hxxp://kamtape[.]com

Analysis

user interaction
yes
max time kernel
598s
max time network
588s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/08/2026, 22:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://kamtape.com
Sample260808-2lc9vsff73

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2072	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307024001688875"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{D2615589-F963-489C-8719-C0CF4C39D41F}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
6128	msedge.exe
6128	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe
2240	msedge.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 2240 wrote to memory of 5048	2240	msedge.exe	86
PID 2240 wrote to memory of 2072	2240	msedge.exe	87
PID 2240 wrote to memory of 3984	2240	msedge.exe	88
PID 2240 wrote to memory of 3984	2240	msedge.exe	88
PID 2240 wrote to memory of 3984	2240	msedge.exe	88
PID 2240 wrote to memory of 3144	2240	msedge.exe	89
PID 2240 wrote to memory of 3144	2240	msedge.exe	89
PID 2240 wrote to memory of 5084	2240	msedge.exe	90
PID 2240 wrote to memory of 5084	2240	msedge.exe	90
PID 2240 wrote to memory of 5084	2240	msedge.exe	90
PID 2240 wrote to memory of 4528	2240	msedge.exe	91
PID 2240 wrote to memory of 4528	2240	msedge.exe	91
PID 2240 wrote to memory of 4528	2240	msedge.exe	91
PID 2240 wrote to memory of 4972	2240	msedge.exe	93
PID 2240 wrote to memory of 4972	2240	msedge.exe	93
PID 2240 wrote to memory of 4972	2240	msedge.exe	93
PID 2240 wrote to memory of 4948	2240	msedge.exe	94
PID 2240 wrote to memory of 4948	2240	msedge.exe	94
PID 2240 wrote to memory of 4948	2240	msedge.exe	94
PID 2240 wrote to memory of 2612	2240	msedge.exe	96
PID 2240 wrote to memory of 2612	2240	msedge.exe	96
PID 2240 wrote to memory of 2612	2240	msedge.exe	96
PID 2240 wrote to memory of 8	2240	msedge.exe	99
PID 2240 wrote to memory of 8	2240	msedge.exe	99
PID 2240 wrote to memory of 5812	2240	msedge.exe	98
PID 2240 wrote to memory of 5812	2240	msedge.exe	98
PID 2240 wrote to memory of 5172	2240	msedge.exe	101
PID 2240 wrote to memory of 64	2240	msedge.exe	110
PID 2240 wrote to memory of 1660	2240	msedge.exe	111
PID 2240 wrote to memory of 5452	2240	msedge.exe	112
PID 2240 wrote to memory of 5112	2240	msedge.exe	114
PID 2240 wrote to memory of 5112	2240	msedge.exe	114
PID 2240 wrote to memory of 6128	2240	msedge.exe	116
PID 2240 wrote to memory of 2624	2240	msedge.exe	117
PID 2240 wrote to memory of 2624	2240	msedge.exe	117
PID 2240 wrote to memory of 4436	2240	msedge.exe	118
PID 2240 wrote to memory of 4436	2240	msedge.exe	118
PID 2240 wrote to memory of 1040	2240	msedge.exe	119
PID 2240 wrote to memory of 1040	2240	msedge.exe	119
PID 2240 wrote to memory of 1480	2240	msedge.exe	122
PID 2240 wrote to memory of 1480	2240	msedge.exe	122

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://kamtape.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2a0,0x7ffb32f3c188,0x7ffb32f3c194,0x7ffb32f3c1a0
  2⤵
  PID:5048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1980,i,17718924792724891850,8053568794744069879,524288 --field-trial-handle=2340,i,1110309262747024081,7002874804055539501,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1852,i,10043864360160186969,15989285011556268175,262144 --field-trial-handle=2340,i,1110309262747024081,7002874804055539501,262144 --variations-seed-version --mojo-platform-channel-handle=2336 /prefetch:2
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2364,i,5857353546537017971,267001490019138366,524288 --field-trial-handle=2340,i,1110309262747024081,7002874804055539501,262144 --variations-seed-version --mojo-platform-channel-handle=2372 /prefetch:8
  2⤵
  PID:3144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3420,i,4020741483232289456,625734644043349965,2097152 --field-trial-handle=2340,i,1110309262747024081,7002874804055539501,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3424,i,2369244448008833675,17992944806640759037,2097152 --field-trial-handle=2340,i,1110309262747024081,7002874804055539501,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:4528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4220,i,12402875053556408665,14543829229010086767,2097152 --field-trial-handle=2340,i,1110309262747024081,7002874804055539501,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:1
  2⤵
  PID:4972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4256,i,4397581895052369680,9732874800288359728,2097152 --field-trial-handle=2340,i,1110309262747024081,7002874804055539501,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:2
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3624,i,2107855121929375285,3375355454765669713,2097152 --field-trial-handle=2340,i,1110309262747024081,7002874804055539501,262144 --variations-seed-version --mojo-platform-channel-handle=5104 /prefetch:1
  2⤵
  PID:2612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5556,i,17063881180057179585,13702248380907894292,524288 --field-trial-handle=2340,i,1110309262747024081,7002874804055539501,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:8
  2⤵
  PID:5812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5564,i,13537713545540787788,4978743788096127786,524288 --field-trial-handle=2340,i,1110309262747024081,7002874804055539501,262144 --variations-seed-version --mojo-platform-channel-handle=5512 /prefetch:8
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,13742271693619380462,12818526383690695959,524288 --field-trial-handle=2340,i,1110309262747024081,7002874804055539501,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:8
  2⤵
  PID:940
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,13742271693619380462,12818526383690695959,524288 --field-trial-handle=2340,i,1110309262747024081,7002874804055539501,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:8
  2⤵
  PID:5172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4308,i,13303154737913829906,8730481919070598432,524288 --field-trial-handle=2340,i,1110309262747024081,7002874804055539501,262144 --variations-seed-version --mojo-platform-channel-handle=6116 /prefetch:8
  2⤵
  PID:64
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4532,i,9393395549478103613,18087371873775177734,524288 --field-trial-handle=2340,i,1110309262747024081,7002874804055539501,262144 --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:8
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4808,i,1644237907927344875,7601923723177720487,524288 --field-trial-handle=2340,i,1110309262747024081,7002874804055539501,262144 --variations-seed-version --mojo-platform-channel-handle=6184 /prefetch:8
  2⤵
  PID:5452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5416,i,3872967979190357758,9505341086173115318,524288 --field-trial-handle=2340,i,1110309262747024081,7002874804055539501,262144 --variations-seed-version --mojo-platform-channel-handle=4784 /prefetch:8
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6064,i,15720779271765400611,438662463381852548,262144 --field-trial-handle=2340,i,1110309262747024081,7002874804055539501,262144 --variations-seed-version --mojo-platform-channel-handle=6372 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:6128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5648,i,7896878672267298678,12084442896896841682,524288 --field-trial-handle=2340,i,1110309262747024081,7002874804055539501,262144 --variations-seed-version --mojo-platform-channel-handle=3116 /prefetch:8
  2⤵
  PID:2624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3740,i,17138341617577809083,12091244265359323749,524288 --field-trial-handle=2340,i,1110309262747024081,7002874804055539501,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:8
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6560,i,5298813567816159980,14588810129026293043,524288 --field-trial-handle=2340,i,1110309262747024081,7002874804055539501,262144 --variations-seed-version --mojo-platform-channel-handle=5696 /prefetch:8
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2116,i,7670534529457713125,14362440478785427489,524288 --field-trial-handle=2340,i,1110309262747024081,7002874804055539501,262144 --variations-seed-version --mojo-platform-channel-handle=6420 /prefetch:8
  2⤵
  PID:1480

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:456

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 ca4ac85fa9af9d400600502f608a3f8d8bb73aef8a60227135f105dbe1ac2307
MD5 fd67f6c669d512d4f5409397f5166524
SHA1 57fe9fe38f3185ffaf45d9ead615bedb1359e4ef
SHA512 33fb3eb9c722b4610f37fb197d6c1b499a01cc5837317c4a96cf987a38080a355b423a63a7605516c6e162ee005b1a8e5c3175e684731288f3db35ba4da31224
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7y:fwUQC5VwBIiElEd2K57P7y
TLSH
T124B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 b90e4437812b0799727f15167656f3b97b32b179954692c7ce47009a44ddf9fd
MD5 9c9bdd5770083c39d02373f1cb11e291
SHA1 c04e864be334a6604326d8ae26d6edad55f84a32
SHA512 cb90dff6acec9d80914c43b21be4d40ffba0c30c3216752e9b623ec5eaf8eb95303706b27abbf14e96adb57fb45a3af0a40aaec4ab1b7784ffb395ced10d5192
TLSH
T195E0D8B455C4C35EE618644B6165470C92C0360ADACAE986171484C530C20C4EAC1D74
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 bb2b25743b4df66a2cafcc9ed7f99a0c8142cf0aec0a15d50c21c9462a9704b6
MD5 71e470b84fb3a9fa7f501ba0ea8b5864
SHA1 08fe8bb8a5f872c72e7b755530146fbf9164f224
SHA512 2a10321e463b16ac66ceb4176c230a906080a895443049889b0639028eed40884ce84e6bcdb803716ad5a91ba630feab8e97da49e390e856677b2e6ad4d816f3
TLSH
T1FAE0208415C4C33DF5106ACF6575930C53C07A1ED7CDEA171B0088C53142480E6C9EF0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 51db83ca889769190a633d098a8ec1cc292de80a657d0c422491495a61ae589e
MD5 7da813acf55b5b58e998668cd4eaf4f2
SHA1 d2990011be67bf9f3fc41870fe0b741218cc3bbb
SHA512 4e8859e8598696cd0c6a4a659785815470e4338c7e0f58df7b8b6dc43832e0bffb8401fe88dfe312999187b700d3da05c08760a51c2de74734bcf2cdd84a472e
TLSH
T179616EF8415D4CD1EFA21230E8D1DE0AF4F2AEBA99770FC5E6485ABE2905B20C15B334
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe585908.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe585908.TMP
Size 3KB
SHA256 f0dae4d76951b5ba4982cbe63b6b776d250c374bdd2abc9611a60026877990c3
MD5 603b384a7252f0a8030e9ee9b5f02e0e
SHA1 4414edd42abff563fd1fe357c9fce6bc44524762
SHA512 ffa4a52173047ff0c97dbdf01456d330e32de3a80936094e9b2594f32e94d97f2e61d07f06aa65648e47db5a9515872dae7902228f9ed14130145af370905f57
TLSH
T137616EF8414D0CC0EFA21230E8D19E0EF4F2AEBA89770FC5E54856BE2505B60C15B330
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 b3796278e9804af35f09db95344474d1a85f7b581611a84aa1bf0381db0c99bf
MD5 5b9d8f76b9349a53869947e49a2358c2
SHA1 0ed745e31ff48d913bb4c30d579857dba7e4cf65
SHA512 3911c5510a53b8f94aeaa7616e70707745d003baf1497e3d1d321d775e64c355d88c9c397cd797c9d34da981903bdf93c689df9cc5f7ba206111f345dbde6bb6
TLSH
T1033154B383E5825ED91156F09A18AE2FDE6C0919431C7C3989D5FF57D3E2072E002A6B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 9ea284487edffe06afb251258c99dc6f961b10eda35709e244a76ac4ac4c12d5
MD5 2e24390ee4b65547a4afbb53c01bfc1b
SHA1 92682254db624fd1a0455feb1bf88549ccf6f52d
SHA512 1923875844cdd557ac0318cfbe56f37ff94ce1e7f245389a40d5c2441031b6f37cbce94c484620ff833cb6bcce551b52ac21cc29dfd244736b1e515b7d67c883
TLSH
T1783157B2C3D8826EC81216F05B14BE2FDE6D091942283C2AC9D9FF5B93E2471E101A5E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 d5c684b9db98f9a6602afe04fa50ff8e660d179c686fbad25f08db350ed45b4e
MD5 674bcaa2b0da90bb6ca54666e4910e0f
SHA1 8ee3a5ca7479e05c9bcab14f4408ec8d92146b08
SHA512 3377fb1fb3ad7fd8c6b12b3a4b8ba69aeec77b5e66585a78514a6f88e5357588a7c7e3fb55f60fc6ab9bb4379418800bac9cfb1450d9cfedd4ef935f1270c9a3
SSDEEP 192:sxZ7RuyM/jK1Ml8MkB/fwsfebIdpjuHW6+WN4aK/YHflBkIgrJ:sxZ78MB/fwsfeEyHb4/59
TLSH
T14E52E8126B346977CCCBD209FA45BF53D6F91472A2900E54A9FCDA1C04E7AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 26057b7161e63c1a5826b2a71762e29effd358ca159d4c1bbe7d091045bbae34
MD5 dca352ff204232b33b771554970756a0
SHA1 69afab812ef25d3810afc18eaca2234bebe9bdc9
SHA512 07e87a765ef533f9a9d992816e36d1a55c28753e86444f342820867a9251eac764591a096642c71aaaba7564f8a2b5f43773cb7ad8f7fbb82f5dabbac98c9ff4
SSDEEP 192:sxZ7RuyM/jK1Ml8UQLkB/fwsURbIdp5uHW6+WN4aK/YHMYUkIg5nJ:sxZ78qgB/fwsUREQHb4/E/
TLSH
T1EF52E7526A34A977CCDBD20DB945BF53D6F91472A2900E58A9FCDA1C00E7BED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 2287fc810315fc9fde601d9b04f5df9618c8ecf967b9d3010d1748b542fc8ff6
MD5 e6787326c5cbbaabb118253fd5e94963
SHA1 31d8dad28a412ed9dadf0f16121f922346f92669
SHA512 7b294d63b3e087555cf7e9319f109cb04c3c049c52fd3a2876b9538781328071a5b9d20be428ec52c03ccc7ab3cdf423fe2e438b8da68ab9faa23787fc78bf9f
SSDEEP 768:lgUZYTMWvg09o8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4RProV90z:lgUZYTMWvg09ou1ja7eLZmRcEz
TLSH
T174E20A3B280CCB7E4F844E9DEC2A6F863ED801CB5A584D544BEA894C02C77EB512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\53f0f5bd-7408-47e8-b6a3-5aa7e69ac4b4\index-dir\temp-index
Size 2KB
SHA256 62f45fab809e4392a46c72a8eccf6366344d9a906ed031b35c1074f28e01b0c8
MD5 b8bbed41a59ec36bc8c5560060c568b4
SHA1 f7e48caa42dedc3215857a54fbc72743fcb1fe8e
SHA512 eba808b21ea2af18ad0a23ef8c1596a30a6737c6839953b3607fdc86aa60ff60d1a5b3c78bde852b5587ec9b8db77bd53161e40eb3ec61aa9a4692403692d2dc
TLSH
T17B51C84F4E514E6FD9A842B714B264D037748CCD1B159A2318EC1233FD8366D2D4B3AE
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5c9dbe.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\53f0f5bd-7408-47e8-b6a3-5aa7e69ac4b4\index-dir\the-real-index~RFe5c9dbe.TMP
Size 2KB
SHA256 a1341816b69b747a4f1d7d6f8ad86ea1885fab2558f48ee1f7da8b7db49eab68
MD5 981826573655cbce03f1c8765e81d2e0
SHA1 b1d1c58e14af0d52ab154de54af2b98bd5cc3372
SHA512 ff5d5ef949bf257da3f78a8786e5c4f8b4c0e8a145537e8ab2ce6dc49161d22698b653b916dc31e20a85bbc7167eb96c5990f8d19cfe419ffc81eb2881a6ebda
TLSH
T17C51959A4E428639E9C441770AE3A4B4373925008719BF5374FC9636ACD27AE3E1E2D9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 371B
SHA256 bbeabe7539c8daa42096e3f9c4e7ff9a98bc6554f255ac3e1db93aeb12d64a6e
MD5 24340392ea11040e0fb537b9dc374405
SHA1 1d1707ed9579e53db0c58066f174aa07079996b4
SHA512 6a7c6a57ad50e915876d51132dd8d78ffa4db5d148f53231876ee04740e4d34772bd59d70d10116a7e23b9372177881860183068775caffee478a2a377f17061
TLSH
T17EE068F32DBB1810AD6BC3D64471A4A4050138A8C64CAD8E00AAB2A310A23002806C22
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 d731eabb28ec4239c0247af7210c5e447403192fb23759a6b109d31275cfdd22
MD5 c98298942b896535d348f48a3f7651be
SHA1 11db133a58d96268a32d9a6687b68236237adeea
SHA512 52f30e5b9fe71cf5eb87f242dc8d96894c4389cd7604e9a8fccddbe40e67202b417910bb6d8ea962b581d63de801c2f2715c795b75bcc817906710b5742a635d
SSDEEP 96:KA1eK2AwZiKCsKHuz6OMEE+OUpl8u+KkL84+gmuRox+UKDKuaG8KLaX:E0VFFjno
TLSH
T1B5D1F81672BA02113C3D6B0C86D597AB8E8272637018646B7BED00B19E67D21DEFDDCD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f6356055-e653-467f-9d90-661152fa6b8c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\f6356055-e653-467f-9d90-661152fa6b8c.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 a472eafb143c83d310eb6bc3e61a537055a86d530c6eaf8c3746d78c85058248
MD5 692badce5d5f1f5096ca62a468eaa306
SHA1 510e809c9869ad75f2e8f2b3a7140de667401356
SHA512 16043f43d1ba87bbbd12e036af4086d35ac27b61615d1ee988172a4c1c32e1e00aecf8c27df0e0ab531dd1502847458a16d4b4eff31a5cbf9e435a81870cd0ef
SSDEEP 384:6sNVPTsY80Vm9zX5od+V8ykVVX9tJrOkWh3xs:6c61OD1/hOkWh3xs
TLSH
T106423A36A878AC775DE2A581F44735139EF850A7DA892F9496EC2F0C01DB6AC131BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 6b81d73b5779235a5d924cafbb1b6dd541f582338693ac6544fef46a2ad6460a
MD5 c74635b40432af572d17473c3ddacbe6
SHA1 657394ef4b8f9f9a41609d1a98b8aed876e6cc34
SHA512 f9d27011d2fa90de18a4e2fcd9d5c26d86166a8e41bee354d2abf22b306a7f5f2179239eab8d0fc1b938bc1443f6c983758dfab508e2a020ff62f452addbc37b
SSDEEP 384:7iFiZcIyzsNv8TUNTUlIlSTsY80VX9zX5od+V8ykVVX9tJrOoWh3x2:WFQaiwgib1OD1/hOoWh3x2
TLSH
T18EB2E7F258E79836D9AE5B43A77D2D138EBCC063B5845A94B3D85A0CCC561BFC30A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 add5c30c7ae85e0ac7a5444b388b51740aa352a80823d4329bbc2da52403bb31
MD5 176bf93cfb8bf7d6c6f79ea8b68e3ca6
SHA1 6b18e60e25270c781c466dc1c039f2651064311b
SHA512 4c6386a2e886410fb41784a4ba7519218b07905544557c8f8183a89edf5b60e6af398327da19a3ba1bebd8565e167d598ef30c979e1726a6eb2fd5ecff48f9e8
SSDEEP 192:yONL61VWQmiUy7+gGX5Obd+j1jzorykaoX/aWR315U6:yONL6WbgGX5od+V8ykVCWL5U6
TLSH
T1D702E935A8686CAB8EE2BE49B48737135FD51067EA652F84D6FC1B1C009769C2306C37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5d0ba5ebdfee3e003f73f1b927f13e08a884852edc51fa4cf088b60761cc1b60
MD5 8ec8e21a54a3fe8bb9fc1eb35c7b7956
SHA1 b0e085b22d99ac64ac68472cb76c4d34fab5c6a7
SHA512 84bb866d8bd25bd3e161e908c31d613715d6ff5220a035fd77e265aabbaf324b2d6fdf8bf7efedc600cac0045505a7757876ef1dc5b5fc4c6205a861ab50c618
SSDEEP 192:/ON461SWQmiUyQ+fGX5Obd+j1jzorykaoVX9ySJrOVjJWlqYU6:/ON46fifGX5od+V8ykVVX9tJrOnWhU6
TLSH
T1D0122932A468AC6B5DE2B585B48731139FE41167EB497F90D2FC2F1C01EB6AC131AC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 20adfd61d3af973ba73939b14857540ee91debe5bd52cc1e458a86cf65b872e3
MD5 d36e92f71f3b0e2e49c345647d912b1e
SHA1 87814fd692f38f6ae48fb53a851c14b4937609dd
SHA512 91350c6c14c057d65a9989de69d10c475d8d760a3513114d009dbd94dd0cad8b5a2b9b752328d11bd64f3f6c2ef7b9128d17e00bd2e3d5516046f317c1041927
SSDEEP 384:FZcIhsNVSTsY80Vm9zX5od+V8ykVVX9tJrOkWh3x2:9h561OD1/hOkWh3x2
TLSH
T1A2727D32A878AC775DE6B581F48735138EF89077D6C82F9492FC6B1C019B6A8031BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 c770e461611daacb7bfce266aca2e90c3722bcd8aa80b35fe1b3eeb37bb557e6
MD5 39b6368269c9baa95c6350d37c0f8513
SHA1 fb297a26129c20b1bffcf76e8491bead6d4b33d9
SHA512 5a7f04ad3dc25eb4b5274cfa485c720cf092662d1123d4330b7b5614605a3639260b0208b50e33bce2e34ec6417f2be4fb38fa590b8a88c6da4ba6b02983a12b
TLSH
T1D9414858B6F91108B3B76F5A9BF6686E887BBD332F06D55D10110E4F0A22A40CC71B3B
MD5 SHA1 SHA512 TLSH

Submit Download