hxxps://www[.]mediafire[.]com/file/gv45druxjesxm79/Extreme_Injector[.]rar/file

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
07/08/2026, 11:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.mediafire.com/file/gv45druxjesxm79/Extreme_Injector.rar/file
Sample260807-nc2n7steka

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1992	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134305749710587132"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{7F61FEE5-4CBA-4EC0-9130-6660710503CE}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6108	msedge.exe
6108	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 13 IoCs

pid	Process
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe
2372	msedge.exe

Suspicious use of WriteProcessMemory 56 IoCs

description	pid	Process	procid_target
PID 2372 wrote to memory of 4568	2372	msedge.exe	86
PID 2372 wrote to memory of 1992	2372	msedge.exe	88
PID 2372 wrote to memory of 1140	2372	msedge.exe	89
PID 2372 wrote to memory of 2140	2372	msedge.exe	90
PID 2372 wrote to memory of 1140	2372	msedge.exe	89
PID 2372 wrote to memory of 1140	2372	msedge.exe	89
PID 2372 wrote to memory of 2140	2372	msedge.exe	90
PID 2372 wrote to memory of 1776	2372	msedge.exe	91
PID 2372 wrote to memory of 1776	2372	msedge.exe	91
PID 2372 wrote to memory of 1776	2372	msedge.exe	91
PID 2372 wrote to memory of 448	2372	msedge.exe	92
PID 2372 wrote to memory of 448	2372	msedge.exe	92
PID 2372 wrote to memory of 448	2372	msedge.exe	92
PID 2372 wrote to memory of 3672	2372	msedge.exe	94
PID 2372 wrote to memory of 3672	2372	msedge.exe	94
PID 2372 wrote to memory of 3672	2372	msedge.exe	94
PID 2372 wrote to memory of 1260	2372	msedge.exe	95
PID 2372 wrote to memory of 1260	2372	msedge.exe	95
PID 2372 wrote to memory of 1260	2372	msedge.exe	95
PID 2372 wrote to memory of 3452	2372	msedge.exe	99
PID 2372 wrote to memory of 3452	2372	msedge.exe	99
PID 2372 wrote to memory of 3452	2372	msedge.exe	99
PID 2372 wrote to memory of 4148	2372	msedge.exe	100
PID 2372 wrote to memory of 4148	2372	msedge.exe	100
PID 2372 wrote to memory of 4424	2372	msedge.exe	101
PID 2372 wrote to memory of 4424	2372	msedge.exe	101
PID 2372 wrote to memory of 4236	2372	msedge.exe	102
PID 2372 wrote to memory of 4236	2372	msedge.exe	102
PID 2372 wrote to memory of 4236	2372	msedge.exe	102
PID 2372 wrote to memory of 2172	2372	msedge.exe	104
PID 2372 wrote to memory of 1796	2372	msedge.exe	105
PID 2372 wrote to memory of 1796	2372	msedge.exe	105
PID 2372 wrote to memory of 1796	2372	msedge.exe	105
PID 2372 wrote to memory of 3436	2372	msedge.exe	106
PID 2372 wrote to memory of 3436	2372	msedge.exe	106
PID 2372 wrote to memory of 3436	2372	msedge.exe	106
PID 2372 wrote to memory of 4516	2372	msedge.exe	107
PID 2372 wrote to memory of 4516	2372	msedge.exe	107
PID 2372 wrote to memory of 4516	2372	msedge.exe	107
PID 2372 wrote to memory of 3340	2372	msedge.exe	108
PID 2372 wrote to memory of 3340	2372	msedge.exe	108
PID 2372 wrote to memory of 3340	2372	msedge.exe	108
PID 2372 wrote to memory of 3492	2372	msedge.exe	109
PID 2372 wrote to memory of 3492	2372	msedge.exe	109
PID 2372 wrote to memory of 3492	2372	msedge.exe	109
PID 2372 wrote to memory of 4648	2372	msedge.exe	110
PID 2372 wrote to memory of 4648	2372	msedge.exe	110
PID 2372 wrote to memory of 4648	2372	msedge.exe	110
PID 2372 wrote to memory of 4112	2372	msedge.exe	114
PID 2372 wrote to memory of 3112	2372	msedge.exe	115
PID 2372 wrote to memory of 3212	2372	msedge.exe	116
PID 2372 wrote to memory of 4696	2372	msedge.exe	121
PID 2372 wrote to memory of 4696	2372	msedge.exe	121
PID 2372 wrote to memory of 5424	2372	msedge.exe	126
PID 2372 wrote to memory of 5424	2372	msedge.exe	126
PID 2372 wrote to memory of 6108	2372	msedge.exe	128

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.mediafire.com/file/gv45druxjesxm79/Extreme_Injector.rar/file
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x24c,0x7fff6b8ec188,0x7fff6b8ec194,0x7fff6b8ec1a0
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1764,i,11391461279253379546,6642257597555307319,524288 --field-trial-handle=2608,i,5708509194991763878,3497224214040778102,262144 --variations-seed-version --mojo-platform-channel-handle=2692 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1620,i,11769589200245129726,9860917179518249873,262144 --field-trial-handle=2608,i,5708509194991763878,3497224214040778102,262144 --variations-seed-version --mojo-platform-channel-handle=2604 /prefetch:2
  2⤵
  PID:1140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1988,i,3800169937863618956,8911639451057007392,524288 --field-trial-handle=2608,i,5708509194991763878,3497224214040778102,262144 --variations-seed-version --mojo-platform-channel-handle=2700 /prefetch:8
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,6131908253168215753,14295808724580952330,2097152 --field-trial-handle=2608,i,5708509194991763878,3497224214040778102,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:1776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,15566911960539053668,3257544452587745498,2097152 --field-trial-handle=2608,i,5708509194991763878,3497224214040778102,262144 --variations-seed-version --mojo-platform-channel-handle=3424 /prefetch:1
  2⤵
  PID:448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4040,i,10092808958886084014,2554216340397786322,2097152 --field-trial-handle=2608,i,5708509194991763878,3497224214040778102,262144 --variations-seed-version --mojo-platform-channel-handle=4116 /prefetch:1
  2⤵
  PID:3672
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4052,i,17934531061569834975,16534044270669167450,2097152 --field-trial-handle=2608,i,5708509194991763878,3497224214040778102,262144 --variations-seed-version --mojo-platform-channel-handle=4128 /prefetch:2
  2⤵
  PID:1260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4940,i,17463882690108783988,5719595383555194178,2097152 --field-trial-handle=2608,i,5708509194991763878,3497224214040778102,262144 --variations-seed-version --mojo-platform-channel-handle=5080 /prefetch:1
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,1208693710179594450,8771187624140381660,524288 --field-trial-handle=2608,i,5708509194991763878,3497224214040778102,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,9039901714316037936,11334111861307570694,524288 --field-trial-handle=2608,i,5708509194991763878,3497224214040778102,262144 --variations-seed-version --mojo-platform-channel-handle=5280 /prefetch:8
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4928,i,9450162099935577991,16306527608681221125,2097152 --field-trial-handle=2608,i,5708509194991763878,3497224214040778102,262144 --variations-seed-version --mojo-platform-channel-handle=6268 /prefetch:1
  2⤵
  PID:4236
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6644,i,16992236179317389941,9187059267952419454,524288 --field-trial-handle=2608,i,5708509194991763878,3497224214040778102,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:8
  2⤵
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6644,i,16992236179317389941,9187059267952419454,524288 --field-trial-handle=2608,i,5708509194991763878,3497224214040778102,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:8
  2⤵
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4960,i,9691915362479058050,3867882926948664727,2097152 --field-trial-handle=2608,i,5708509194991763878,3497224214040778102,262144 --variations-seed-version --mojo-platform-channel-handle=4908 /prefetch:1
  2⤵
  PID:1796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6988,i,13549086476194716545,3753243302812210692,2097152 --field-trial-handle=2608,i,5708509194991763878,3497224214040778102,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:1
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4344,i,10571879932709167002,3465972697955811542,2097152 --field-trial-handle=2608,i,5708509194991763878,3497224214040778102,262144 --variations-seed-version --mojo-platform-channel-handle=4328 /prefetch:1
  2⤵
  PID:4516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=4940,i,3505180802392299723,15881159610412689756,2097152 --field-trial-handle=2608,i,5708509194991763878,3497224214040778102,262144 --variations-seed-version --mojo-platform-channel-handle=4348 /prefetch:1
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=5792,i,5630766123670738560,14548959951294356297,2097152 --field-trial-handle=2608,i,5708509194991763878,3497224214040778102,262144 --variations-seed-version --mojo-platform-channel-handle=5840 /prefetch:1
  2⤵
  PID:3492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5776,i,11982863084268049060,940232017340231454,2097152 --field-trial-handle=2608,i,5708509194991763878,3497224214040778102,262144 --variations-seed-version --mojo-platform-channel-handle=5796 /prefetch:1
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6724,i,6017421350593174544,18112464990091303613,524288 --field-trial-handle=2608,i,5708509194991763878,3497224214040778102,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:8
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6716,i,15917524127262038101,7559200367181688229,524288 --field-trial-handle=2608,i,5708509194991763878,3497224214040778102,262144 --variations-seed-version --mojo-platform-channel-handle=6720 /prefetch:8
  2⤵
  PID:3112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6712,i,15023127106464193651,8191923305917779277,524288 --field-trial-handle=2608,i,5708509194991763878,3497224214040778102,262144 --variations-seed-version --mojo-platform-channel-handle=7324 /prefetch:8
  2⤵
  PID:3212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7444,i,5447478576435382990,3877752564922714841,524288 --field-trial-handle=2608,i,5708509194991763878,3497224214040778102,262144 --variations-seed-version --mojo-platform-channel-handle=7436 /prefetch:8
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7240,i,13729360958179536190,2709233023919928133,524288 --field-trial-handle=2608,i,5708509194991763878,3497224214040778102,262144 --variations-seed-version --mojo-platform-channel-handle=5584 /prefetch:8
  2⤵
  PID:5424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7588,i,15238226988914475238,17856165241565023871,262144 --field-trial-handle=2608,i,5708509194991763878,3497224214040778102,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6108

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3776

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 cc6205dfc0ad92d30fb9ee805c729d53c836cff0462f2e045a52fbf9353b96ba
MD5 f562913e5926d98801f903f9ab792282
SHA1 8891dadd21fb366e56ca3e18b52a40681e1c6bd5
SHA512 4b1aaca6f81fabe0474d092b453cb6d7540505c123db6a819cbbd5d6f8b61b43326519262ad010d1ef93e3bc712b9067ba041231fbb887f2053b2fb964c01056
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7w:fwUQC5VwBIiElEd2K57P7w
TLSH
T12AB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cd640af4b18734f838b65cd3f2b65e25dc669e7cc487a16f826240b353446af4
MD5 337b94f0014654439210355bd20e82dd
SHA1 26e4c8276331781253e2a807dd554b2ee3ad7e8e
SHA512 087107a51c83ccffad34c7d3f5423a0f231d30a9f78e9ed5db98eb770bada291f65c7b34d1e72284571b846a7acdf88b217ef4da25b7acff47964af1551b2e9b
TLSH
T1B6D012323B197041E71A8130E403C74017AE54B524864606A254C50D6DA90C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85f865adbe5e58c0596a4db9b9daa509b8e2bd087dbcc9a01a5a095a266757bc
MD5 29ddc94c4e214fd03f664130dd36edfe
SHA1 10dfd57508ad6ef16445956dc1ee4d8c2bffc4e3
SHA512 fa7477f3f8068f41dae4965a930de8ad11b234c1ccfcd17a84fb2bfe4c289beebc19be8d058f75ed01b6dbe7304af8270da91d31316fc94360f4fa750ab203bd
TLSH
T13AD012323B597441E71A8130E403C74017AE54B524868706A254C50D6DAA0C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 5KB
SHA256 fdbaf8a5437dbe60cf9a36b57d936a09e8fca2b50adba96002c5d9c678d684c2
MD5 46a273c33233f00dfd53ac58808d9017
SHA1 3dcf747c6fbdc62cedf60203c79be476c3b11ef3
SHA512 9f13a64e92ee2caa78c24289d0c0c9f90c554e4904dfe91fe9c67ed767222c2f21a1a8efa129aee667f063d887b8757e013ce5f767b834357f5c6da27009fe67
SSDEEP 96:/B8OAt80dik/0zUtTSd2BADNdPZfndbRhsu/v0:/Bhbu0STM2BYNdP9ndbX1H0
TLSH
T115C193300892F069EB034636FAC2C85A767185DBF53F5DAF12944EBCDDC63F18299822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 5KB
SHA256 a53501e412f5f59e1436a8f8b831c747aa2e55596b526c4d4d20124173165e20
MD5 b5d7678479ba00f7bea4d7e6155110d4
SHA1 0178a64c23e0a7beb24f68f81e03c253fbbed78e
SHA512 637310e07a0959fcf24994bead2905430721500c546628b956f2dcf1b5127eac8d07aec6bfb25f114dfdf3f9aa8c23dbd23eb3b10b9e0ded90d8446a16268378
SSDEEP 96:Yb8OAt8xdik/0zUtTSo2BADCPZfnTbRh5uOvf:Eh+u0STx2BYCP9nTbXguf
TLSH
T144C173310842F069EB024632FAD2C85A763185DBF53F5DAF12904E7CDDC73F18299866
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 cb269c7e2f0ee20b204d3b8985eb4d882594fc7e9609c5ea5ebfe0883a41b155
MD5 247d422c179a78fec7366ced2086b660
SHA1 e247a113f4a04f4f5e0da4d8a6b9f3b775099535
SHA512 4c2c1dc61d2da49d88a57206a8f30e75e0a6c27e4591f79249faf58eac9fc191bfad0c461f552e1691323a91d4f18ed5d53bf47e1bfd7252218f9ecafdad673e
SSDEEP 96:S8OZt8kOik/0zUtTSo2/ADCPZgT8Rh5uOvy:SGeu0STx2/YCP6T8Xguy
TLSH
T1BBB172311883F029EB025636FAD2C85A763185EBF53F5DAF52904E7CDDC63F18299862
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe590a95.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe590a95.TMP
Size 3KB
SHA256 6e264007258653a8b49a40e725c710af5ef9ce46b27675d2411c5c12650cf1ea
MD5 192184117375d7fa36f706c0574a8752
SHA1 60d08a0f043f63edfcb85dfc07cc8d3dc07a5d5a
SHA512 48f097183a6db37348bb8980e306d856dd706a7eb2de4655e2ab6515ab3bb8c2e828c05b1f04086cae9acecc998868b2b62730dbc1b4e484e6fa3c95590b6e00
TLSH
T1F97193350A534268E7670332EBD2C51A727186EAFA3F9DED24D0587C4D0B3F1815A567
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 28KB
SHA256 e242d68b033eec298e1e0473bd35b456af8112d464c761f8af502150eddf36f3
MD5 5d6eea0c76ac1ff7596073d321b7ff03
SHA1 ae4bc3f6478f3ecf3059505a5b808228fa554fb8
SHA512 70f7db439eb903e251ffc77128d960ad4196736d8df4ab800d36b1575884e1173360c8aad697f2d5aeb732f84c0a7c96579effcc3b1c912ae9db43cb53d82b09
SSDEEP 384:DIErrWbKnnewe0KRefFbBcBee5erIpJBJitevMe9J0femBeubnRRJfj14I9yYPfw:JoXFCtUWPQSM/+sfNRo7dUeWv3
TLSH
T174D288F383E5E56E89011BF85A106E1BCE1C0719432D3C2689D5EE87E3E2472E16E65F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 778820a0f724b283979c9a01685c9c5fecf1d66f9c5eb3addf8d4012723e328b
MD5 8d0522520b83613892f3d6692f79e21a
SHA1 92d085be3c6659a5cd005802d6b4da8539553bfa
SHA512 2d077871aeac0f52bba497e2d3f048eaf4ccc8a3723fcb1bc2998e916eaa0e72b8be2e3d7706faed55fd40bd601e71482186c64834c22f531a9fbb74a68a551c
SSDEEP 192:sxZFRfyM/jK1Ml8Mkm/fAslV2vDIYBg1p8YHW6+WNmLI/YzvixMhhIgrJ:sxZFRMm/fAslV2DaxHbp/zG9
TLSH
T12C52D8526A34A97BCCDBD209BA55BF53D6F5447292900E44AAFCDA1C00E7BED2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 18c2f24764dd44952e527e94ac57ef5e5b42438c5716171fffed139f36e87a98
MD5 6a428d956762b2a417cae167d690c51f
SHA1 6a7b1cbc8c45e57de3584670fce9c470f719d0fa
SHA512 17bebe5658bd5060c2ae9121d11f08fb97b0af6cfb68cf724657a7578633457c2b32593735445b89ddb395af46a3b5d03f0e403ecab7aafc5881b3c475ad1063
SSDEEP 192:sxZFRfyM/jK1Ml8UQbkm/fAs7VuvDIYBg1puYHW6+WNmoPXYzJixPhhIg5WJ:sxZFRqwm/fAs7VuDaDHbVX1JY
TLSH
T17852D752AA34997BCCDBD209BA45BF53D6F5447292900E44AAFCDA1C00E7BED2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 3b4b153b2cc14688dcf9a88059f5cdd893ae0fbb4d73eaa8ddca3e7e12756496
MD5 ab1ba29fed4b0ca2f3efa50dbffd4acf
SHA1 e7052b062f01e303ed08e1f9dc275eacc17c3a1f
SHA512 3824f061a5dfcfa4d46fde6285e2242c4656d8644f458bcca81aa800972ac1afb2f401f445b7a973acbc2064326e481398662c8be6b6df1c615ceafb72d9d871
SSDEEP 768:fSW7kf0Wvqina8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX5LlWYSjcroIp0gYd:fSW7kf0Wvqinau1jaa5LA3jHpd
TLSH
T1BAE2FB3B684CCB7E4F840E5CEC266F966ED801CB66988D544BFA884C03CB6EA51175DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

16385cdedd97981b_0

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\16385cdedd97981b_0
Size 63KB
SHA256 31f4229d2091c8d4b37a3a58ed11bd243ef4ec539bba9d6dda95c33396fab239
MD5 a84c8371f76ee8e6ce8a7d2bf12e3082
SHA1 dd95b3e06019603efa75c11b0a0d3b97ebd94e96
SHA512 4daf19226e148f803ec4f565d99e5db3aed24273e0edd1a46cb6396fca602f34f239b641cb0503a72a2c0383e10426f059eb4f0da1136fb62e7e375b3bd416d8
SSDEEP 1536:b8k3vI6lZbRXxyqxn4Y473+KrYF03iRNjkv:b8k3vFpxh4Y473qW
TLSH
T111536BA6337178B3427BA1B1906F130B713EE5A7F40484F8A198EDF45E44A960267F7C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 7faf382c8da487a17eea7efde8b80d3113acd3b121631cff16ed47db7cb609ff
MD5 c49452d7de19fe89130f3ea513f9a7b2
SHA1 1fb856241fde8e2381b067e7c5000a34b8c85db8
SHA512 8b4a214ae9f9516ae29f6a328359bab415236b1b4d86d9fe63428c083aaf2b95d9bc485d39d050e3a3997ceb510cc9dc46680bde56c7f4822c80d6234c8c36c7
TLSH
T101A002A042517469D45682702ED311B13356481C5315066689D4005EC8981D2D50225C
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 db0abe9239aba3e21b20b692c3c1f1d3c65d793832c3a831c156c481228faefc
MD5 0afa1c9b1140e0382457d6c10efba18d
SHA1 3d8be4e21e6adc9954589418a0452b6444ede057
SHA512 5c3e48df158f04f625e4e045465d4783017d9cefe5d5588cc6ee987cb6c9999bcaaac226d7ea69c3256ee4b8a5e527e817e46b692a44e639c27dc214910a8e32
SSDEEP 48:KfSVOyIQA2aQL9IZy2KYTbEIfKFmc3yZ8ILK9KclbIZK4g:KIbCKcbEQKFmeK8gK9KebiK4g
TLSH
T10B915546713B160138BE2C88A29685374F4231933968A8AFBF7504A22D67F134FFD9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6ca28bc5-8e54-4c31-ac15-59c17a9614a7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\6ca28bc5-8e54-4c31-ac15-59c17a9614a7.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 214ae941995cd404055f62d1aad34ce0df255abdcf0a52020106b203ac527d63
MD5 7ab74a03b403f8b3bb688691e49a5dbe
SHA1 0f2f20fd1cf8911baacaabc818ac7c0c14b0a18e
SHA512 024b1e8056109046babe7c728363affe81c01d80e21ce0141c27dda9c644617f102a86efc86b2e372bcd73eff330b5478bb0b152a01034b15e3d9fb68a748bf5
SSDEEP 384:VZcIhsNvPX/iHbAkkjuPdlhCEJrxuf5Urzg:thlH1kU7hxuSg
TLSH
T1A0928E705C74AD3766E2E581F84737175EF88137E3C42A98E5EDAB2C01AA698170381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f34d2bcd5449540d6e2ed8118f169dce4d308938e8afca388899ae9a671e8c9f
MD5 f5b57cf7d5cfc44c95ef8376fbe17578
SHA1 885d4e1e726c78ac80c975236cb556d30d6c8576
SHA512 e845dfdc3011c371143c3e92f9357dfc3b1cbd3fb8f23b2115a46523a0061a09f7fe4e29a009a19f04c666db44ef079491beeeca7a0009cf1f068deba119a508
SSDEEP 192:MONB64BAQmiUy918W5GBPKDv+FdGEIaD0rU6:MONB6eAa6WAdlxCU6
TLSH
T11A02E938AC697C7B9EA2AE45F88637175FD8113BE6D51F44EAE85B1C019764C230382B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 344a748d76e04157dd544f5f805e2f69883e4469ecbe46038870d853d222c1e0
MD5 629e8e23ead93576b095fc633b84ff06
SHA1 0cbcb90683b413731dc0f953d1acf20ade59a1c9
SHA512 d7b8d9bedf35b7b4a4116e892946a63eaa16a884d0aa23ef1087da61709e23d95683723993398ec1079a92f320779257fab621c019f1be972113cdb9c73ad008
SSDEEP 384:8ciFiZcIGzsNR8TUNTUlIleX/iHbAAkjuPdlhCEJrUuf5Urzg:GFQ2swghHRkU7hUuSg
TLSH
T126D23BF148D79936E9AE9B43A77E2E134EBCC167B2806554B3D89A1CCC561BFD302806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0c924a2f2d48d2b2f0537c1b1b98846bb29e145504622f708c7b7a32c0384a61
MD5 ec0a73ac5600f171566ebca3eb717bb3
SHA1 b0654c2261f5962c07a31850683c64a971ad777f
SHA512 bb8655bf4dd9f8c4a7c7ad0eb7e71bba8c521cb53465538729ada45699f7891e582af9b030005a9006faee0f1dec6b9262225d8a505ecca0ff48737e8c6d91f7
SSDEEP 192:qONS64B0QmiUyE8k25GBPKDv+FdGE1VFC1SJrHWwyqkZU6:qONS6eEak2AdlhCEJrzuU6
TLSH
T1C9121A35ACA4AC3B5EA2B541F48736135EE4413BEAC57F94E6EC6B1C01EB75C230681B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 95f958d101511b51ef89158d2d641a31f27176f4b55ca634d83ffe893574801b
MD5 9901982385b331567399a2504ec3a98a
SHA1 2d0a8a5b7c2a5ad315dd66ef8cc5ac03302b812c
SHA512 cd956a5c55021afdb698d0ec7eae0fa302922d15379a69c9046a727fa66e839ad81628e5a7a307178dc43998dddc3175fed2a224e5dc989f55cca64fb3aa8e23
SSDEEP 384:EYZcIhsNveX/iHbARkjuPdlhCEJrxuf5Urzg:FhSHwkU7hxuSg
TLSH
T16F928D705C74AD3766E6E581F84737175EF88137E3C42A98E6EDAB2C01AA698170381B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 f822a85af9ac2b242cdeff12a9956d4c40d9b7f2c700597f7745f63a41fef272
MD5 1f4348230a0c326fa20e89db42e26c8d
SHA1 ad4559a6e24a4c728f8c0cd57a2d949471617049
SHA512 58f3ff5f54b796adb900e2c64a9667cef36fcfd9304c1869f323ca3ff549ad0f81cdc442cef677ef1209a6ef24a6c5935bd57946439de4a92cd76e76445bf57f
TLSH
T18C412869B6FA1108B3B36F5AAFF7A46E087E79772E0BD55D00110D4E0622B00C871B77
MD5 SHA1 SHA512 TLSH

Submit Download