hxxp://20[.]2[.]8[.]21

Resubmissions

07/08/2026, 23:38

260807-3mrdjsvhlb8

07/08/2026, 23:30

260807-3g744sdp5z3

Analysis

geolocation tags

nanew-jerseynorth-americaunited-statesususa
max time kernel
898s
max time network
732s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
07/08/2026, 23:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://20.2.8.21
Sample260807-3mrdjsvhlb

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4028	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134306195438024634"	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1108628292-2849104889-3743975892-1000\{A8D39E16-CF9D-4F71-9F6B-08D8353A8A43}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1108628292-2849104889-3743975892-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3924	msedge.exe
3924	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe
388	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 388 wrote to memory of 4372	388	msedge.exe	84
PID 388 wrote to memory of 4028	388	msedge.exe	85
PID 388 wrote to memory of 3684	388	msedge.exe	86
PID 388 wrote to memory of 3684	388	msedge.exe	86
PID 388 wrote to memory of 3684	388	msedge.exe	86
PID 388 wrote to memory of 3976	388	msedge.exe	88
PID 388 wrote to memory of 3976	388	msedge.exe	88
PID 388 wrote to memory of 1600	388	msedge.exe	89
PID 388 wrote to memory of 2928	388	msedge.exe	90
PID 388 wrote to memory of 1600	388	msedge.exe	89
PID 388 wrote to memory of 1600	388	msedge.exe	89
PID 388 wrote to memory of 2928	388	msedge.exe	90
PID 388 wrote to memory of 2928	388	msedge.exe	90
PID 388 wrote to memory of 1624	388	msedge.exe	91
PID 388 wrote to memory of 1624	388	msedge.exe	91
PID 388 wrote to memory of 1624	388	msedge.exe	91
PID 388 wrote to memory of 5052	388	msedge.exe	92
PID 388 wrote to memory of 5052	388	msedge.exe	92
PID 388 wrote to memory of 5052	388	msedge.exe	92
PID 388 wrote to memory of 3044	388	msedge.exe	97
PID 388 wrote to memory of 2040	388	msedge.exe	98
PID 388 wrote to memory of 3044	388	msedge.exe	97
PID 388 wrote to memory of 2040	388	msedge.exe	98
PID 388 wrote to memory of 3936	388	msedge.exe	100
PID 388 wrote to memory of 220	388	msedge.exe	109
PID 388 wrote to memory of 5064	388	msedge.exe	110
PID 388 wrote to memory of 2664	388	msedge.exe	111
PID 388 wrote to memory of 1608	388	msedge.exe	112
PID 388 wrote to memory of 1608	388	msedge.exe	112
PID 388 wrote to memory of 3924	388	msedge.exe	113
PID 388 wrote to memory of 4436	388	msedge.exe	114
PID 388 wrote to memory of 4436	388	msedge.exe	114
PID 388 wrote to memory of 3152	388	msedge.exe	115
PID 388 wrote to memory of 3152	388	msedge.exe	115
PID 388 wrote to memory of 1516	388	msedge.exe	116
PID 388 wrote to memory of 1516	388	msedge.exe	116
PID 388 wrote to memory of 460	388	msedge.exe	117
PID 388 wrote to memory of 460	388	msedge.exe	117
PID 388 wrote to memory of 3336	388	msedge.exe	118
PID 388 wrote to memory of 3336	388	msedge.exe	118
PID 388 wrote to memory of 1468	388	msedge.exe	119
PID 388 wrote to memory of 1468	388	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://20.2.8.21
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2f4,0x7ffc35a0c188,0x7ffc35a0c194,0x7ffc35a0c1a0
  2⤵
  PID:4372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1776,i,17079765272269769830,9776526783662674753,524288 --field-trial-handle=2228,i,17240256942901337901,2764781681492244726,262144 --variations-seed-version --mojo-platform-channel-handle=2256 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,5399502883941720004,203662981705473785,262144 --field-trial-handle=2228,i,17240256942901337901,2764781681492244726,262144 --variations-seed-version --mojo-platform-channel-handle=2224 /prefetch:2
  2⤵
  PID:3684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2620,i,8950749662307131047,16635122973317707574,524288 --field-trial-handle=2228,i,17240256942901337901,2764781681492244726,262144 --variations-seed-version --mojo-platform-channel-handle=2688 /prefetch:8
  2⤵
  PID:3976
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3444,i,9481664543368082907,14555426040813192313,2097152 --field-trial-handle=2228,i,17240256942901337901,2764781681492244726,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3440,i,14838583142845970608,18318484486367785787,2097152 --field-trial-handle=2228,i,17240256942901337901,2764781681492244726,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,10710071871611734534,2833577446861325326,2097152 --field-trial-handle=2228,i,17240256942901337901,2764781681492244726,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:1624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,7795218400267326654,16128278380654693611,2097152 --field-trial-handle=2228,i,17240256942901337901,2764781681492244726,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:2
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,14531967771703873695,4691075969963679292,524288 --field-trial-handle=2228,i,17240256942901337901,2764781681492244726,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,15642852263991267808,8157027234001788449,524288 --field-trial-handle=2228,i,17240256942901337901,2764781681492244726,262144 --variations-seed-version --mojo-platform-channel-handle=5244 /prefetch:8
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,14409769637716295402,11950679666925120357,524288 --field-trial-handle=2228,i,17240256942901337901,2764781681492244726,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  PID:3032
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,14409769637716295402,11950679666925120357,524288 --field-trial-handle=2228,i,17240256942901337901,2764781681492244726,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=600,i,11566881277185062559,1592864418481076141,524288 --field-trial-handle=2228,i,17240256942901337901,2764781681492244726,262144 --variations-seed-version --mojo-platform-channel-handle=4220 /prefetch:8
  2⤵
  PID:220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5088,i,9686707682079972339,2461209734557881505,524288 --field-trial-handle=2228,i,17240256942901337901,2764781681492244726,262144 --variations-seed-version --mojo-platform-channel-handle=4612 /prefetch:8
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6156,i,10202898364311182680,941103031156675834,524288 --field-trial-handle=2228,i,17240256942901337901,2764781681492244726,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:8
  2⤵
  PID:2664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6464,i,2476461358677348715,14513673407366207435,524288 --field-trial-handle=2228,i,17240256942901337901,2764781681492244726,262144 --variations-seed-version --mojo-platform-channel-handle=5432 /prefetch:8
  2⤵
  PID:1608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6084,i,1746243633303593713,11054794477962248282,262144 --field-trial-handle=2228,i,17240256942901337901,2764781681492244726,262144 --variations-seed-version --mojo-platform-channel-handle=5936 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5624,i,10137601232851989188,6906154816230744954,524288 --field-trial-handle=2228,i,17240256942901337901,2764781681492244726,262144 --variations-seed-version --mojo-platform-channel-handle=5632 /prefetch:8
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3380,i,15181336368258931272,11593681548070768052,524288 --field-trial-handle=2228,i,17240256942901337901,2764781681492244726,262144 --variations-seed-version --mojo-platform-channel-handle=5364 /prefetch:8
  2⤵
  PID:3152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3516,i,12414309124251955431,4809912286036514296,524288 --field-trial-handle=2228,i,17240256942901337901,2764781681492244726,262144 --variations-seed-version --mojo-platform-channel-handle=4252 /prefetch:8
  2⤵
  PID:1516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5348,i,16645772492287682341,13135304160240380948,524288 --field-trial-handle=2228,i,17240256942901337901,2764781681492244726,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:8
  2⤵
  PID:460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6568,i,15728408265142068147,9847738370291938309,524288 --field-trial-handle=2228,i,17240256942901337901,2764781681492244726,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:8
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6728,i,8654087167099000447,2399758657293616529,524288 --field-trial-handle=2228,i,17240256942901337901,2764781681492244726,262144 --variations-seed-version --mojo-platform-channel-handle=6736 /prefetch:8
  2⤵
  PID:1468

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4060

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 337373c4da28ee3002914faa7f66bd64bd0d39f2478ab28111896aef3d732e8e
MD5 1538b94629725dbea32dff25f55639b2
SHA1 133e292c7d10ee2edc74eda507e40b826be644bf
SHA512 ace9ab652f654068c864bb79cea4a34770b9e3e2dfeab9c984cbcd6625ccf3ed273271281737948f7076a7204abb9af1697268a6d42c8b81e2eed910356306c4
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7+:fwUQC5VwBIiElEd2K57P7+
TLSH
T1DFB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0382957c99791bbf37f0a292a68a688ba898893f53c7be2d420d0abfa3205949
MD5 80e81afd519a94b0e3f1e843218d3393
SHA1 093d55b2a0251e8969cd893db151c2617d83ebb1
SHA512 192644826f1731a384b4a8a62d6df749510036d4f447f976a99b3b16ab73b188a9f8602e8e5e57f53a4ecc919d28bd8b5b97a0d5dd2b3cfaa58fdd196e2db9a1
TLSH
T148D08033364D6002D7A573B3D447CF45175E557415525601F124D54CD6F50C49397686
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 eb6e4c3c1ff9ed97bb67aeb0d434ffe02961fef2204006156de0c8016e804f8c
MD5 ad47d0f507ef049d8589a010a5742cb0
SHA1 b6cd0d47a5138ac8c4b9f43cfb419391ca142fa6
SHA512 8347fe69939685ced24d8db2ac65a696d817ae5d3cc9eaadabcc077032027d0ae50a34c8744211ec16388506f4257888fbaa081dbfc2aa366d9e0e40c78e2b89
TLSH
T1ABD08033368D6402DBA573B3D447CF45175E557415529702F124D54CC6F50C49397686
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 d59482268af572a82f6258092d5626fbd37cdf31b41373047a0cd0a2596cc453
MD5 bbae7d2e39fd4e8d15c3d0b6753174db
SHA1 64a1d23fccbf76f3921e30f3f14d1ce1d8f74d14
SHA512 f8d971826f0d65fe86cf58fc392faf12c595d16e357bd9274b7dc44370bbb261bebc783d80d4572b5c076525c48668277e3e36e3dfc517c8046013961f46b208
TLSH
T101E0209414C4C21D990464879278B70C45D1370ED6C4AADD570188543106855FBC3AE0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 29834e66d04a8d341441d070ebf28d1cf5edeaa2482cd5b1aee72e0eff2a99fe
MD5 bae0ba4d411d5d882710ab3c55ab8f37
SHA1 36e61ead3311822a96db05736131e012f5c2f442
SHA512 bc2e3e8a76cd650308d9482d7d9c09959bea211cf04ee978b065833557b8be23e4ab100b659fd7154a805d817676aab855e350c3b44f81cf94bcf682c2ebd5ec
TLSH
T15FE0208409C4C61E950C654B52B8B70DC2C0360AD7CDFA1957018CD9310285266C2A60
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 e69a2aab0a5fcc5cc45f52dc469b6913c726f196ec47b70d7dac9d7a90942c5c
MD5 9ee533108408c2b88b221f8c44834396
SHA1 683cb686c2d3ef480a113a5b3968cc484d72fe8f
SHA512 0473e4a0db805231f970ff8533985c1c38d652ad43272d10c88e6aae64cbc3f47c78fe20439bf29e9d87158213122218b4e0880d28facfcb28675a574b1f069e
TLSH
T1CAE020792284D5DC690197C7A07F735840D2B109FF4CCEF93204E0D625428136B54FA6
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 3162af488c283bbdb6565f4200727821b4e60ce0c47948b8d5b3655271a2625a
MD5 7b9f1e9c5ca7be7a0fd051116a616b72
SHA1 8a88b30a2e0c8a2c94e5512f0a5bb56573a6d8b9
SHA512 2c13705b178f640305a8b7685e6b6a7e49374c53b0713e7e54da2205c3c290a3f79ad3280c111728c5383ffc23941c73a23b34049e67b876aa1915e6e2992364
TLSH
T183C08058798C845DC280187FA726F400177155115817962705A1FCD031406A01F2D124
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 2d4d1e4b5fee564f568d882b605bb2bc52b79ed8d48f3dc6a257abfb27f45f31
MD5 947311dd3d5ece546b433c56d92fb642
SHA1 eb7ad62dfe73b2dee10fabcec33f13b2683f786a
SHA512 619c26adb3dd037f3ae0601b0f432668b51a8d32e2a748bd7ee7f61b892b9a886bc2c7384d89267ea0fb219874e41a1100fc93f3067e472c5e362f88798639af
TLSH
T121713A26124387E4E351FE32B0F3AE9E3571B9FAC90B3F8A25A454317709362C56084B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58ca60.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58ca60.TMP
Size 3KB
SHA256 01bb5d05d9db1ef8a15117234d8f292a01efa6c048841cb86580addc4ceaaa38
MD5 a6a589cebf11766eb5bffeb30a9030d0
SHA1 8a6e9f3d0c786420180704ffc4b27861a87204ef
SHA512 3455b5046a36333f58aa77593ee08db1f9a71c412988ae4e82536e9cdd66e5677f435fe8fcf3e14eee25acb1646b44954be0095e261c205f8a781366db5c4a1d
TLSH
T1F2713C26125387E4E351FD72B1F3BE9E3571B9FAC90B3F8A159444717709362C56084B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 949B
SHA256 035d38e4a25ad2c93e4ed76d985f0414e4eeaacb47190d5939457a35c0bfaadf
MD5 7fe0daefe55c82bd3d090d4ebf7d9fe1
SHA1 d24052ff2f39831f946b26e4c09a355afb92afd6
SHA512 56b9744d3c513fb4c649513e1ee4116520cd40cac022a457e3ca2c303e0c16117b922410ff460674cd8c2aa14be69222d207a242847f8a4965268e405e321f7f
TLSH
T1F7115BB3C7D5856E891156F05A24EE2BDE2D050582187C2589D4FF2B93F3466E10255B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 293d529f17ddea6adbc8c00c70eadf1b32c6175be841e116367e312497c99a9d
MD5 806a7b010ad1957b276bca42c2059a74
SHA1 8eaffdfd38b342b03a7ea20fe3d67d1a0075f4a1
SHA512 d88bef8b87ba6061c739368795c416cd97f98b0a7c3d276cddf4c467a8cc407c8a3cd436e102c242b4070ee7e997270c3e580155742e593c1a8e93902772e41c
TLSH
T16A21BEF783E185AED91156F09A14AE2BCE1C0505821C3D6A8AD4FF67D3F3071E102A5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 18abd35fd163154950f820c9ba85b4e006eada1e6ec92189556269243c0e4d4c
MD5 c888c6362ad4a8d3c99393ce5bea0f30
SHA1 3fb64244b6bf7a95221f8c60bca1df4982c803c1
SHA512 18e0b059625c4bad328ed218f026e0e0b5ff31d4220c57584ce7065beb1bf74fdc3e6d2a9263fb3fd7d6a426384185e1c6bfaf8bb927496517fd7a27a37c2ab1
SSDEEP 192:sxZnRcyM/jK1Ml8UQOkv/ffsVAzDIdpFtHbT6+WNlWd/Y4ULc+gIg5eJ:sxZnuqlv/ffsVAzczHk+/hPg
TLSH
T1DC52C6116A34997BCCDBD219BA41BF53D6F5447292900E449AFCEA1C05E2BED2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 ef6c328cb3f91c28354120d2193a0238b2ccdfa862daccc9fef26122b16bff40
MD5 ea3ebb23d2e1b4b2ba468599dbb3a29e
SHA1 3a94c879ef8c0e649c52a2d9d96d1f819b4d2522
SHA512 c2cb8ef70a1d942b001bd2b912009331512a07214697defd9c72f5531c2d5069552992a326f5372edbf5148bb8accbcc294f5eccf4b42c8b3dd2b3f014695774
SSDEEP 192:sxZnRcyM/jK1Ml8Mkv/ffsFHzDIdpDtHbT6+WNlWd/Y45Ac+gIgrJ:sxZnuMv/ffsFHzchHk+/3P9
TLSH
T17C52E7116A34A97BCDDBD21DBA41BF53D6F5447292900E549AFCEA1C04E2BED2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 6c6d439e725ff98586936ca237da92fe86f1fd5e0bd0bc2b13bb9c78a5f38d2b
MD5 0234b2c900c399aec048779bf3275dcc
SHA1 0e8f836a0fa5b518627983c76d2097ea2de6dee4
SHA512 b1a2a2b1c3874539821883b63a5e7731ed5ebec161462cc9de842d725e36e204b0425e1dcc312b911c43471772d2fb7b8510f74c2343186a441e0949b7b0d629
SSDEEP 768:wVEPO/KWvWeI58F1+UoAYDCx9Tuqh0VfUC9xbog/OVKqLlBHu1DroAkGSk:wVEPO/KWvWeI5u1jafqLXO1w+Sk
TLSH
T112D20A3B680CCB7E4F840E9DEC26AF966ED801CB67984D5447FA884C03C77EB511699B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\67e80507-316b-45f9-8f16-d70efa58e597\index-dir\the-real-index
Size 1KB
SHA256 d567fa865a29675c20dfc23fd35b9694278b97bd0364090052ecb7464880031a
MD5 f2146da37e2bf244cda7e9c7a1f15ba1
SHA1 a66b48ce0f836542742a530ac6678d913726d5b3
SHA512 ba02f839611aadda34508380c35f0dc6dbdb9eff0aa148493dfb7f3a3701d9f0a5fa84fcc652cfe46f7adc388ca3acdcaf6611c1b4b77d9e6239ccb0e4086860
TLSH
T1A431478DCE51865FDC6448B2147625B833B0D9CC171162534C3C763B7D6736E1A9B198
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d1f71.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\67e80507-316b-45f9-8f16-d70efa58e597\index-dir\the-real-index~RFe5d1f71.TMP
Size 1KB
SHA256 83db466690b9b797ac9505deed75ef36efef14a0aa5e4b2cdd0bd498811958b6
MD5 925fb7d501e8b54f5efa1c853efaaf53
SHA1 1c8646047135fd179206baa0d86435d9c7a47be4
SHA512 db7fbb4f83508a82a725f6de068d8ecb29059fe046628d37cf1a425615d2a8a9877bad2a46036a4f747777e6bc36c00b910db75e5ae127a6402798956468c666
TLSH
T1C031938A8A418A1FE8D400720997A4B83379D9405312778798BD6239BC753BD1E5F0C8
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 4ceb09dd117b9ff98a691e2dc2ff3ef141ebee8aa8dd66ec552a119cbf7241c4
MD5 749c96de333f148bbe096622ba0182f5
SHA1 b3b8c523de60eef5acd0870c684ef98363b47678
SHA512 109d69c942df73fe133e6d39b90e2c86de6655ebeb7987056e63122c5b30804a4c6ecfea573d8b7a699080f8c814d6a01e0eb25081738879e5b708b509714463
TLSH
T147E068B63CB71C20FC6BC3C2A47054A405667A688A00AC8F141AA2CB30F1324344FC62
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 7820173d958591b86f48b62a89db5f7084f22f185aa616308318b1ae857b8f0f
MD5 952a85f38fcfe3e7c7afd30b0f654795
SHA1 9395bc1b45a56f1dd9e5eb269924169e71907f38
SHA512 3e631ffe4d4f2226b4bd2fd90f6b278b330853baa88b822b54a914f0069f7fab1a4064b1ad0dd2fc9ffd3f07ea425b179c2cf031a089d5761608e5d4f5a4dbe4
SSDEEP 96:KITKKMsOQl6J17HzEDHIvJNEKRhJTE9V1o73KkKf6WPz:sxPczb
TLSH
T184916112707A02513C7F291C91A686770A4271733119E67F7BAA08B60F67E6A4CFDDCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe596a59.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe596a59.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 6a6bbb0e3e27234903e3948e6885b00516dbdcd17c33d731ed4cc7ce92eb75f4
MD5 61913aba29cb2acf40ea87b6223aac2b
SHA1 3670d25f316f6aa85c5a253397e00f86df202fc7
SHA512 45ec26ac46f036d979287ee4c2ecd07cab21dd667c1c9c22bafae883f4278862205bdd546408e245e58f3c51f12d7d77fa7b76c3b12cf2dbfbd2ede4a735f191
SSDEEP 384:XZcIhsNMUkeLYi+9VXq6U2HHxXr+/XEKqfPbQEiJflBTNsQBuL:fhi+nNr+/XERPbQEixlxBuL
TLSH
T129927D72AC34AC775DABB246F44A36139FB49167D7886F8099EC7B1C01EB65C030AD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 a399410af06c22efccfe8d6ded2d0f544b893f47bf659327d1c4558d6ca32d0a
MD5 e482989d3d28dd260ae76ac9931c9985
SHA1 a3b36a429aff27f2d08992d9562a7fd3b62a5152
SHA512 0f9fe7252e0abf6775b147c1d72a835514cc4ba04eec49c94535feb121e9692910b07c279f750e4e34c02d0df5bce629bf19426b5c4ed2f0ace1ccec89d117d5
SSDEEP 384:YiFiZcItzsNN8TUNTUlIlkzLY2+9VXq6U2HHxXC+/XEKqfPbQEiJflBTNsQBuL:jFQVUwgg+nNC+/XERPbQEixlxBuL
TLSH
T166D24BF258E79836DD9E5747A77D2D038EBCC067B544AA80B7982A1CCC9617FC30AD21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 808860d03bb4906de03b16cccbbc5ae8c1ed75882db6f2016d461d3dd3a66690
MD5 7a93dbe7068a7e7e416fe2869a606ef2
SHA1 32807e0691ad9b0e881a4eac48067cb03e8e2b76
SHA512 3bf52df62456f282c9c253f28097c430dc33673597f9580d75cdb09ad7de1f5516912ac6eca34235e54eefdcef4709a208edf24a952f8fba0dd35920732c35c2
SSDEEP 192:mON66rvoQmiUycKvDrKhD4XqMB/1jajzonMKHGExMjU6:mON66ca+6Xq6U2HHveU6
TLSH
T19F02D835A8786C7B9AE7AE49B48B3B135FE4202B96947F84DAEC1B1C00D765C1306D37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 4fa70403cbe0c37dc67ff3351f5847faae032be0ba93dcc18a98011e820cc01a
MD5 7d88c2e455418a3246a7225e54dc3edd
SHA1 f9a983d41b1384abc7c70fa581c47f507960fb0f
SHA512 279b2fac1a5f9c274870d5181e6adb36ee162458eb3c9a9c1951618698947a17154e05deb22029771cfdaa4c04aeb7eba48011fff66759bb28f8e21698f1fdfb
SSDEEP 384:rZcIhsNMUkzLYi+9VXq6U2HHxXr+/XEKqfPbQEiJflBTNsQBuL:zhl+nNr+/XERPbQEixlxBuL
TLSH
T174927D72AC34AC675DABB245F44A36139FB49067D7886F8099EC7B1C01EA65C030AD27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 82ff3ae62c5edd96d1c8dd3bc867aab69eeb71ba0ec3b5adf8c43b2266b5d4ec
MD5 e07e2a1b9c94a770b202bfa5729cbc09
SHA1 3d354164c9486fa290ed920124eff03fb71156c9
SHA512 b1d824c3b8f6a4a1abeace939d34fa5131097f9e160d55b0b1a0c93f5ab30915ce6bec1b426d013fa8ea70a05bb5983b477e62380355ac02d88a31e90adc62ab
SSDEEP 192:dONG6rvdQmiUyKvDEhD4XqMB/1jajzonMKHxX+hICdqSMU6:dONG6/9E6Xq6U2HHxXo+U6
TLSH
T1B312FA32A828AC7B5DD7B645B08735035EA45127DA897F90DAFC2B2C01DF65C530ED27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e3113ad0-e0e6-4cea-a86c-ea1d7cc67ab8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e3113ad0-e0e6-4cea-a86c-ea1d7cc67ab8.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 1bda33672f6645762359d84e0df650f55678aec60089c9b74eefe12e0da98c6b
MD5 b5dd6fd0d9547d2d4bc6df67cac79220
SHA1 dc67482fe4d729a4c521cd4e0d28f585f629c949
SHA512 971da36637e167a87f71ee8e4fdaaef4584f61692d5e9cc8f05bb9efc501c228c1d6be9fd29f18aa85fcdc1661684458c927078f7d9c8fbf503e7472075156a7
TLSH
T160412658A6E91148B3777E5AABF6A86D487F78772E07909D10110D4F0A36F40C8B1B37
MD5 SHA1 SHA512 TLSH

Submit Download