hxxps://cordly[.]pro/attachments/images/0629177609261423256/2630594244928983810/image[.]png[.]php

Analysis

user interaction
yes
max time kernel
149s
max time network
143s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
08/08/2026, 14:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cordly.pro/attachments/images/0629177609261423256/2630594244928983810/image.png.php
Sample260808-rtb2nadh78

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4308	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134306729291325235"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{6BF882F7-304B-4AE9-95BD-4FA6B845A5FC}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1396	msedge.exe
1396	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe
3368	msedge.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 3368 wrote to memory of 1564	3368	msedge.exe	85
PID 3368 wrote to memory of 3296	3368	msedge.exe	86
PID 3368 wrote to memory of 4308	3368	msedge.exe	87
PID 3368 wrote to memory of 3296	3368	msedge.exe	86
PID 3368 wrote to memory of 3296	3368	msedge.exe	86
PID 3368 wrote to memory of 1908	3368	msedge.exe	88
PID 3368 wrote to memory of 1908	3368	msedge.exe	88
PID 3368 wrote to memory of 840	3368	msedge.exe	89
PID 3368 wrote to memory of 4668	3368	msedge.exe	90
PID 3368 wrote to memory of 840	3368	msedge.exe	89
PID 3368 wrote to memory of 840	3368	msedge.exe	89
PID 3368 wrote to memory of 4668	3368	msedge.exe	90
PID 3368 wrote to memory of 4668	3368	msedge.exe	90
PID 3368 wrote to memory of 2900	3368	msedge.exe	92
PID 3368 wrote to memory of 3792	3368	msedge.exe	93
PID 3368 wrote to memory of 2900	3368	msedge.exe	92
PID 3368 wrote to memory of 2900	3368	msedge.exe	92
PID 3368 wrote to memory of 3792	3368	msedge.exe	93
PID 3368 wrote to memory of 3792	3368	msedge.exe	93
PID 3368 wrote to memory of 3936	3368	msedge.exe	97
PID 3368 wrote to memory of 2872	3368	msedge.exe	98
PID 3368 wrote to memory of 3936	3368	msedge.exe	97
PID 3368 wrote to memory of 2872	3368	msedge.exe	98
PID 3368 wrote to memory of 4708	3368	msedge.exe	100
PID 3368 wrote to memory of 4820	3368	msedge.exe	104
PID 3368 wrote to memory of 4820	3368	msedge.exe	104
PID 3368 wrote to memory of 4820	3368	msedge.exe	104
PID 3368 wrote to memory of 1628	3368	msedge.exe	107
PID 3368 wrote to memory of 1628	3368	msedge.exe	107
PID 3368 wrote to memory of 1628	3368	msedge.exe	107
PID 3368 wrote to memory of 1716	3368	msedge.exe	108
PID 3368 wrote to memory of 1716	3368	msedge.exe	108
PID 3368 wrote to memory of 2128	3368	msedge.exe	109
PID 3368 wrote to memory of 2128	3368	msedge.exe	109
PID 3368 wrote to memory of 4160	3368	msedge.exe	110
PID 3368 wrote to memory of 4160	3368	msedge.exe	110
PID 3368 wrote to memory of 1240	3368	msedge.exe	111
PID 3368 wrote to memory of 1240	3368	msedge.exe	111
PID 3368 wrote to memory of 4404	3368	msedge.exe	112
PID 3368 wrote to memory of 4404	3368	msedge.exe	112
PID 3368 wrote to memory of 4388	3368	msedge.exe	121
PID 3368 wrote to memory of 2752	3368	msedge.exe	122
PID 3368 wrote to memory of 2912	3368	msedge.exe	123
PID 3368 wrote to memory of 1684	3368	msedge.exe	124
PID 3368 wrote to memory of 1684	3368	msedge.exe	124
PID 3368 wrote to memory of 1112	3368	msedge.exe	127
PID 3368 wrote to memory of 1112	3368	msedge.exe	127
PID 3368 wrote to memory of 1396	3368	msedge.exe	129

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cordly.pro/attachments/images/0629177609261423256/2630594244928983810/image.png.php
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x1a8,0x24c,0x7ffe3a6fc188,0x7ffe3a6fc194,0x7ffe3a6fc1a0
  2⤵
  PID:1564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1752,i,14997891042753929614,13982731484864155197,262144 --field-trial-handle=2308,i,2514442499902115828,12586095323971347169,262144 --variations-seed-version --mojo-platform-channel-handle=2304 /prefetch:2
  2⤵
  PID:3296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1992,i,2921206405735626693,6080502674419867467,524288 --field-trial-handle=2308,i,2514442499902115828,12586095323971347169,262144 --variations-seed-version --mojo-platform-channel-handle=2360 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2068,i,1498638766088995878,962178023941954097,524288 --field-trial-handle=2308,i,2514442499902115828,12586095323971347169,262144 --variations-seed-version --mojo-platform-channel-handle=2728 /prefetch:8
  2⤵
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3392,i,3885917056848275839,15379206035663127683,2097152 --field-trial-handle=2308,i,2514442499902115828,12586095323971347169,262144 --variations-seed-version --mojo-platform-channel-handle=3420 /prefetch:1
  2⤵
  PID:840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3400,i,11083921279648461791,14631176024966550919,2097152 --field-trial-handle=2308,i,2514442499902115828,12586095323971347169,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4216,i,14610579138576165810,8506826958140099460,2097152 --field-trial-handle=2308,i,2514442499902115828,12586095323971347169,262144 --variations-seed-version --mojo-platform-channel-handle=4272 /prefetch:1
  2⤵
  PID:2900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4248,i,4476914262972398259,7373962498404375706,2097152 --field-trial-handle=2308,i,2514442499902115828,12586095323971347169,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:2
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3596,i,701630464937126660,2483192016028124479,524288 --field-trial-handle=2308,i,2514442499902115828,12586095323971347169,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5040,i,6340666590450537314,5489845202750166281,524288 --field-trial-handle=2308,i,2514442499902115828,12586095323971347169,262144 --variations-seed-version --mojo-platform-channel-handle=5168 /prefetch:8
  2⤵
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5796,i,7525014340083669234,10259478467240218088,524288 --field-trial-handle=2308,i,2514442499902115828,12586095323971347169,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  PID:1632
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5796,i,7525014340083669234,10259478467240218088,524288 --field-trial-handle=2308,i,2514442499902115828,12586095323971347169,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  PID:4708
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6244,i,17263535663276824258,5013041070356977114,2097152 --field-trial-handle=2308,i,2514442499902115828,12586095323971347169,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:1
  2⤵
  PID:4820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6628,i,11394778903458150686,17201210950277274530,2097152 --field-trial-handle=2308,i,2514442499902115828,12586095323971347169,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:1
  2⤵
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6408,i,17285998497552619264,16593628745798497357,524288 --field-trial-handle=2308,i,2514442499902115828,12586095323971347169,262144 --variations-seed-version --mojo-platform-channel-handle=6424 /prefetch:8
  2⤵
  PID:1716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6536,i,8602973743326242240,16414933205641611162,524288 --field-trial-handle=2308,i,2514442499902115828,12586095323971347169,262144 --variations-seed-version --mojo-platform-channel-handle=6440 /prefetch:8
  2⤵
  PID:2128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5796,i,17390864504691038363,13801286315907828135,524288 --field-trial-handle=2308,i,2514442499902115828,12586095323971347169,262144 --variations-seed-version --mojo-platform-channel-handle=6540 /prefetch:8
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6888,i,6342577131587142148,10646935891674432687,524288 --field-trial-handle=2308,i,2514442499902115828,12586095323971347169,262144 --variations-seed-version --mojo-platform-channel-handle=6892 /prefetch:8
  2⤵
  PID:1240
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7044,i,6514182654709149854,14674264605995886952,524288 --field-trial-handle=2308,i,2514442499902115828,12586095323971347169,262144 --variations-seed-version --mojo-platform-channel-handle=7048 /prefetch:8
  2⤵
  PID:4404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7096,i,16881011804863104395,11212874387305766428,524288 --field-trial-handle=2308,i,2514442499902115828,12586095323971347169,262144 --variations-seed-version --mojo-platform-channel-handle=7060 /prefetch:8
  2⤵
  PID:4388
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7100,i,3810904431678826951,4680356203442321795,524288 --field-trial-handle=2308,i,2514442499902115828,12586095323971347169,262144 --variations-seed-version --mojo-platform-channel-handle=7148 /prefetch:8
  2⤵
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7084,i,4021022374285034592,15180082885985581437,524288 --field-trial-handle=2308,i,2514442499902115828,12586095323971347169,262144 --variations-seed-version --mojo-platform-channel-handle=7044 /prefetch:8
  2⤵
  PID:2912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5664,i,6909564689040472241,1399300402263652859,524288 --field-trial-handle=2308,i,2514442499902115828,12586095323971347169,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4064,i,11320667557702126233,16300605892385683623,524288 --field-trial-handle=2308,i,2514442499902115828,12586095323971347169,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:8
  2⤵
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5348,i,13123196787372509879,604416592160877223,262144 --field-trial-handle=2308,i,2514442499902115828,12586095323971347169,262144 --variations-seed-version --mojo-platform-channel-handle=5240 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:1396

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4784

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 65ceb66d8748e634274345927fa0d138641d979a5ae9ef1c1ff09253068a27fe
MD5 cebb9198a8a062b7e3314afa9d64ded6
SHA1 2407c1957f09676a58b694aa14b49315ca612dc4
SHA512 81a68f27f0544b096926031380eed2e2ed21ac0dd543fd21b35f254d7cfb476bb93139fd710e74ca06c877dcbf8c62bc7468922fe8a2f411f401fb5386347733
TLSH
T1D661E87803B23CA0E7645C7070D60F4170B6CAE6FE4B5FC9D1CB99B75A1836D012659C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c33b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58c33b.TMP
Size 3KB
SHA256 886381aa97d849442f4b9584029f623cd3f163a22a3517f67bfacbd664bc13ca
MD5 0efc29b2ccda0ab3c27d1a206651a89b
SHA1 55abc5f0869de63630644be304717b6c9b318d48
SHA512 4f9acf363c03765b51583353212a3dcd38b54301ca6c8af654aaae424505a0db63bf055462fbaa742370a8fe531c555c74f7cc6b492d43f4a6912a8a34b94e52
TLSH
T1C161E8B803B23CA0E7641C7074D60F4070BACAE6FE4B5FCAD1CB99B71A1836D052659C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

verified_contents.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\kfbdpdaobnofkbopebjglnaadopfikhh\113.0.1765.0_0\_metadata\verified_contents.json
Size 2KB
SHA256 6f64306515428487987fabde07ddf1646f64ad4e3dc4841e982d40ad91459822
MD5 c7182c4ef7a2cd6a57e48d44bfd4af9b
SHA1 2e1e4746da948d83baf4bcebee618784f8ab209c
SHA512 d8af16336b66e4f264eda4ea68de4c1763a9c9b99635184d9ece67a9ed69a09bc1088bed254b3d2a8877ba3218e043065d1e4a06c20f18b58d312d93fb84bc83
TLSH
T1BA419322CCA5BC1F293173704EB90662AB0595AB2081295A70FC099D3FF15666436EBD
MD5 SHA1 SHA512 TLSH

Submit Download

filelist.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\kfbdpdaobnofkbopebjglnaadopfikhh\113.0.1765.0_0\filelist.txt
Size 134B
SHA256 543c0e50c16159439d3dfb3f1151bc64e2f5b60a0e3824c5f93c4c5c14dd945b
MD5 3bf6b4eae5af15288bf0d79702f9cb78
SHA1 b8a052dc4973757ae865661ea0300dea1d27f3b6
SHA512 25e2502ad314635035f303aa1f0f195c28af91d0b51280e5a4c9310aae65aad857073137196f41a9a2fd7ef96e54ce9b329c448d5acf87b10134168ee7652c0c
TLSH
T1C9C04C206C0494B7810CEF55C5F9FD34940616007E33DC8913584270101B68E8DB5324
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE.md

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\kfbdpdaobnofkbopebjglnaadopfikhh\113.0.1765.0_0\third_party\babylon\LICENSE.md
Size 9KB
SHA256 4135d3051e1bfdccf0440f6d8867a6dc1e39587694995479c3e29826e53aff63
MD5 e57b8dbca804bf4a2db759fa1a70b3cc
SHA1 8acc131b3698964249b08a0178f7c8c467337048
SHA512 d2ca91851daeadedcda21ecee4cf7c9244cf21a15709e472014ba6a332a374cba80acd165b2650ce2c3994c7d0156376c22db00fe0c47833e0fca466bcb8c627
SSDEEP 192:agW/NVo4UTo1YE+FNzFE6GGfGb2y1CVzho1oHqxQJbbLwY:a7hUk1+bXU4qbQ9l
TLSH
T18E12427F7748137B0AC30172B78BA4DBF32E903C3B9556644059D06823ABD6583BB69E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

babylon.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\kfbdpdaobnofkbopebjglnaadopfikhh\113.0.1765.0_0\third_party\babylon\babylon.js
Size 1.2MB
SHA256 b5a426a0769b378e196ab2698c14a326d86ab2443010e16e4ac3cdde06371e6d
MD5 e1adfd8f62854c2d9ce65f13268c1ac1
SHA1 d564ea1d59305bbec12995ee43f1c28838e82519
SHA512 ffdf74b8bba179c7d5d6d49205b8aebfc7b27395852d05f1ae5de5c23b5dfbd87776f2046fad20b652a7663dacf90da0336a802985bad14ba3591bbfd9ca4caa
SSDEEP 6144:j7WIrpHJ1yA3d0xEWv/v/82mXgBYdnU7yTGpjGp8MTYgANTJCpzesRGvJaGpLsXW:vC/ErriNqfGp0KV
TLSH
T175450999B3217926478390A5143F090BA33B68DE940540BCF299D8DFACFD149667BF3E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

typescript.js

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\kfbdpdaobnofkbopebjglnaadopfikhh\113.0.1765.0_0\third_party\typescript\typescript.js
Size 10.4MB
SHA256 986134e07f34257fd85c084441c825d7d8951705a0b8c76b0d7c5499536cc959
MD5 d931cf27eb964f239e5bec661810abf5
SHA1 1616508213014fa7cdb50e691cf737169019c6ed
SHA512 9c2bae1025c1c9579e5e7ba8119e11bc298bbf968aaaaea94f12b8a96155f63bcdbce60deb1445c484aeef3fcfdf96156fc804c2867726617e7b772440989fb6
SSDEEP 49152:noUsnsTsUGJR5dZjSB1FBUWx3pZzoYzuQRlbVbOFeWSeoMTNKtsL4IMltR6SMF9K:BTsUqRIb3nYz1q3X
TLSH
T1D3B6E6BE79E330B16A5B2136672F8001B735D257220CD8907E9CC3A95F1587462EBFE9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 51cadbb044674630585d532d64d1a71c1a198b410b87ccafdf41ea34e533c9d0
MD5 7e6e6c81732ed1d56f685c57213c715b
SHA1 20ac8f3f8b7c32318e27c9c47f478f7b0a457d83
SHA512 3aac41968a2dd2b678c66c48281e947ede2a3b43865070014af8f115cbbea5d9f22bce81b67238b0266a0c9aebb05e8dad1771212e6d6b8728c88949f1075925
TLSH
T16031CEF3C3F4856F8A0156F0AA18AE1BDE2D0516431C3CAAC9E4AF2B93F3571D14169B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 04832101d160c8d51c14d6542dc31dfe96bdbab184c189a76f04db20ecf692ad
MD5 f5f825dca083022ffacdc95acff030d9
SHA1 68574116b64021a17555cd649840b70a0378ac23
SHA512 dfad0c881db1c79c45edbeda659568b6ff30846a52cf01d37e80c178257c1b7c60a2344747623e714642d1370dbee02695187a838b532f90ba694a1d3d55aed4
SSDEEP 192:sxZaRNyM/jK1Ml8Mkp/fhs2kvFvIdpqglETHW6+WN6Evo0/Y9IvWl5hIgrJ:sxZa/Mp/fhs2kvq2THb7A0/n09
TLSH
T1254209116E349A77CCDBD209FA55BF53D6F8057292900E54A9FCDA1C04F6AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 19KB
SHA256 7470d2e4f70e3f8e5c1b63e8e41366562bd4d64a6688c5fe021b68ef97702ea0
MD5 bd2f47c6ac61332190d687bcc4d49cd2
SHA1 fa8082631017fda878bdecbf5caa4a4d82585098
SHA512 92e8ed56f95f5126f2a8d050a40b25e105b93528208e93e45508572123e776bdc51c935d80825b1764a530367900cf728565653ceb6124170ee187eb0bbbf9d0
SSDEEP 384:sxZa/qEb/fPZ9ZhZgZjZRUZyZeZOZj41xnOkuJzvkjwGQsckwqIHb7A0/nx2:sSCEb/fxjfW9RC8wAeAkwVHb7AGnU
TLSH
T10B92E7069820EE77CCD6A61EE9757F63E5F4462683C01D6C69FCCB0C40A6AFC615782B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 1b99e0b14d437d83b64aba96796677360aeb49f03227d97a28c137d448fd3687
MD5 e611dd8c59b484ee3f13d2a513db83ba
SHA1 74f9326e1f6cb6b9569de39013b82537a8414f5f
SHA512 43d2741c5f21ac928df6473f40707afad242c31e845d63abbbf7c70b31da9d8849fc3ab8eaa4d0d39af00bad8c9d88ba66383da1adb13e20664030939277a4b9
SSDEEP 768:Qdcv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWNzro5g6V:Qdcv21wWvu+Z+u1jaeFLeRNA5F
TLSH
T1C0D20B2B280CCB7E4F841E9CED2A6F866DD801CB57988D5447FA894C03C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 33KB
SHA256 8d663768f263a73314b64b9af492a1f288ea0116253cbfa137e9c9c2ccb0923d
MD5 8c6e3ff42d6e37e0017ca2e8b1e86ecb
SHA1 47856f5c0c0c1c16bf12bbe85f75c87496592e85
SHA512 5e97d813f8e97a887bd3428b332c421cd1c6ad035526470473e29ef8baff299ef0f781dc83200f0825cfe29ac694f53dd6aee6977d3e003a693685aec8092b65
SSDEEP 768:Q0KGcv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVGEFLlwmWNzro/g7/:Q0KGcv21wWvu+Z+u1jatEFLeRNA/2
TLSH
T162E21A3B284CCB7E4F841E5CDC2AAF9B6DE801CB96948D5047FA894C02C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 427be45bf96c98890e3f4d295f2823f20a603270aa23b6690ae876dc69482a48
MD5 7c62e12681c97eca15f43e5490a45b17
SHA1 be2105132bdcc358c8a0e5e9babe1e86506f138a
SHA512 4d79ce7a31f704c216b422414f2dfd5acc9d6ba6e283fe761a15fca0a899e0b9c65f63c10f54f0375c6bb40c849dd957986daf93df1dda9906f06c382a2f2bc6
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBD4D6HTNJ9wZx0jrbwKjlrlwnrbkFDd414xi:mT4D6HTNJ9ox0nbPlrlArbkFDd414x1c
TLSH
T13E914C11713B02823C7F684CA79596376E4235633828A5BFBBB840A15F67E116DFE8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9303edaf-c5f5-4de9-bcf0-759477bd7742.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\9303edaf-c5f5-4de9-bcf0-759477bd7742.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 752426e4ef54c1c2cd25d1b7192350a81aab80f6ffd15131eb8ba5e8dfb2f29f
MD5 6264ac06d2acbb8f3890e065bc6412cf
SHA1 88f5f959cfa215aed05b8f74fc3a29b695ebbccc
SHA512 5ef71cc4d10d3ca80efb3658d97b0b425bb36922c62c1b9062ce99f634292e5c5ad5ab60a4a149898805e40ee3ecd0090a437b65c97e50fa830b2550a96b4d75
SSDEEP 384:GZcI0sN9L8NhziRgQe+CwOt/X1InTKwBODNZOCeWt:U0XBPzYOVX1InewBKZOHWt
TLSH
T16F929D716C386C765EE6E555F84B32078EF88177E6C42B9095ECBF1C01DB698230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 ad18b88cfcf5a786316dee033fa23300bdd005a58a53c8d0668e2b9ec5d6b315
MD5 710fabc90a28664ae7fcd8d29d60f691
SHA1 8c758add34f225ddd1df60bac19f804ee7c367af
SHA512 26bba9d333746130d0e4fc1ebc05591c5a1ba4c6d3af1641a6defc686eccf33a86c7ae7af4a92c956953f4c9acb4aee5d163234b4a9e1b0d8bed0c59f2cc2dcc
SSDEEP 384:giFiZcICysNH8TUNTUlIlA8NhziRXQe+CwOt/X8InTKwBODNZOCeWt:7FQLewgxB0zYOVX8InewBKZOHWt
TLSH
T1C0D219F258E75876D99E9B47E73E2D038DBCC063F5806650B3986A0CCD9617FD30A811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 793d53e692c9b043c33d9f21b476faf6bf89156cff663dc483466f29559c8b7e
MD5 4dfeded64aa1810f073cff582e4f1f50
SHA1 cdbca98aabdacc00c9f4807f3469dc23870e6f32
SHA512 2d90456b15b56fc0b45dba933ff992649c2a2277da5d253588134c482574e19ddd1eb8ca7abd58df188280cdb3e1e0a7ef222be37d8363d2ded1e437eb9ee178
SSDEEP 192:JOND6v+YLNQmiUyXyZh+CGdOtPus9k+U6:JOND6vz/LZh+CwOtbZU6
TLSH
T16F02D8356D681C7B9BE2AE45F58B37275FA8117BE9912F80D9D82F1C01D764C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 60eb9821eb2562fe84b3238d2891d10e138fddf182308cdb08b5f2ffcf7ef3c2
MD5 89355dd1ea9573cf1aef270256bb55e5
SHA1 e4243c0b6b0103740594d4c00ec88a5a47206e7c
SHA512 e524d755a4622ec36ec70a6bd2a795143a16dac72ef19a097c514fb2e53edcc18d9473563ec4ac4ce21b89c1070d4590ff70c95a34fefa39d6765047bac353d1
SSDEEP 384:vZcI0sN9A8NhziRgQe+CwOt/X1InTKwBODNZOCeWt:n0aBPzYOVX1InewBKZOHWt
TLSH
T165928D716C386C765EE6E555F84B32078EF88177E6C52F9095ECBF1C01DA698230BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 9e7d037b588bb22d00be849474ca6b46f78451ad71eeb6adeef0ff40b14b1574
MD5 65c96207d9201d8c6caad4cae12de957
SHA1 3458cc804185cb3fe3f3b50a74d346084b36457d
SHA512 98cc8e4def3ae44db5c0fc4a400185c5cd0bdc10ac9ea2a7ef02cd7f9eefd4d150fcd224152cd19c5a81519ac4ef2ac863e34f6e4af89d18f37cc35f6f1a4968
SSDEEP 192:gONA6v+YLdQmiUyvyQh+CGdOt/X6CHNqJU6:gONA6vzHFQh+CwOt/XjIU6
TLSH
T1AA121931BC785C775EE2A955F48736138EA88177EA867F90D4DC3E1C06DF69C230A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 445acb7e983aec64aa04f987449c0dc0dacdc20c66a41d779a5b1bc15fd3ace3
MD5 2f43d915d77158b5838c94a4317b2b4b
SHA1 74e8a54e9621c6c86e7c48caea83e9ecbe79e8aa
SHA512 e73ae344b657447c86579006565f0e90f5c6f32d283604d263c602e90cdc4b7f3c4af2d7eea5c80dabf16ff0a9353f5eb18ecf3d3dbf6ab7d68295f84dd3b504
TLSH
T14F410458A6ED1149B3B26F569FF6A8AE487FBC773E06906E00010E4F4A62B40C971737
MD5 SHA1 SHA512 TLSH

Submit Download

5b5a3317-41ab-444c-8fe0-ab8c687f4f70.tmp

Path C:\Users\Admin\AppData\Local\Temp\5b5a3317-41ab-444c-8fe0-ab8c687f4f70.tmp
Size 2.1MB
SHA256 efdad7555293ec2d14399c2c2fc9d07228de1f6e3746b27da621b76fe5ceea07
MD5 4cd67032e35fa92f5182df10df289906
SHA1 9210bfc66bd808ffcd7c6443e160dc8d6754c416
SHA512 f3d83f6e77e4568d2dae539c95acf0a886926a001b4d80f0ea602387530fc333f688ac031b3057e1c2b0375426cf47ae33315f7da9ffaec601102be0bb7221cd
SSDEEP 49152:ykR5Xz/3zNOm3NOHF4+n/UlfmCSJdm8IKXmiQeujzX:DVEkNOHJQOtICGb
TLSH
T166A533BB93AD6C15F3A88C67DCDD498641C2798E6161B7F619837C282ADC07CB47CE09
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6f54ab7c-d762-4aa5-8c5a-d25ab5a43d0a.tmp

Path C:\Users\Admin\AppData\Local\Temp\6f54ab7c-d762-4aa5-8c5a-d25ab5a43d0a.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

1783d33e-b87e-48ab-9659-b0e2c68a32d1.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3368_282044818\1783d33e-b87e-48ab-9659-b0e2c68a32d1.tmp
Size 3.0MB
SHA256 2d69203739eca77886457d27c0df44eca47da02810061a7f5e15288c2e643f23
MD5 06f47f5ad37fb94be87982adc116d012
SHA1 4899ca7b1be75f8607b00b59b8469c8072f514ef
SHA512 b9ccbc3f2c45eaefcc4e157fb19eafd10eb54465f514ad16ada25e81390c3d577fa52aa6fc03461de6726694cdfda15ea96c5420609ac7a426e7b5afa43cab46
SSDEEP 49152:nqSGYpZHVTcorMCTt7OQvYilFbQ0NyNLvTAIPvWcfbcFlTfTGquf:n5pXTcoYCTYQAybMg7cfbcFPc
TLSH
T159E53395F69FF0F4D9A5F3317F8C765F16AAD387A30091D84283204A7BA9E210A5DF60
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

manifest.json

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3368_781812701\CRX_INSTALL\manifest.json
Size 658B
SHA256 fea905b763b26db02673c6ab14f422b21eff64de59351f0818b501dd4e7f9430
MD5 2cf796650e5ad5bfb6c4a421d81734be
SHA1 79298d3cdd584b290d825d6fff4b857012e71992
SHA512 1ee7604bd7293d6296cf1368ed0dadaad7359f4d00be75e7730a9704b2205438a06ba7361554437b3e6ef352482011a90500769ff713949716c24355ee742e33
TLSH
T17A01233A268140F238347640087155A4F176620B9100F8053835E36EC460BFDBD79A6D
MD5 SHA1 SHA512 TLSH

Submit Download

LICENSE.txt

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3368_781812701\CRX_INSTALL\third_party\typescript\LICENSE.txt
Size 9KB
SHA256 43692cfafa6a5c09136cfa0138b9c78efeb56ee6b9174553dbf704b888771f6a
MD5 f632dfdde0adc0da86f701c6f2df38af
SHA1 5a7612b4d9977a7e79f60e88df556b09a90df828
SHA512 87722a2d675028d18ea276dcf18c24e891a0bad5f85f7387702310976d2fb8e1d0687321b0844b6c47947e6fbb489fe08bd1ffbe9772955ac7191ba4e274c8a5
SSDEEP 192:rwqW/NVo4UTo1YEHFNnFE6GhUGi2Re1CVThOCoHqxLJbzjwA:8ZhUk1Hf4Rg2HbLNB
TLSH
T19C12637F774903770AC30172B78BA4CBF32E903D3BA556644059D06823ABD6583BB69E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download