e4918eeebd9c7e3051532de4ba5cc4087e133d1a584a57bdd2efc6e350ac2815

Analysis

max time kernel
898s
max time network
731s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 23:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
setup.html
Size 395B
Sample260809-22e4dszzcz
SHA256 e4918eeebd9c7e3051532de4ba5cc4087e133d1a584a57bdd2efc6e350ac2815
MD5 bc5dfeb65fb4cfd5aa0ee76d199b5414
SHA1 db3f413a84d04d671874a9eda72b7a594f81417e
SHA512 0b6268c1b9bbb92b32b8e98834c42aa3ecc4f4896c1e734b9e814b1bf1cfd532763a504f031a1f4faecff936bf3494fed06da3afda5199511f46adb264cbcfdb
TLSH
T19BE0684E9D4AAF175128156E1FF1D20C2AAFFA4A0600C4E616C7567AEEC1384CC136F8
MD5 SHA1 SHA512 TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5092	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307903052286389"	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{4EC354E4-AFA1-4FF4-9997-491871CDFCA3}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2520	msedge.exe
2520	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe
4208	msedge.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 4208 wrote to memory of 1808	4208	msedge.exe	89
PID 4208 wrote to memory of 5092	4208	msedge.exe	90
PID 4208 wrote to memory of 4716	4208	msedge.exe	91
PID 4208 wrote to memory of 4716	4208	msedge.exe	91
PID 4208 wrote to memory of 1356	4208	msedge.exe	92
PID 4208 wrote to memory of 1356	4208	msedge.exe	92
PID 4208 wrote to memory of 1356	4208	msedge.exe	92
PID 4208 wrote to memory of 4768	4208	msedge.exe	93
PID 4208 wrote to memory of 4768	4208	msedge.exe	93
PID 4208 wrote to memory of 4768	4208	msedge.exe	93
PID 4208 wrote to memory of 5936	4208	msedge.exe	94
PID 4208 wrote to memory of 5936	4208	msedge.exe	94
PID 4208 wrote to memory of 5936	4208	msedge.exe	94
PID 4208 wrote to memory of 1588	4208	msedge.exe	96
PID 4208 wrote to memory of 1588	4208	msedge.exe	96
PID 4208 wrote to memory of 1588	4208	msedge.exe	96
PID 4208 wrote to memory of 2148	4208	msedge.exe	97
PID 4208 wrote to memory of 2148	4208	msedge.exe	97
PID 4208 wrote to memory of 2148	4208	msedge.exe	97
PID 4208 wrote to memory of 5320	4208	msedge.exe	99
PID 4208 wrote to memory of 5320	4208	msedge.exe	99
PID 4208 wrote to memory of 6100	4208	msedge.exe	100
PID 4208 wrote to memory of 6100	4208	msedge.exe	100
PID 4208 wrote to memory of 5952	4208	msedge.exe	102
PID 4208 wrote to memory of 4424	4208	msedge.exe	106
PID 4208 wrote to memory of 3012	4208	msedge.exe	107
PID 4208 wrote to memory of 1844	4208	msedge.exe	108
PID 4208 wrote to memory of 1948	4208	msedge.exe	109
PID 4208 wrote to memory of 1948	4208	msedge.exe	109
PID 4208 wrote to memory of 2520	4208	msedge.exe	111
PID 4208 wrote to memory of 4456	4208	msedge.exe	112
PID 4208 wrote to memory of 3828	4208	msedge.exe	113
PID 4208 wrote to memory of 4456	4208	msedge.exe	112
PID 4208 wrote to memory of 3828	4208	msedge.exe	113
PID 4208 wrote to memory of 236	4208	msedge.exe	114
PID 4208 wrote to memory of 236	4208	msedge.exe	114
PID 4208 wrote to memory of 464	4208	msedge.exe	115
PID 4208 wrote to memory of 464	4208	msedge.exe	115
PID 4208 wrote to memory of 1392	4208	msedge.exe	117
PID 4208 wrote to memory of 1392	4208	msedge.exe	117

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\setup.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x264,0x268,0x234,0x328,0x7ffcef4ec188,0x7ffcef4ec194,0x7ffcef4ec1a0
  2⤵
  PID:1808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1884,i,14500283146944476098,10008888404791496108,524288 --field-trial-handle=2636,i,2560027086351532317,2161225412826394860,262144 --variations-seed-version --mojo-platform-channel-handle=2668 /prefetch:11
  2⤵
  - System Time Discovery
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2276,i,855585560188528580,10598869009851032031,524288 --field-trial-handle=2636,i,2560027086351532317,2161225412826394860,262144 --variations-seed-version --mojo-platform-channel-handle=2856 /prefetch:13
  2⤵
  PID:4716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1604,i,9727179722903007628,13613525685266609828,262144 --field-trial-handle=2636,i,2560027086351532317,2161225412826394860,262144 --variations-seed-version --mojo-platform-channel-handle=2632 /prefetch:2
  2⤵
  PID:1356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3588,i,12302537313595653621,12141845378572742269,2097152 --field-trial-handle=2636,i,2560027086351532317,2161225412826394860,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3616,i,7659784791371428586,7109479161060899000,2097152 --field-trial-handle=2636,i,2560027086351532317,2161225412826394860,262144 --variations-seed-version --mojo-platform-channel-handle=3636 /prefetch:1
  2⤵
  PID:5936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4336,i,17225005014619712258,14280277171496836252,2097152 --field-trial-handle=2636,i,2560027086351532317,2161225412826394860,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:1
  2⤵
  PID:1588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4372,i,787538200169339004,3695829958028101717,2097152 --field-trial-handle=2636,i,2560027086351532317,2161225412826394860,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:9
  2⤵
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4536,i,18401358529717057306,2049648490533220811,524288 --field-trial-handle=2636,i,2560027086351532317,2161225412826394860,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:14
  2⤵
  PID:5320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5356,i,12735978505155132647,6559001949753911595,524288 --field-trial-handle=2636,i,2560027086351532317,2161225412826394860,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:14
  2⤵
  PID:6100
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,4179362893335107303,16757488358035776740,524288 --field-trial-handle=2636,i,2560027086351532317,2161225412826394860,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:14
  2⤵
  PID:4344
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5928,i,4179362893335107303,16757488358035776740,524288 --field-trial-handle=2636,i,2560027086351532317,2161225412826394860,262144 --variations-seed-version --mojo-platform-channel-handle=5952 /prefetch:14
  2⤵
  PID:5952
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5208,i,4050793945137401735,13843324369048556707,524288 --field-trial-handle=2636,i,2560027086351532317,2161225412826394860,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:14
  2⤵
  PID:4424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5192,i,1542407623415188361,8751415999483099823,524288 --field-trial-handle=2636,i,2560027086351532317,2161225412826394860,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:14
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5196,i,9188185627950904922,8786244355601622978,524288 --field-trial-handle=2636,i,2560027086351532317,2161225412826394860,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:14
  2⤵
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5204,i,17296016626780067104,2689653593018252914,524288 --field-trial-handle=2636,i,2560027086351532317,2161225412826394860,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:14
  2⤵
  PID:1948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6444,i,14529081179443273199,6301738921346297738,262144 --field-trial-handle=2636,i,2560027086351532317,2161225412826394860,262144 --variations-seed-version --mojo-platform-channel-handle=6564 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5592,i,7261324879684389254,2929643772929572446,524288 --field-trial-handle=2636,i,2560027086351532317,2161225412826394860,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:14
  2⤵
  PID:4456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4164,i,16862692990128864581,9882457007908586085,524288 --field-trial-handle=2636,i,2560027086351532317,2161225412826394860,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:14
  2⤵
  PID:3828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6536,i,11739448916278480260,4041127228282026923,524288 --field-trial-handle=2636,i,2560027086351532317,2161225412826394860,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:14
  2⤵
  PID:236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5308,i,8060740451286781284,4522724861944114651,524288 --field-trial-handle=2636,i,2560027086351532317,2161225412826394860,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:14
  2⤵
  PID:464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6000,i,3127744008295985799,219838808511900581,524288 --field-trial-handle=2636,i,2560027086351532317,2161225412826394860,262144 --variations-seed-version --mojo-platform-channel-handle=6068 /prefetch:14
  2⤵
  PID:1392

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3608

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:2404

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:2384

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:4340

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 592a25be5129e6cfbdd17595261ee18aa3620a10a2e34aadff2e41cdad7c4ce8
MD5 15fb24e9a09f7f3ad34b2ab6f788b566
SHA1 f3bc5a288ecf620a283e0aac3519208fe81c807f
SHA512 ba7dbf3d3cf304ef43e72b6e71ce8429cd1623e3bd78ade8417de1ef17612e462208cca187de5d735805d55911b6086ad78d0012917cf3228ff9768ae7eb5290
TLSH
T139E020B549FCC25DDF407647D16C431CA280364A97C4FA0A374088C87445840E697F51
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 7bdedb81b954529dda3c7d1325d85862474369320fb38e3b623abef0d8ba9be1
MD5 8790285bbed296bdff2315cfd21b37b3
SHA1 9db35c45de1f166c37418a9ab07470381a6a8f44
SHA512 941165521d7e0d58b6947d0274a7d5001550ba2f821885cd3042a753894974d8821c42c4196730f921ae7868d7d2763bf330955430cc94840233585eeb7a302f
TLSH
T1DBE026B404DCC3BEEA4275875168930CD280364E93C9FA0A27888DCA7485150FAD3FA5
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 e89859490fc1c59a91b809f697088f6705bdb2db9e6e4f74da9de5e5ab3ebcd9
MD5 3ab77ce4e5377d6d69b367c1879c65a1
SHA1 35525d2f353fe4ba77f6c78a0b8ce956a4917ff7
SHA512 b1962fcf7c656e79866f3ef93b316459daae596cfff45bbc3d19cd95fbf1cbc441f7120a7d04be16f62f8d632e042c393acc36dd53e25663abfae70df1597711
TLSH
T182E020E908CCC39ED94064875174878CED80364A9BCCFD052740C8CD7981850FFC3965
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 1011fd49f119e09945a4dd7b14b2963910c1a88397f2a4d070e0a3a56a1b67e5
MD5 4a9cd66b6a5f3cea86d049a5c29d0cb2
SHA1 160a8d94a22cd57642f9d92d7a71093726bc145f
SHA512 6531e4b19a004a5748b0f1068ac7001c5af6a579c95af20d493ab08be8f45687804e1cc4c7a1c3a877055946491df2547ac1506d27de2bd2a7243b735b2a318a
TLSH
T1AF511AB023B2D9D3D765877757E26A8E36F0946B26072E5940643D758906F2CDCF102F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 67ae5e89a4939e85d55555b2c5c21e763ca84287d41b4e249992e33f6761b961
MD5 2290236701e29ae8c1106a7aa13238a3
SHA1 ef022d6151105370e757fa6021382fd6f14f5964
SHA512 2c3e9a06235e72f85950d2d2d1c2a686ce07387f7e4167703420bbd02bba8b9bb553b9b8154eab2f36276745531ac5daff9cdd449a4100c6ab4bea7bab2c1fa5
TLSH
T1C831BEF783F5857E8A0186F0AA14AF2FCE2D0511831C7C69C5E0AE2793E3472E041A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 e07697ea86d1db3842ca434942762481a4e17dcca9474fed03438bc2e001b670
MD5 98a9e6f5e1a630b463f4a1b07272ea7f
SHA1 95f3c55bdef0554c4513e00b2b20402a9416e1fd
SHA512 4a4bc3f5711ff2a19922252fbdbbecfa6f2b7ca6ddea7afd3e07b61fe6e96abb3d079366aa0af9a1cca42d7e134d6a74a2b357f4290cac69cd5abbacbf856d53
TLSH
T17531B0F743B4856E8A1196F0AA14AF1FCE1C0511431C7C69C5E0AE27D3F3072E041B5B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 ad22e6991187dceabbe86438d3b3b2219545cfac372814c7254044385ee2dbc6
MD5 32f3b4ba8bc489f38042999902549c0f
SHA1 2073edbacc3ee1b2a9170707623bef8db8828ec6
SHA512 d24b04145ed20202c0a904e333d806b1266a23b08e450b563a3d6dc15249d5b320617cd787ca4cee858122674f14f148494cb0f64df58bf5eff2ccc1024f305a
SSDEEP 192:sxRZR1bj/f5sNhwG0zoA8p4w/g6+WNIYo5XCYGGrPiIgDWJ:sxRZHj/f5sNhpV9/5IQWPiu
TLSH
T16732A6156A38A93B8CC7D21DBA65BF53D3F95032A1D42E58F6FC9A1C04E7ADD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 07fb3072ce3924d54f6029995f297d6f881e171571720aa86dd262ea07bf3381
MD5 5fd26bb594b9371539af6413ef9b8070
SHA1 625cb173a01de5eae184999e43a7d0b116a251de
SHA512 acae06468f748eb69cd793a184df32bdf81f4bad8976af8f1c9789b52ef70bf602bb8bad1373e8fd1e2b10e3a6bc57c28db7b5597e9580b5121c1e84a6f5b481
SSDEEP 192:sxRqR1bj/f5smhwG0zoA8p4w/g6+WNIYo5XCYGGrPiIgIJ:sxRqHj/f5smhpV9/5IQWPis
TLSH
T1573297156A38A93B8CC7E21DBA65BF53D3F95032A1D42A58F6FC961C04E7ADD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 3659ede9e492d61c5e0764638d69035e37dfcd8476069af3dd5627b8df83edb1
MD5 04c7e16a077639838733fa41032157df
SHA1 e9fcb5289c1082e7f28b5db824f5ffde680511b0
SHA512 1936a10c78f06863384aa65f149ef220d10b23f6dd3de8d304aa3685729d30d545f27ab112ab1aba30e4b52402d63d3ca700605a30c0447045e4d7d471477ff6
SSDEEP 192:sxRZR1bj/f5sN7wG0zoA8p4w/g6+WNIYoHnCYGGrPiIgDsJ:sxRZHj/f5sN7pV9/5IiWPis
TLSH
T1EA42A6156A38A93B8CC7E21DBA65BF53D3F9503261D41E48F6FC9A0C04E7ADD220741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 e4e21d1734162ae2b165f96a6f90659448a75c3d3ad6da857efa5a34d3677f2d
MD5 f79df1742e8d3b846987079e0d76bb70
SHA1 17dbe2588c9de1fe6d8c35a18834deb60fe767d9
SHA512 d4e213306dda9de9fa47af357f4f5a0e87736d5daa0c59b919f837966f7661760279e826db7a84ba00366c86c6070ef944b1adfc55bc3e73b966f2e3e31d5796
SSDEEP 384:jzK6H0dfCtgsqFf02KhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVvf9uaRXero98D:j26H0RWgs2f028F1+UoAYDCx9Tuqh0VJ
TLSH
T1D6B2EB2B640DCBBE9F800A9DDC196FDB6D9802C79B588D4047FE994C03C77EA911A4DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\947f6716-2b3f-4c7b-b889-f206c72a8acd\index-dir\the-real-index
Size 144B
SHA256 736834e8f51e00580d2ac9d7679d5baf77e35dce809bb41c942c780062fb90d1
MD5 731d61cd31423eca4ccb73575bc98088
SHA1 3c94cdd43c22657ef85b3f47f8cf94c051fe9bb0
SHA512 741c4a113aa61579b1bbe99a695413afe7bd9f3befdf9c0040613ca74f3aadb799ac707b0ea8089df4b9fadf44745783a338a1ce24df36c3328f9027aea6ca3b
TLSH
T124C09216CC1A4AB5C86B62312A67306827220AAC0516AA2A14DD2C06A5A345DE0D7905
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5df0ea.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\947f6716-2b3f-4c7b-b889-f206c72a8acd\index-dir\the-real-index~RFe5df0ea.TMP
Size 144B
SHA256 0f54fa9156c51ccce761b8057f3697f7d6d4aac78fd53bc63ca814f730504f58
MD5 4606135d152b336ba77b853292c93a9d
SHA1 7206b28d9825e4e5cb27745da1f772bd5889484c
SHA512 1f0434254e4023367ff0b8d5fa5c9e4af2b1d115504465ceef36aec03c6fe20fe1a6544bfe49d400eb44ae60d76d4613d2791dbadd3752321e8fd13597ddaebe
TLSH
T1EDC01222C552C9B4C40B657010438229237F0C300025B72B70ED186F98F50C4D0D7B09
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 370B
SHA256 0e0ac4880fb4527c754d69e47bc5085015e49169e78c831ae394ea1c2262ac70
MD5 6740af6afd0e6994bd1962834b71cd3b
SHA1 bad24cefe95019c89b965d9c5c68f72ab532e73e
SHA512 572f98adb146360ab21d34e95dcfee29b7a0e0cf218ae9158cc0585a687e8661aab94f17e558c1ab14fd3e55eef3b55c28d9a219078bb200895ecca7d77adce1
TLSH
T10CE0D8F62DD73C14FCBF97EA147564980181B9649449EC8F251E96C760F22513896C25
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 d876abb36678c506e195ea0d168e836260bb294fe8f064325548821abc5b3df9
MD5 ca7de861b41dbb82d7ab38aef9d1d8dd
SHA1 baa7e6c78d8d2250a9820046828cb1db4088644e
SHA512 0f240822d8b6d954d15c2872757281f230ae328f6872c871f13f6aae8fbfc7bd14df249aea9ab3fb6290daeae3df5b3aedbf2c5ed822ffc14ee698d1b257ad9f
SSDEEP 96:KR3gFB31lpWRekgJpK4ggHpcvHG5FaHoZs4q26gWeDzgggK41gCgcwgzijkAKp6c:C3gFB31lERe1JDggH2vHG5FaHoZs4q2o
TLSH
T1EB91704176BA02043C7EB61E81AC9D1FD69170737109A52F7BA801664FABE464CFDDCE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

c755a6ee-2982-4641-bc1f-982f6967dc7e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\c755a6ee-2982-4641-bc1f-982f6967dc7e.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 caf70c90e2d9a80b9b60805147bf62bfacec1dccdf05dc9feddcb868bc7e6ec2
MD5 5a2758970557fbee80f751e89edc478d
SHA1 9c689688b3c4a7ecebb699a9d373d93c895c890b
SHA512 8039dc86b17cf6943c491421aad0abf6e90125eb1d2f5d3b3ec36b98e933e14802e021590cf548424ea5fa7a61107e27852f8f86300e4a93a2f2257a69187484
SSDEEP 768:2K3fFD/TBOW8FsmgONXyer1IRCzni9Jhy6Dqi:2K3fxadgSIqnqTV
TLSH
T17CF2BF31E5A4AE274CE6A3C6B10A3303AFF95027D6C45B94EAEE6F1D01C755E130F81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 2f28f0d993a78c7a55be8e9ec6cd2576f84dd50cea35e0bbabd0478ded879afd
MD5 e27ec5ccfdc4a8365c1996a47dce7045
SHA1 43d7204dcc7fc78727eae13188f90a4165f2599e
SHA512 c19888f2cf97b307e73f21e9b7d899af08ab9ae181eeeb7c69a121f21a7b63c481c2906ad3110097ffbc0670a02bc2f68a4996113470f8c639bb22e1c54e73f9
SSDEEP 768:Vrv+4UNbd93/ND/TBOW8FsmgONXyer1IRCzni9Jhy6Dqo:Vbsbb3/5adgSIqnqTf
TLSH
T1B113BF31E1A8AE374DE6A3D5B00B36437FB8101796C50BA4EADA2F5D05DB49E230F917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 c6d49e28fd2407381dba65d2a60c8f27ac171ac81d3d30f197dd00429525a2e2
MD5 76937a9d4b8a8ecb4085c6f4b476514a
SHA1 db0e8c6411cc300bf1e414c71b341e0730b5010b
SHA512 8de2a811586ac36192c7a0c6f1666187504bb29fd77bdb948f56eefbc00d15c86406d8f666511abc0afeba29729be886556829630d2a378fa2737c22fcc80207
SSDEEP 768:tFQh3twg5FD/TBOW8FsmYONXyer1IRCzni9Jhy6Dqi:8h3dxadYSIqnqTV
TLSH
T10E03AE329594DE3B8CEAA7C6F50A3313AFF51027D6C49AA0EBDD6E1D019719E130F816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 daabd45868d256e1f2ff61fcf37973882be77c157ffb1f20ed63060cfa338ca4
MD5 1643442a71fa08250d551d3a476ae584
SHA1 495c857f45cc59a26bd30e849658b3e9eff167ca
SHA512 9136fa150c5aa94a1594516cbd8067cc472109cd74bd9052ae0009219a74403a5c356b3a9d082c5dbfe63659c54b69f6f7a0d54985aa4cbd04088ea21fe0f7e3
SSDEEP 768:hrv+4UNbdz3F9/TBOW8FxONXyer1IRCzniB1eVH1SK7:hbsbV3baxSIqnyEH1l
TLSH
T16B03BE36E4A89E378CE2A3C5B14B72037FB86057C6840BA0D9DE2F4E069B59D130B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 6a951e3d9609f8306e40ea48488e3d2248aba2629c2e8f2b5831e31e166ee4af
MD5 a70cee730a1ada77b0be7af75c23b0c1
SHA1 262c2645c05b6b2d69da6ed4ed0bbc24abf14b98
SHA512 c38455c837a049c206e44c5487268a1dae12845c85cc9f63ddc3f3618f45a9bc310a570faf9dedee47f580450675ee6aadbc60048e4fd56970f8df8cc32b07df
SSDEEP 768:Wrv+4UNbdz3aR/TBOW8FsmiONXyer1IRCzniwJeVH1SK7:WbsbV38adiSIqnVEH1l
TLSH
T13F03AE31A1A8DE374DE2A3D6B04B72037FB8605BD6840B90DDDA2F4E069B59E130F957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download