5eacce0201fdad363cc361808aab4d5ae3a648a09a24aae3d14642277fa4048e

Resubmissions

06/08/2026, 10:09

260806-l6vrmsydre8

06/08/2026, 09:48

260806-ls2m2aybnb8

Analysis

max time kernel
600s
max time network
426s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 09:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
email-html-2.html
Size 8KB
Sample260806-ls2m2aybnb
SHA256 5eacce0201fdad363cc361808aab4d5ae3a648a09a24aae3d14642277fa4048e
MD5 911000d6d52bd6e3a33eec09d3acf84f
SHA1 35c88394eebf6cba5412afd4a53189f79f1f2ce8
SHA512 dfac4d7f611cd85f6eda57e3a180dbb7496ae7a31d9836310d5ff063c907f660671ed06e945c93f670a3dc7a92ff598310885cc8680865c866aa0cef0a4a0cbf
SSDEEP 96:VuD1kmBK5ucMKRHNoOroTSKiSriSqiSriS9iSrKSziSniShiShiShOS9vHS1nxh2:EKRHuOY67G7zZxzllx8HmnL3+wq8cUOx
TLSH
T11D02E303D5240D4B65FB90F0A06B2B64C085C74ED3196AE4B39A63B3EDCA6766FC3349
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2000	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134304833329808518"	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{FA035726-42FD-4994-8B4C-2DFCDFAD8876}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3144	msedge.exe
3144	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe
6076	msedge.exe

Suspicious use of WriteProcessMemory 38 IoCs

description	pid	Process	procid_target
PID 6076 wrote to memory of 5692	6076	msedge.exe	89
PID 6076 wrote to memory of 2000	6076	msedge.exe	91
PID 6076 wrote to memory of 1708	6076	msedge.exe	92
PID 6076 wrote to memory of 4816	6076	msedge.exe	93
PID 6076 wrote to memory of 1708	6076	msedge.exe	92
PID 6076 wrote to memory of 1708	6076	msedge.exe	92
PID 6076 wrote to memory of 4816	6076	msedge.exe	93
PID 6076 wrote to memory of 5844	6076	msedge.exe	96
PID 6076 wrote to memory of 2364	6076	msedge.exe	95
PID 6076 wrote to memory of 5844	6076	msedge.exe	96
PID 6076 wrote to memory of 5844	6076	msedge.exe	96
PID 6076 wrote to memory of 2364	6076	msedge.exe	95
PID 6076 wrote to memory of 2364	6076	msedge.exe	95
PID 6076 wrote to memory of 4620	6076	msedge.exe	98
PID 6076 wrote to memory of 2828	6076	msedge.exe	97
PID 6076 wrote to memory of 4620	6076	msedge.exe	98
PID 6076 wrote to memory of 4620	6076	msedge.exe	98
PID 6076 wrote to memory of 2828	6076	msedge.exe	97
PID 6076 wrote to memory of 2828	6076	msedge.exe	97
PID 6076 wrote to memory of 1668	6076	msedge.exe	101
PID 6076 wrote to memory of 1668	6076	msedge.exe	101
PID 6076 wrote to memory of 2116	6076	msedge.exe	100
PID 6076 wrote to memory of 2116	6076	msedge.exe	100
PID 6076 wrote to memory of 5144	6076	msedge.exe	103
PID 6076 wrote to memory of 1848	6076	msedge.exe	107
PID 6076 wrote to memory of 2720	6076	msedge.exe	108
PID 6076 wrote to memory of 2516	6076	msedge.exe	109
PID 6076 wrote to memory of 3312	6076	msedge.exe	110
PID 6076 wrote to memory of 3312	6076	msedge.exe	110
PID 6076 wrote to memory of 3144	6076	msedge.exe	112
PID 6076 wrote to memory of 2232	6076	msedge.exe	114
PID 6076 wrote to memory of 2832	6076	msedge.exe	113
PID 6076 wrote to memory of 2232	6076	msedge.exe	114
PID 6076 wrote to memory of 2832	6076	msedge.exe	113
PID 6076 wrote to memory of 4792	6076	msedge.exe	115
PID 6076 wrote to memory of 4792	6076	msedge.exe	115
PID 6076 wrote to memory of 2540	6076	msedge.exe	116
PID 6076 wrote to memory of 2540	6076	msedge.exe	116

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\email-html-2.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:6076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2cc,0x7ffe69d3c188,0x7ffe69d3c194,0x7ffe69d3c1a0
  2⤵
  PID:5692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1820,i,1871011457266521654,10131739249772882959,524288 --field-trial-handle=2832,i,9176659905082156111,18150419290974169679,262144 --variations-seed-version --mojo-platform-channel-handle=2888 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1612,i,5610796663283847579,9536105599280721735,262144 --field-trial-handle=2832,i,9176659905082156111,18150419290974169679,262144 --variations-seed-version --mojo-platform-channel-handle=2664 /prefetch:2
  2⤵
  PID:1708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2432,i,6385737385600354991,16598704737470828118,524288 --field-trial-handle=2832,i,9176659905082156111,18150419290974169679,262144 --variations-seed-version --mojo-platform-channel-handle=2896 /prefetch:13
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3588,i,3439459093743038015,7721814912364620547,2097152 --field-trial-handle=2832,i,9176659905082156111,18150419290974169679,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:1
  2⤵
  PID:2364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,14505695594426454979,11388082740800477710,2097152 --field-trial-handle=2832,i,9176659905082156111,18150419290974169679,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:1
  2⤵
  PID:5844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4248,i,9817086631895406885,1397993510523908187,2097152 --field-trial-handle=2832,i,9176659905082156111,18150419290974169679,262144 --variations-seed-version --mojo-platform-channel-handle=4792 /prefetch:1
  2⤵
  PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4288,i,15739062550266333794,13013841718052315886,2097152 --field-trial-handle=2832,i,9176659905082156111,18150419290974169679,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:9
  2⤵
  PID:4620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5372,i,1758197098786759853,7913039728774810759,524288 --field-trial-handle=2832,i,9176659905082156111,18150419290974169679,262144 --variations-seed-version --mojo-platform-channel-handle=5400 /prefetch:14
  2⤵
  PID:2116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5364,i,12861632693084843087,13503801596617482319,524288 --field-trial-handle=2832,i,9176659905082156111,18150419290974169679,262144 --variations-seed-version --mojo-platform-channel-handle=3652 /prefetch:14
  2⤵
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,17574327937905206974,3496290372381634995,524288 --field-trial-handle=2832,i,9176659905082156111,18150419290974169679,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:14
  2⤵
  PID:712
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,17574327937905206974,3496290372381634995,524288 --field-trial-handle=2832,i,9176659905082156111,18150419290974169679,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:14
  2⤵
  PID:5144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5056,i,17841786285084430719,6385789063371944417,524288 --field-trial-handle=2832,i,9176659905082156111,18150419290974169679,262144 --variations-seed-version --mojo-platform-channel-handle=4936 /prefetch:14
  2⤵
  PID:1848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5060,i,5480559163834169634,3521083779119746894,524288 --field-trial-handle=2832,i,9176659905082156111,18150419290974169679,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:14
  2⤵
  PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5044,i,5601212945159475984,16849333425269696746,524288 --field-trial-handle=2832,i,9176659905082156111,18150419290974169679,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:14
  2⤵
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6540,i,754165060433886304,11159847832140281472,524288 --field-trial-handle=2832,i,9176659905082156111,18150419290974169679,262144 --variations-seed-version --mojo-platform-channel-handle=6552 /prefetch:14
  2⤵
  PID:3312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=812,i,13470037356354332867,5703715228781960028,262144 --field-trial-handle=2832,i,9176659905082156111,18150419290974169679,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1084,i,4696951786844130882,1617688985388235522,524288 --field-trial-handle=2832,i,9176659905082156111,18150419290974169679,262144 --variations-seed-version --mojo-platform-channel-handle=1088 /prefetch:14
  2⤵
  PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6052,i,14397950962359041780,3111242365844402206,524288 --field-trial-handle=2832,i,9176659905082156111,18150419290974169679,262144 --variations-seed-version --mojo-platform-channel-handle=5224 /prefetch:14
  2⤵
  PID:2232
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5548,i,12148315117219700324,15543389421441352719,524288 --field-trial-handle=2832,i,9176659905082156111,18150419290974169679,262144 --variations-seed-version --mojo-platform-channel-handle=2840 /prefetch:14
  2⤵
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5040,i,15837062943555180869,7651556995247860310,524288 --field-trial-handle=2832,i,9176659905082156111,18150419290974169679,262144 --variations-seed-version --mojo-platform-channel-handle=5028 /prefetch:14
  2⤵
  PID:2540

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3664

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4140

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

LOG

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG
Size 331B
SHA256 ae9dbb914033bd34195c6e113d389832c7ce1938fed67bc2dc22d7ef96cce522
MD5 f8e3318a1e696aadf085d045c7db46ab
SHA1 a15609c3654d8129bcbca6eae64f1dc09c9deedd
SHA512 3724611a69f14f8a23a60bf7f35a8b536fe88ccb8eb5af92f08028212503ab9599806dc27e4b60a7efe9f3686db9f818d56f0188fae6dbd71d3c5f43cb2cf8ed
TLSH
T154E0268444CACBAFAB00648B5268574C8AC03B4EDAD8B91E27008AC87005848F7C2AE0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 a7906afe5fafb7e243f2166af3d891b7c79757cc9a06b7b4dc57499db98e6e20
MD5 87bc7a8a18da1b6d0b64578674296b51
SHA1 204b5a3ecc4c1a1800d48b79e1f46996abaf4ef3
SHA512 a2a38861f3ba17247b7583c6714409d7f03a263d6d7dcceab12dae927e2c6ce5eb269fd99e84bddc489ae27e140ea206fcce441888aeac4b111186256878aabe
TLSH
T129E0269504CAC26EE749648B526E578C82C0372B9ACCB90F570988C4714A144ABABAB0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 19d161dfba692474ba15e1cca782f595536e644497af455aa141be611aa13264
MD5 ea6ffdf1863abb8f26e728bb9b181817
SHA1 65a4c17c243faabe2265a01b15d4705203104cb3
SHA512 9841573829f6c254667691adee64cd3e53b7e541931fb8b52c4c3f6f0ffaf17ed6631a25384cc97873c92b71f9030916ca0d97ef145564277ff2d6dcf9c51022
TLSH
T1A1510A41136E18C6CB6497B953E117DAFAF078490D7B7F0148A1EC30E053F69A1E15A3
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 c5c0283c4d973b65ccef4c0dd15c0607b3d893813f548897eb183eb45cf66402
MD5 ae979732f18192a169b372366f83f487
SHA1 6feb655ffa6c8e86e05f8f6a668ff57832932cc7
SHA512 92acc04908ef8d00cab58de0a9f3dafe25cf8b5f825222a89d40fa5bf0269f66c75009a2015c4acd930e6fe86f98d2be3a5828d01a6c76db72d569392fe4059c
TLSH
T11141ACF3C7E4857E890156F0AB186E2BCE1D0915832C3D6AC9E4AE2B97F3471E14195F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 c3355cc6839be71bc9403a0b55f2a500b6eeddd523cf420d9d795bd6571a0717
MD5 a6bfb4e4edb8bd3b6574f370da98ba4b
SHA1 e129928f8b785b88401ddfed3d9bb4a7740012c8
SHA512 043d33b54d8e34c29eb4d0f8cbdc74f84618d851c4a498b3d146754a015a36ec771f5a7f268ba2f126310e2504970ef70b7524617f7147180039f68a9acda932
TLSH
T10141C0F3C7E4866E890156F0AB18AF1BCE1D0915432C3D6AC5E4AE1B93F3471E141A5F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 7ff19128d628d02a81138a9f96896a6f43ba1c136e15cde28bb8838ef01283dd
MD5 b8f29f958a2b2b5d43a043b3204b12c9
SHA1 58351165f32007a08f96463a98e292636f8bc67c
SHA512 e2c93cfbcec56523698083f2403c0812e674eb807e1acbba2371b511385a7fa77b38ddb6d5d3a6e89cf454aff7227e9d18166ee6a241c8fdb69844dc77db6843
SSDEEP 192:sxROR1tbP/fEsYV/wGIzoA8p4u/g6+WNIYoXwYZG3IgIJ:sxRO3VP/fEsYVpRH/5IA3s
TLSH
T1F832B6166A28A97B8CD7E21DFB65BF53D2F91032A1D42E58B6FC960C04E76DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 34423fba194ee62613dc0c4ff8a67e87e70f2f42540bb694dc7493a3276bf21c
MD5 4943253ccebb5a2266c3f572cd1ede33
SHA1 ae242640185f94d66f50e15d802b175f0d93c740
SHA512 74ee87647026fe816a0608b09286774e255f03066e93ca90222b5a20a0b0218102a11cd3d5efb9a209d8b3c93755f26dd5c78db673dc5ae3308a9335d242a585
SSDEEP 192:sxRlR1tbP/fEsseT/wGIzoA8p4u/g6+WNIYoewYZG3IgD/J:sxRl3VP/fEss6pRH/5IN3F
TLSH
T18642C6166928A97B8CD7E21DBB65BF53D2F95032A1902E58B6FCD60C04E7ADD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 4bd6bae8f406b507ef59ab7ce8a58412ffb0659486a814c90e58dbefa6cbd172
MD5 556a4098da9cc3baf4107dfa25477726
SHA1 ef73ba91753bece7a046fa08ee666e36ee332e6b
SHA512 ac414da6ef2a66a238bfdc76886dc15a1a6936b039cccc7ff4e7b6a0c84e3f916b00d541486216c07450f81f0aece1b2d75c482c913863811c5852a7162c103c
SSDEEP 192:sxRlR1tbP/fEssV/wGIzoA8p4u/g6+WNIYoXwYZG3IgDZJ:sxRl3VP/fEssVpRH/5IA3H
TLSH
T1BA32C6166A28A97B8CD7D21DFB65BF53D2F91032A1D02E58B6FC960C04E76DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 19a8e0c66d4d2e7a74040072e39585017bb40a5e07cf3cb1b7f3c33ba8a64140
MD5 6aa51ae43d463ad96faef6c9a1d9df4e
SHA1 abd9d8d1f149fe8ea0a931e0a2ea79bac63164fe
SHA512 a7f5a8f62930e171568a22cee8990f47ec815e9a144fe387a582ff389693da890dd74b2415345c8c2524fa82b210bd43f116915292e3c83d993e5c1b574143bf
SSDEEP 384:jzK6H0dfCtgsqFf02KhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVvf9uaRX6ro984:j26H0RWgs2f028F1+UoAYDCx9Tuqh0Vi
TLSH
T177B2DB2B640DCBBE9F800A9DDC196FDB6D9802C797588D4047FE994C03C77EE911A4DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d163513e-8560-4a47-a70c-eb2f6265d9d1\index-dir\the-real-index
Size 168B
SHA256 0a222e638439914f25afcc8742eb6c125c88719ddc74922413d158b735ec406f
MD5 adf9f77ac33c65b8e55efd94bb0ed383
SHA1 3e60406a7c41f505f5483255493ee74071f92afa
SHA512 132466ca61c95bcc4fe2c82d3c7ab5aec3e5d956bf663f31041809c1722eb6efce4b2ca586d63f187ad761e6b6c7a81f8d613a06504c12c405d5c4f45f961235
TLSH
T12BC02202CC0A88AAC80322300C3B20282B330AFE08223E2200EC8002E030E2C80CFA00
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5e0b58.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d163513e-8560-4a47-a70c-eb2f6265d9d1\index-dir\the-real-index~RFe5e0b58.TMP
Size 168B
SHA256 1141e09fdf8824dbec410eaa48cdeb194c0058d59d4f8c0b420036975b5f6949
MD5 b9265973981f38b8533b5a14c395c7bc
SHA1 0be961b5c556945664d842a838314417e73251ce
SHA512 ec5f588921d68e63190251bb578fdb87e5badfe58012c6eb4010306901eaee698ea7db2fff03c2d53d655ec26a81a1b4ed1843b179d39b80dfc7118c24b285e3
TLSH
T12EC02202C822CCB0C00B08302023A22822A30E280020BA2220E8082EE83008880CEA00
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 370B
SHA256 e41b07ed53a342857dfcc6dcd7e40e64dfcedf7790f463b49b1cf7de3e9c5a48
MD5 275b54156f73183e8bdc371a8ed62933
SHA1 71b4f82dec779cd307f2f3c63e41f3e85f0e579b
SHA512 e901d89c014b5a94093b6e4aebbef7a241b94c9909f864b72bfdb654f2b7e8d9f364a3997496f5082f20af411c5cdf9c9198414a67606dec0e000009b98886cd
TLSH
T101E0D8B32DD76810ECAF97E62C7154A40181B464D545EC9F251A93C750B1221B856C31
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 42491b385f64317413b5b7973e2fba5ae6d18bde8ea274272e5967a237233376
MD5 5265fa28c090a6ed5356090e652e71ab
SHA1 5b6a144b51665d2eb3aad2d7db1796d7cffd9912
SHA512 d2fa43f815109f2a52439c3ff8cda69f45398fb28bf36a827f4e7fd6d5bad8b56ecb55c49ed74a78aaac8c17615448840cc55d2a861966ee6493fadd32560742
SSDEEP 96:KRFSr/VPTXW2r7gooK4tgaocII7aglHPMPNP4PcPWPaPOP8WPqPnPngP2OP22K4K:CFSr/VPTm2rEostgaHII7aglHU1gkeC/
TLSH
T1E9915105317F42843D7FB91C81698C1B42C27472311ABA6B7BA941A35FA7E029FFD9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a636e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a636e.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 19401a59e81b6b0d984b526e61fe4256555ad9b69ea80da246b25d9ec0ac3726
MD5 92892c80d8a9dbd7579cf6635ad6bf30
SHA1 6055788dde88569b0c9a8ab213b1f5c173083584
SHA512 23f6ef0a8ee2ab3c268694625c5921543a5f59981b843db3c6b892851939a693374808cd207b0b5747b8421f562ec38ddc5f59c11d52921206efd88d0b5d1059
SSDEEP 768:Drv+4UNbdS3xg/TBOWt3lGONXyer1IRCzni99qw:DbsbM3mNGSIqnOr
TLSH
T16403BF31E559AE338CE2A2C6B10B77437FB8505786C40BA0EDDA6F8D059B5AE130B917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 df295fdbf1ecf97eac982298504642b3d4d78c36121d36d6545c7f02c121650d
MD5 753699326f82a514b0c4836e91d5c69b
SHA1 1083bcd795330febad21b160cfa62b89739bb274
SHA512 c2009216739758c75da0c112b0c4e0bd00c6e1b397ea823c2683507e27b417f9893cdf37321351fd8ad0aa322c1e5010ad2560788e24ad1d7cc83e9c58bf264c
SSDEEP 768:I13Sg/TBOWt3lGONXyer1IRCzni992ewBKZOvWOPv:I13FNGSIqnO2evZ0JPv
TLSH
T1D9F2B031E459AD234CE5E3C6B50B7343AEF89163E6C41B60AEEDAF1D019765D130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 92778370662b00094329728b5db701c70d5d613ccf28edac6ed1378777d8ddd2
MD5 57cc8319d03159fabf32f49403cb627d
SHA1 bd5333a4bde0c2bfb752482f0013f97e39374a74
SHA512 6be015dad945398f4cd95de77b504a7f2ecd684e18a60103e1e258c1ad169ffd85ae3896bb449819f036f7e0e17234205696535966604ab11642e4f6a83637da
SSDEEP 768:l13Ug/TBOWt3lGONXyer1IRCzni992ewBKZOvWOPv:l137NGSIqnO2evZ0JPv
TLSH
T1DAF2C031E459AD234CE5E3C6B50B7343AEF89163E6C41B60AEEDAF1D019755D130BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 6de8290147c22fad67e304a6c921b3aba856cdfbd3a386c2e9b6d2f1c136a470
MD5 d0f7ad96701096382072fa6b9831f212
SHA1 3947f84b5ed37d361ac82aa4e365ef3ab0951bb0
SHA512 8795fd9a9599689f826556906c4a71d73eea905d2b7eb7c8bb828308f64f482adfa97fafa9c65b3eeb191107346a99a53327d65dbf8a9e1883d4747ec4bc2bf8
SSDEEP 768:3FQS30wgTg/TBOWt3llONXyer1IRCzni992ewBKZOvWOPv:KS3fNlSIqnO2evZ0JPv
TLSH
T1CF03AE32D888DE379CE6A7C5F60A7303AEF85163D6C456A0ABDDAF0D01A759D130BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 6f0b051c02d9fd0682f191dc2185fdbae672747c2952900bd5057f700ecfa12a
MD5 c2df2a130a1151c892bdb992bc4a2652
SHA1 cf653c4a60d41f6aafde1cb01f29970c36c892ae
SHA512 44546b691666cac6aa1c01a0916f4e5d760ee458dcfcc3bd9d899a32e86577eeb67bf1cf8f76cd19d5becb31a83d0749a5c5796ed884c8ca00495473f54efb2a
SSDEEP 768:hrv+4UNbdz3Kb/TBOWtqONXyer1IRCzniBeeVH1SK7:hbsbV3eiSIqnlEH1l
TLSH
T11B03BF32E4A89E334CE2A3C5B14776437FB86057D6800B90DDDE2F4E069B59E130B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

memory/5144-176-0x000001EC20330000-0x000001EC206EB000-memory.dmp

Download

memory/5144-167-0x000001EC20330000-0x000001EC206EB000-memory.dmp

Download