2700
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵PID:2604
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
- Size 105KB
- SHA256 f23fde02e6abf8cd0305ab90615b1755e3aeb27a3f4cbd6fc54416037b890ff8
- MD5 42fe604ca282400d99acb30f8f51653e
- SHA1 ea07b07170437486730789c12fb044630364f6ad
- SHA512 de6687cffc0a3ae239a365ca7f115bbc800ea83070e3f1c55911729ae71c368496445425b66b4454610a9ed74d059d8923c9a71b3600664e73bcbe86717c2657
- SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7P:fwUQC5VwBIiElEd2K57P7P
- TLSH T107B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
- MD5 77a76342e47369b91c295856d0d136ad
- SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
- SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
- TLSH T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
- Size 280B
- SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
- MD5 6503f091cfa7258a2190ed65490b1bdd
- SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
- SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
- TLSH T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
- Size 331B
- SHA256 64db2783ece2ed05319c58b965b06a5bc716443b0545940f8b677e6a2e11c31f
- MD5 cc9e577e025dfc8d18fb726b07d526b7
- SHA1 b3a9de754ae3b53f56cd578820b529029e77194f
- SHA512 d8fca658e5400f9cbd11c908eab7b616e18a78d68862d559dd8b4c77f6fc123527cd9dc305e9883cb41890912af0a78e17607f11b8303b73aedc6553ffb23a84
- TLSH T133E086D405DACAAE9724A8C76174630C8ED4370EDBD8BE4E7B0488C57146D88BBA29A5
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
- Size 558B
- SHA256 376b39afab28230a8809c00b586f559aac2d30c41a4dfdaf51634605cc01914e
- MD5 8f5569e3dcf3c686389bcf783905b92c
- SHA1 412e074dfcfc78d8eb966b746329014739d8e3f3
- SHA512 113485792562ae02a57f2ecf7218f6338f4fb351951fd450666d94ef14156e3ad14dcd10f0f4377005bff6b126d766de37db5176332dfaa8d6442986cb63bf9c
- TLSH T132F0C05B73C1CA694A0A51CB914677A884D0B347EFCCE84D23096CCC3404216ABBFAE4
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
- Size 158B
- SHA256 3162af488c283bbdb6565f4200727821b4e60ce0c47948b8d5b3655271a2625a
- MD5 7b9f1e9c5ca7be7a0fd051116a616b72
- SHA1 8a88b30a2e0c8a2c94e5512f0a5bb56573a6d8b9
- SHA512 2c13705b178f640305a8b7685e6b6a7e49374c53b0713e7e54da2205c3c290a3f79ad3280c111728c5383ffc23941c73a23b34049e67b876aa1915e6e2992364
- TLSH T183C08058798C845DC280187FA726F400177155115817962705A1FCD031406A01F2D124
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
- Size 6B
- SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
- MD5 377d072e137022223a370760763420bb
- SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
- SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
- Size 3KB
- SHA256 e73b32e7f8f197937201aa5dac644172808591d7db6d8a78f931b8fae335ff1d
- MD5 d38a8f67641e69e117db32f34fb5b339
- SHA1 3c8656e20a6b5903275ee7143dd57c3a8c6ca04f
- SHA512 e633b1cbb86672c5191a33cf42852c68b338f2e49156383bcdf79386a208d68e21750edeeb4fd8190461f3c832652d2552c9219e2dcf526f1360b26dd338639a
- TLSH T1BD713C95CEB2C591F3633C32D2D37129753976B94E13AF260344ED3C6A2AB2E7EA1144
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58772f.TMP
- Size 3KB
- SHA256 6d055953f575e4493c2981abc70021513cf295677bc6ef663585623252824d58
- MD5 7d73f4fc64489015944a8ff6eaabf47f
- SHA1 dd246f3c4cd65bd3ea9de3be6a976e9e26e29416
- SHA512 8f8a09bc66ec21387156e1f0cddfc8e83b2b1926322b2b2d72a61cbb2a7ed70a983133b09db421593420c6fb4fecd1f9548371de0354d5651ca834718d8af3b6
- TLSH T1F9714D94CEB2C591F3233C32D2D37129753976B94D13AF260344ED3C6A2AB2E7EA5144
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
- Size 2B
- SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
- MD5 99914b932bd37a50b983c5e7c90ae93b
- SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
- SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
- Size 70KB
- SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
- MD5 efe54a870e0f5ff28d7e00036b861065
- SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
- SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
- SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
- TLSH T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
- Size 949B
- SHA256 c6e570f26d790d4dd049d8b09665287a2d87ec6f6bad7cf49458321f8030aad7
- MD5 d3b8aef9dabb730a412450e59cc0965b
- SHA1 bb3de7225c283491b0d6e94519899bc48e96e41d
- SHA512 68a50f9ea7f39e7f3f6917bb82b20f8be8198ef8d59b88a55de79e8a498364e265216847f17c4285e93bbf7084b8bd66ed1b79592bfa495b5feefa82d3de2aea
- TLSH T153117DF3C3D5856E891156F05A24AE2BCE1D0616825C7C15C9D4FF2793E3075E00259F
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
- Size 111B
- SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
- MD5 285252a2f6327d41eab203dc2f402c67
- SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
- SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
- TLSH T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
- Size 966B
- SHA256 a3639494b4e9303c3486aac61a28e3305be2a9a0ca0b030f7cb6c9ae170277a0
- MD5 d9be1aef69591958133230e040d065e3
- SHA1 9cd800f00f566d56af3ffc818ff75137f1817222
- SHA512 62cef1417be67d4f1cb90dc6b8b3efff7836d5ae5ac1e1e60fcd3d4969467b2786abeb321d2bb212d81f8b0190763655804c96b4357631128a4ca386e7afdbfe
- TLSH T10E115BF387E585AEC91156F05A28EE2BDE2D0506421C7C2985D4FF67D3E3076E002A9B
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
- Size 2B
- SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
- MD5 d751713988987e9331980363e24189ce
- SHA1 97d170e1550eee4afc0af065b78cda302a97674c
- SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 13KB
- SHA256 449a2cc8c9d6a71de70a84906c5be39813edc67dc6112f0b83217e27a25a7b5d
- MD5 08e76ee2fa24fcf08e313ce63e8b04f5
- SHA1 dff746d95a889282583642abe5f50664b3bddede
- SHA512 7613762972f6665117511a79bdb3f9b34a03575c415ec56a1be8b85c182282c6699d6f47d5ca07d7ac9e77599891870f3567bc18a2b2f69a433673c35418e929
- SSDEEP 192:sxZORuyM/jK1Ml8UQpk3/f8sO+dIdpH1HW6+WNGYLlh5/Ig5yJ:sxZOgqq3/f8sO+eVHbGus
- TLSH T1CD52E711AA346977CCDBD20DF941BF53E6F54572A2900E84A9FCDA1C04F6AED221782F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
- Size 12KB
- SHA256 67722b388535096ba9dd4a0b07629a72956838a64da2392aca55d745467256f7
- MD5 c80356950b6d7ebc6af17811aef1278e
- SHA1 a4fc482607a2b71d7f381580cef1a0996019f206
- SHA512 cbfe27d03a08e9d51d4066ad9833cb1df03d1f9540e4552cda9a114ffc1f9fa3ca26fb5487536e22c8436f748c41a2a5ae4c79069cbd9f3e7dd2614f2336f248
- SSDEEP 192:sxZORuyM/jK1Ml8Mk3/f8sludIdpd1HW6+WNGYLzSL/IgrJ:sxZOgM3/f8slueLHbGD9
- TLSH T13B42F7116A346977CCDBD209FA51BF53D6F90572A3900E84A9FCDA1C04E6AED2217C2F
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
- Size 30KB
- SHA256 740b05fdfdfc99743fc72b2c8e72ccfa1aebeeba86b131aec1abdfe9ca2aa891
- MD5 60b240f3b1bd9263a6525704a90adac0
- SHA1 50b05f726b91b13c2d4ffb827f98ac614ffe9e3d
- SHA512 40ac6ec1cb76e27518af0ee8e0a2a348b751cc4d494b74d5bf5d802ac0b0142b66e9876de6bc4f23b6271f835d7227fea547e8c8fdd0a78957054a1ed48580aa
- SSDEEP 768:bLs6pD1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJNUroCe:bLs6pD1WvxzWju1jahILIsN/Ce
- TLSH T196D2FB3B680CC77E4F841E5CEC2AAF967DD801CBAB98899447FA444C03C77EA512759B
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\903a2be3-ab32-4cfa-b622-4e95ccd6e856\index-dir\temp-index
- Size 2KB
- SHA256 ca49c6be6e8b2b298fc371f81d4fdd9159b9e7cbc9b28fa52bfefe6c0e3421ec
- MD5 00890ec34c73e25708417355f056d383
- SHA1 20a41e69fc6d837803e08877291829212d548a08
- SHA512 46c5558066b2fb7065787d09f4494414d6edfb181e7e26f056c3f0040c29656c28ca33055516ac8a5fd3ce044dcacf9c3190ece5987ef08e5ded1c018e561f2f
- TLSH T1E851C64F4E619A5FE8A842B314B3649033749CCC1B55972368EC2231F88775A290B7ED
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\903a2be3-ab32-4cfa-b622-4e95ccd6e856\index-dir\the-real-index~RFe5cbcef.TMP
- Size 2KB
- SHA256 45462734078fb455237eaec572479372c648a9368dab825699274d6e3a8e8ac8
- MD5 749afc228c1c034d35eacf861ae0fc15
- SHA1 2cf148b7d5c9c877ec7c0bd3034bef3baf7d52cd
- SHA512 4229a7f68a551249c16427a9191a081327cd1e1c96b961ac11f14cbfd483e6448b1d7428ad03197172a6874dbe977741f791b32c14a778c137237e249cadbc2e
- TLSH T19751B75A8D424A39E9C441B70EE3A4F4373929008719BF5374FC9636ACD27AE3D0E2D9
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
- Size 371B
- SHA256 a255c3c1a2c83cd4a49d8cda1f9daff5c688eb874e2582236353eed37038b916
- MD5 344feb2e8a2a2ca14291e67b5fdd2dc2
- SHA1 27515ba5dea1768f3fa79d6af3bb6f9413235fad
- SHA512 3aef0d12e537fca5e3801b0db346e950f64982cf971248484b026ae2bf62c6cff8567e5e3a2f8fc8c1ab72ac6ae9a1f895d9faa225dc851a824d12831a5df44c
- TLSH T125E0DFBB6EA76820FDABE3E7287194B50241392CC805BC4F686AA6C3A0B13557846C65
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
- Size 6KB
- SHA256 8a549cd65471d47d8444a5b148d9ea63459056d756e01699155aff2f106bc226
- MD5 371b8df9ce13330b20513015a5b4eebe
- SHA1 a0fe4b97e61da48933a8642373ade4822f9d96ae
- SHA512 77acc00025d1c699e35cea67bcd28823e52818cfd21420c90326fb856c5870bde45249812fd227d4117d5223206178ec561a4faa8f1db482d1c594065198ffa3
- SSDEEP 96:KUAAKtePuV2Ku8SKy0K3KE3SKAUeqooK52V:iixdf+Zjy
- TLSH T167E1181232BB03433C3E6948A2558B274B86B1633118B42B7BA905B24D67E355EFD9ED
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
- Size 22KB
- SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
- MD5 f768bcb451a187c18099961c484eef8b
- SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
- SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
- SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
- TLSH T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5914d6.TMP
- Size 3KB
- SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
- MD5 904e6e94a1d46374c8630cfd86cc729f
- SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
- SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
- TLSH T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 19KB
- SHA256 8871b433f663b3dfe94da7d3ea0a9920066cb4344799be8849dd27b9619448e6
- MD5 efa7dc7dd35613feb6977637c6dc8f3e
- SHA1 802372f54bb52a521a140c45979bd0fadaeab9dc
- SHA512 65fb898d5967e775100dc24d50eedc9808ff79e4b45a8b85805033c9f9a35f9a1c243856b536f613e515f79f9667b5de2272f1588752c3ca04f3542c7124db2b
- SSDEEP 384:eZcIhsNnsSGz9Fa91AlWCKnTKwBODNZOCmWOP0:chRI7sKnewBKZOvWOP0
- TLSH T1E1927D7258386C735DA6E145F94732074EB88173E7D82F94D2EDEF1C00EA6A82316C2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 20KB
- SHA256 90e71aa95d72aa6f8b7de62b8d792041381368be6a623a7f5d1b933bab724429
- MD5 fc10b738ddbfa8796b9b60ba6688c687
- SHA1 5390d2cb60e52d707b6dae6f9e71068cddd16af9
- SHA512 13907a3d69d60dd81c83845299d1f0dd1086669e40debe72db6203cc3ec89fce913eb9aae24a0bfcac263a5a3bb8dd317b1a767df52129f4bc26ccdb216904f1
- SSDEEP 384:gZcIhsNnFSGz9Fa91AlWCKnTKwBODNZOCmWOP0:ehII7sKnewBKZOvWOP0
- TLSH T194927C7258386C735DA6F145F94732074EB88177E7D82F94D2EDEF1C00EA6A82306C2A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 22KB
- SHA256 c96a21e095457f3551a7c4cd2da76bcc13e3fc055c49659ef5431a30f307b62b
- MD5 b77385ffae091ba372d0be32ad4602c1
- SHA1 ace24d5a2fced5df7b81d1930088b8dd6d5004af
- SHA512 e76ae9d2c449adeff5d9774aecffcae55d2d44dcf0af3ece5eb4ca6413eedf03a7fe0c36ff731f8d0411a057938da2e515f1d0cef921a2c2015959f39ceccfbd
- SSDEEP 384:9iFiZcIOzsN58TUNTUlIlFSGz9Fa91AlWJKnTKwBODNZOCmWOP0:0FQOkwgVI7DKnewBKZOvWOP0
- TLSH T124A27D735C68AD779EB6AA45F94A32078EF44177DAD56BA0E3DCEF0C00A71A81307C25
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 8KB
- SHA256 511cacda87e20bb78d43c667fe71944420e9c05acd49a2cdf200b0bba0da656c
- MD5 2e1b9915efa9980f75cf5749f253a903
- SHA1 4d6b555a7b1d9080b77546a07fe4fccc8fc6cdda
- SHA512 b676126a4adef9a22b3fd9ab83c251e9293bd48dae0a6b61628b8011165d9b74b319b392466e9723f49128a16cdc6e7a9568733565e9628903887b3fcc94ee6a
- SSDEEP 192:qONc6O7+3hQmiUyFnGttb0X+FA42YlgGeAU6:qONc61+Gt91AlQHU6
- TLSH T13202D8356C786CB78AF2ED45F58767135FA5113BA9A52F80DAE81F0C00D765C2346827
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
- Size 8KB
- SHA256 0d9cb64344b231edf45c94ec880bec7dc3a6c52e7b63248301bb128c95526197
- MD5 b6882f308fd50887b694d609cc04b13b
- SHA1 1bd67fc498b90fab8ed29f0f9374ffe129fd374e
- SHA512 a73fd84ce7cdc3a5d8d599eb85aefc0aef6a4b29063e2e7c5eb48a141f235ed6774b06c83174d73b4d832148ca5609e21755771e778890735742e8347dd22816
- SSDEEP 192:3ONK6O7+3jQmiUy5n3ttb0X+FA42YyuNQcN2q/OU6:3ONK6Lm3t91AlWRKU6
- TLSH T1C8120A3568687CA75EB2E541F48735135EA5413BDF8A2F90D6EC5E1C00EF6AC234A81A
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\5496ca21-387d-48fa-9d5c-1ee351ca4aab.tmp
- Size 13B
- SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
- MD5 2aa9e263ee3796d9ce358460a2451b4c
- SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
- SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
- MD5 SHA1 SHA512
- Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
- Size 2KB
- SHA256 293c761ed71a5de9e2c4a89cd88f8844d2dcd11ea65dff5b87692ab7c1ab2e3e
- MD5 356590ecea18f040bf8dd53a69e88bd5
- SHA1 c73357c29d52984359ef05666bc5de106e1ade17
- SHA512 71ac63ec7a2b6a6591fdda3c1f2c7a8edd0f25f27a2f87d03bf51583c3e89b77e10396e2ee6bba61b0e05bd0a4649a776bc2b3398a7a05f7ce83e6185cfd7a31
- TLSH T10A41E85CAAFA1144B3B76E5AABF6A86D447B78772E06D55D00010E4F0A63B40D862B33
- MD5 SHA1 SHA512 TLSH