02cb496bff5ecd4ef3228202796d761b8729488fecf4aca89da22c048762bafc

Analysis

user interaction
yes
max time kernel
1679s
max time network
1317s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 03:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
sample.html
Size 24KB
Sample260809-d53f4azbkd
SHA256 02cb496bff5ecd4ef3228202796d761b8729488fecf4aca89da22c048762bafc
MD5 ceca47567d6c377101329ddeda5b7a0a
SHA1 e067fc83d99b29c0c7a670063fcce478be1a9208
SHA512 97c6b1036a517224fd68e46b43433ef2cffd22fb1064d68fbfc835091d28d61f7f7518036989fd32d326de88e9fc27d98ef20c18091fcbc2218728e5eb14d49f
SSDEEP 192:pZTysqR7dOFdQaFAmwJ+c2+XURKj03RhtXLe+sKzekPPUyJLxNK91m4dbPD+1Jk4:pxFFGbb+rV3KSMbkkpOi9OhK9jS
TLSH
T1ACB2D964E5F250754047C3D09BB6AA2A2F91E107F647C81CBAAC0B949FC2D9ED8936C7
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
6068	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307201940901095"	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1738198120-2966725515-3980530802-1000\{2EB238FF-DAE4-4089-BB27-0CCCDC9C8884}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1738198120-2966725515-3980530802-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2824	msedge.exe
2824	msedge.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
1668	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe
4136	msedge.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 4136 wrote to memory of 3732	4136	msedge.exe	88
PID 4136 wrote to memory of 1668	4136	msedge.exe	90
PID 4136 wrote to memory of 6068	4136	msedge.exe	91
PID 4136 wrote to memory of 1668	4136	msedge.exe	90
PID 4136 wrote to memory of 1668	4136	msedge.exe	90
PID 4136 wrote to memory of 6072	4136	msedge.exe	92
PID 4136 wrote to memory of 6072	4136	msedge.exe	92
PID 4136 wrote to memory of 1660	4136	msedge.exe	93
PID 4136 wrote to memory of 1660	4136	msedge.exe	93
PID 4136 wrote to memory of 3284	4136	msedge.exe	94
PID 4136 wrote to memory of 1660	4136	msedge.exe	93
PID 4136 wrote to memory of 3284	4136	msedge.exe	94
PID 4136 wrote to memory of 3284	4136	msedge.exe	94
PID 4136 wrote to memory of 700	4136	msedge.exe	95
PID 4136 wrote to memory of 700	4136	msedge.exe	95
PID 4136 wrote to memory of 700	4136	msedge.exe	95
PID 4136 wrote to memory of 3436	4136	msedge.exe	96
PID 4136 wrote to memory of 3436	4136	msedge.exe	96
PID 4136 wrote to memory of 3436	4136	msedge.exe	96
PID 4136 wrote to memory of 5884	4136	msedge.exe	99
PID 4136 wrote to memory of 5884	4136	msedge.exe	99
PID 4136 wrote to memory of 5884	4136	msedge.exe	99
PID 4136 wrote to memory of 2008	4136	msedge.exe	100
PID 4136 wrote to memory of 2872	4136	msedge.exe	101
PID 4136 wrote to memory of 2008	4136	msedge.exe	100
PID 4136 wrote to memory of 2872	4136	msedge.exe	101
PID 4136 wrote to memory of 3428	4136	msedge.exe	103
PID 4136 wrote to memory of 3324	4136	msedge.exe	107
PID 4136 wrote to memory of 4004	4136	msedge.exe	108
PID 4136 wrote to memory of 5932	4136	msedge.exe	109
PID 4136 wrote to memory of 5556	4136	msedge.exe	110
PID 4136 wrote to memory of 5556	4136	msedge.exe	110
PID 4136 wrote to memory of 4248	4136	msedge.exe	112
PID 4136 wrote to memory of 4248	4136	msedge.exe	112
PID 4136 wrote to memory of 2824	4136	msedge.exe	113
PID 4136 wrote to memory of 2424	4136	msedge.exe	114
PID 4136 wrote to memory of 3308	4136	msedge.exe	115
PID 4136 wrote to memory of 2424	4136	msedge.exe	114
PID 4136 wrote to memory of 3308	4136	msedge.exe	115
PID 4136 wrote to memory of 6084	4136	msedge.exe	116
PID 4136 wrote to memory of 6084	4136	msedge.exe	116
PID 4136 wrote to memory of 1312	4136	msedge.exe	117
PID 4136 wrote to memory of 1312	4136	msedge.exe	117
PID 4136 wrote to memory of 5880	4136	msedge.exe	125
PID 4136 wrote to memory of 5880	4136	msedge.exe	125

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\sample.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x2b8,0x7ffcd606c188,0x7ffcd606c194,0x7ffcd606c1a0
  2⤵
  PID:3732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1832,i,4110436236836526834,1225837397985212537,262144 --field-trial-handle=2664,i,12991762987200159353,10249457887006946008,262144 --variations-seed-version --mojo-platform-channel-handle=2660 /prefetch:2
  2⤵
  - Suspicious behavior: GetForegroundWindowSpam
  PID:1668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1956,i,16938247727364688998,4248089172249311321,524288 --field-trial-handle=2664,i,12991762987200159353,10249457887006946008,262144 --variations-seed-version --mojo-platform-channel-handle=3232 /prefetch:11
  2⤵
  - System Time Discovery
  PID:6068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2424,i,15320306130434639836,8188587805927156524,524288 --field-trial-handle=2664,i,12991762987200159353,10249457887006946008,262144 --variations-seed-version --mojo-platform-channel-handle=3180 /prefetch:13
  2⤵
  PID:6072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3544,i,12716462482667523585,7731264832169852677,2097152 --field-trial-handle=2664,i,12991762987200159353,10249457887006946008,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:1
  2⤵
  PID:1660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3576,i,1099558777734363071,17831027304730702679,2097152 --field-trial-handle=2664,i,12991762987200159353,10249457887006946008,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
  2⤵
  PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4264,i,18177570655584455069,2796311059011402943,2097152 --field-trial-handle=2664,i,12991762987200159353,10249457887006946008,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:9
  2⤵
  PID:700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4228,i,5716873136675649393,6793667515973126889,2097152 --field-trial-handle=2664,i,12991762987200159353,10249457887006946008,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:1
  2⤵
  PID:3436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3872,i,7736479100167625898,8591543067923664422,2097152 --field-trial-handle=2664,i,12991762987200159353,10249457887006946008,262144 --variations-seed-version --mojo-platform-channel-handle=3812 /prefetch:1
  2⤵
  PID:5884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5476,i,2578878625535909114,9046319339831162455,524288 --field-trial-handle=2664,i,12991762987200159353,10249457887006946008,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:14
  2⤵
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5488,i,1914668552586747601,2865986825157805216,524288 --field-trial-handle=2664,i,12991762987200159353,10249457887006946008,262144 --variations-seed-version --mojo-platform-channel-handle=5544 /prefetch:14
  2⤵
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,16055235568638486673,17618662543886732324,524288 --field-trial-handle=2664,i,12991762987200159353,10249457887006946008,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:14
  2⤵
  PID:2708
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6292,i,16055235568638486673,17618662543886732324,524288 --field-trial-handle=2664,i,12991762987200159353,10249457887006946008,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:14
  2⤵
  PID:3428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1240,i,10035687073898805812,16087178537568519966,524288 --field-trial-handle=2664,i,12991762987200159353,10249457887006946008,262144 --variations-seed-version --mojo-platform-channel-handle=1356 /prefetch:14
  2⤵
  PID:3324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1232,i,3215066895463873081,558029599423326744,524288 --field-trial-handle=2664,i,12991762987200159353,10249457887006946008,262144 --variations-seed-version --mojo-platform-channel-handle=6336 /prefetch:14
  2⤵
  PID:4004
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1360,i,1935069038037142474,2772930997223023993,524288 --field-trial-handle=2664,i,12991762987200159353,10249457887006946008,262144 --variations-seed-version --mojo-platform-channel-handle=600 /prefetch:14
  2⤵
  PID:5932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6844,i,1838340019358065145,11156201309458490575,524288 --field-trial-handle=2664,i,12991762987200159353,10249457887006946008,262144 --variations-seed-version --mojo-platform-channel-handle=5500 /prefetch:14
  2⤵
  PID:5556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,18108735191037010287,3085003710187162129,524288 --field-trial-handle=2664,i,12991762987200159353,10249457887006946008,262144 --variations-seed-version --mojo-platform-channel-handle=840 /prefetch:14
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5736,i,17019217477119138872,6098832842976323238,262144 --field-trial-handle=2664,i,12991762987200159353,10249457887006946008,262144 --variations-seed-version --mojo-platform-channel-handle=5728 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6196,i,17435716979461237413,3101565710425658277,524288 --field-trial-handle=2664,i,12991762987200159353,10249457887006946008,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:14
  2⤵
  PID:2424
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,8010219923309602517,134988551810372404,524288 --field-trial-handle=2664,i,12991762987200159353,10249457887006946008,262144 --variations-seed-version --mojo-platform-channel-handle=6548 /prefetch:14
  2⤵
  PID:3308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7064,i,792743412456611972,1061019170351148456,524288 --field-trial-handle=2664,i,12991762987200159353,10249457887006946008,262144 --variations-seed-version --mojo-platform-channel-handle=6992 /prefetch:14
  2⤵
  PID:6084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5580,i,8042211548655770382,9116118865818662131,524288 --field-trial-handle=2664,i,12991762987200159353,10249457887006946008,262144 --variations-seed-version --mojo-platform-channel-handle=5616 /prefetch:14
  2⤵
  PID:1312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1268,i,7957972216045730568,2902369287519186588,524288 --field-trial-handle=2664,i,12991762987200159353,10249457887006946008,262144 --variations-seed-version --mojo-platform-channel-handle=6744 /prefetch:14
  2⤵
  PID:5880

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3760

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6028

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:4684

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:3844

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ac1b1f93ff87eb876027f4166d705375c0f5d3d22dcb03f6a66f6100e88dd10f
MD5 b99f03c5cfe71b03836f8b5fcf09425b
SHA1 8a5078499c0b5ea40183efb77f9c1028c196409c
SHA512 6b9feec4ead7bf05f67d0d480907e21a3b770d8d12dedd2b0d785904186eac7448583e61abacb23582948de55c8ea2043bfd6908efd7faecdd82cee91404cfe6
TLSH
T16DD02BE037909D18C440353163D0122091006C30880923090100A02C8D3E2C3054F0BE
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c95a47aec5edba88214fad580cb869417b6620a91d8ee97e2d0b7801d3372be5
MD5 aad5f2ca0dd16bb2ea6c7757ea569c50
SHA1 5228b0b132542be004ea1bb32f3748964d065af5
SHA512 9d59c0291d741bd9d6cf50c22972d4baef00e7c1a48d6a3311a6cc82c04ceeba6e2be9458334cb954878915cc9eb91a8fd8bc4a47c966d57a2a05d6ee8211640
TLSH
T1D4D09BE177A19D18C545353567D1522591416D31451927194241E13D9D7E2C3455F0AA
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 fab2de54a9148038fa673827a6baff11858628a42d86aae6f12d43c84be285df
MD5 bbeaa05b1323b8536093c839f3d3ddb2
SHA1 1d7ab213dca8ea3a83c308a7fd6b634f2bf6d5e5
SHA512 c1b703eef8fd41552d3ec2c805d8a64426ccb5edddb6ab4626fc1eeb4f11f37289c3292c5b04518d2807fc464e09e8018d9b2e0a45631d29a0132180854c8c58
TLSH
T136E020D805CCC27DAB106547556C878CC2D07B0F9BC8E9552738C8887503454B6F1961
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 8d5c499a91099e46828644cd6be2b7ed0d01ecd298f6103a1de0e277a39b0372
MD5 0164b9b90a1aca1023a5696efcb08f9f
SHA1 d29b1d998ea6976ff9be79ce59ba7a5981facff6
SHA512 0f018ed2d8ba970a9740f0dbd2eb7d3b26908929f8cd3f5d6f4493277724d3ab7cdb8bb22502f6b654eb5deb5239286e8e8ca5d2a9f80f14bc6536932933f0b2
TLSH
T15CE020C805CCC32F7700A5C753595B0CC2D13B4E97D8F9265718C8897A05440E2D1960
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 0edbad8199614040c455cff0d88039b1ce886aa86b5ff954f98159e92944da7d
MD5 2e0b13d72bc59fedaef8e477e6672099
SHA1 309793dc0891176da4d9544000da4e5a0a6ccfc6
SHA512 81b372adb4627ca5d6efe1eeb8e890bca36f17aad8a3df625209f84de8a61b0da3c82cbd49bb3814ecab24bc1218082c5a45a672df7a07e856805908eaaae459
TLSH
T123E026DC04CEC22EA602745B51A84B1CC2C17F0EABC8FA5A2B28C4887601080E6C3AE0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 e62927ef99543bba010df31e83432095c5ed3cfbcfeea6c27c74decf3e23c0a1
MD5 c07dba90f227b874d716653043570382
SHA1 7b02c2de2694c4fbdfced47f0f87bfe54531514b
SHA512 9c04056dd6fdd744f82da3e6e58a9ffab8ef3f0db678ef2fcd387f2bb32e46cf11807867500b8c4f28c36144ddb72568f028e48057cf8102e1384817521022c4
TLSH
T12AE0209816CDC23D550464C7637C570CC9D13E0ED6C4EA695700CC8879025407AD59E0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 3e9207b99c0e559497aad86375ae991873ffd8a1376c081e3c96f3928e54f517
MD5 930b339a3f8e6d95bd86ca365abced3e
SHA1 85cf18ed018d30068f32e1b8ca3d6184c9d72f37
SHA512 915add36f909bd9dd3362de7f4ab7a3decc5a74fe925f0fb47360d1742107c7d273edc6606fc811b959b3238b755af13dd21b8a6014813ca72838c82aa638bce
TLSH
T11651A491632DB9D2DF258C75ABF3148D31F964A9010FDF0280426F34E6A2FA430F102B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe599689.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe599689.TMP
Size 3KB
SHA256 77a6f953e4df813d477bdb77f60361b2cdf5a3ef505667122a909919bd5497ea
MD5 5f79170d916c179de082ea805821d6e3
SHA1 47d0531f140015dbd2fe8b16329e39d838cda99f
SHA512 71329ca6513d5832250d1bf5097909b417b3c1a99fd7235d1d1a73b4559a1601b428815e20401986116218251c4b26efb137d12fcf558f1abd9af7eebbaab7cd
TLSH
T1C7519591632EB9D2DF258C75AAF3548D31F968E9010FDF0280426F34E6A6FA470F106B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 7bc2d0ab067944136eeb236e2295d040f737c6b2c86cc8236a0b775fe2ca5e28
MD5 7c2a0f7b095dc287d0d3fcc72342891e
SHA1 704f6d12d7ea8a6a8eefa308df6480ce31911822
SHA512 8ba353e2ff53049cd0dbe8a8b3f0e40d29c58764093a751525fbcfd369e746211d4182267ac91bfc2012db6aa829a9543835add1570ffd00ca211886eccbd43b
TLSH
T1AF719CF783E4837E991196F09A25AE2BDD1D1117432C3CA689F4AE1B63F2071D14279F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 7327e52b0f25fb0308cbc1a10246c69f0b38b90c3cee414bb506ef9d2ab302b0
MD5 b2fbfbf21544605eccf7de519c98996c
SHA1 0f896d27d97aa7967e3c38cc70d6b339c8cc0566
SHA512 359ec387ff7321310bbb49b17f36e8f3b5fc6d86eb88d28d1af61716f6f4f8c00ca06c514b2e7650044549d2b13b83b21a60f82cef30bea9dccda3acef5e6fc4
SSDEEP 96:DCOMpMSMKHSXDVaaii8CZrzJ3HgVW6RZMEsGwQ:DBMpMSMKHSXDVaaii8CZrt3HgVW6RZa8
TLSH
T1CFA19CB7C3E8837E881156F0AA297E2ACD1D155A422C3C5689F4EF5F63E2471D24229F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 7bb44d9b9def3eca0515a1c1412e2b4ffcb2ee4ce60e35ee77bba1640eb7e2b5
MD5 5d297c6a6e8197a2f23055ee983b0adf
SHA1 a0b9af5ee8df1db0efbf44fd560ae761a7b82171
SHA512 4558c4413f897fcc075e2ccc9cf011556dab84d6195be4691b726618f2d8a24c9e5527db4d03b673be94c9f785a3523ae7d9b314d3d5e91503a1ebd4b08c89c4
SSDEEP 192:sxRpR+Xbo/fPsazDwGkzoA8p4//g6+WNIYo5KCYBGOIgIJ:sxRpcLo/fPsaPpFW/5ILms
TLSH
T10332B6166928AD3B9CC7E21DBB65BF93D2F9503361D02E58B6FC960C04EB6DD220740B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 4e232a0b92160108dc9e03449f1c9046eb728e179b3c77bcaf9abe567ef4a92f
MD5 72916a8454303a5f9788de467d4f2fc8
SHA1 97b6c6b58774191dc5bdce7d02bac6d42a2a3c7f
SHA512 1e4b3c625f37ab7920c57f48517d872bb341d0550f6383c7b653034f1cc6983c92b099c075b73aa07c2629a8b86959fde4e83da84b1428b65a2a1d81c324f350
SSDEEP 192:sxRCR+Xbo/fPs8BDwGkzoA8p4//g6+WNIYowcCYBGOIgDJJ:sxRCcLo/fPs8NpFW/5Iym3
TLSH
T1B632A6166928AD3B9CC7E21DBB65BF93D2F9503361D02E58A7FC960C01EB6DD220741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 2091fb5ce6dacd632d7ec0857ba32a5470880b2d67d5827dd3da28f8c9b8e858
MD5 b921635074c3f047935aac1aab6fb0ab
SHA1 d90ec5bacffe6b6ab102c0391262c5d5a1edc1ea
SHA512 e6592e80405ad47662f2eaa500da4423c03154b7d6ce63d4fd9f220573569e91404d405c9478db7d1d13f03877f3ce568cb1a23583b60d1785ffd75705fd6811
SSDEEP 192:sxRCR+Xbo/fPs8zDwGkzoA8p4//g6+WNIYo5KCYBGOIgD3J:sxRCcLo/fPs8PpFW/5ILmt
TLSH
T13B32B7166928AD3B9CC7D21DBB65BF93D2F9503361D02E58B6FC960C04EB6DD220741B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 a5b348d62ffe44d2987786406ae2f3da32a26c93f6c77c2c19f8d0a111bee934
MD5 f3c02eac995e0841666b158ff53c92c3
SHA1 4670d35fde6187dd20a3385705ef213f1a971fdb
SHA512 aa2c9b9e8101f5eca992d6c3e032d94f0b535c8a9996369a7602cdbad9fb91ef3b882efbbd0fdc10f1a431e14fe653bd7cbe19ae0db0c503ace8a394e6eeac13
SSDEEP 384:jzK6H0dfCtgsqFf02KhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVvf9uaRXVro98g:j26H0RWgs2f028F1+UoAYDCx9Tuqh0VP
TLSH
T13EB2DC2B640DCBBE5F800A9DDC196FDB6D9802C79B588D4047FE994C03C77EA911A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\19e55477-2a64-42d8-8290-7a611fa42000\index-dir\the-real-index
Size 360B
SHA256 871ccdd96a5fff765d1d932613d96173ff999626725a111ce5eacfb66ac41f11
MD5 b974067bc59dd75083693c5ecc6d958a
SHA1 51fdbbe600a5fbde7c20c448869e99bbe3c9b199
SHA512 b0b9a875f61929242f15db0fcb6e159d1a633b869c2e42f656269185ba49ec0ac4442b2831013e4f982f9041c3335c767188bc05abcc4fe200ef5d867e7542cf
TLSH
T1DBE02B9E8C639943CE37B87A0673A42E333B06FD1605AE5A50FE541EA65363C8241645
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5dd18b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\19e55477-2a64-42d8-8290-7a611fa42000\index-dir\the-real-index~RFe5dd18b.TMP
Size 360B
SHA256 b2c8ee282088e0f62223e85dcdf43145e876e20159455162bf4e41e716836299
MD5 404bd4ad6ccbdee085ed7d5407c411f5
SHA1 b9c3ce31f35808f8db8bbe263dd39855b123e9d6
SHA512 c56634eafafbb5139a7f0ef871451aee71a3c696563a749d29544f7f0b1bebe64439402515a3f3d22440c0671c39f02f9dc2ac868b6b4a6f857355d0158b7d82
TLSH
T16EE02BDB4491AD52C92669351502652A333F08242505E61A50AF545E59217BC858560A
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt.tmp
Size 371B
SHA256 a9685f3aedcd8e2c3118d382ec7ff8b1c06d7a54a9ecd51db5630a542d796328
MD5 447dde21393d55a39f269016d06ed679
SHA1 c007259cf08507df0fe68fec979e806227779ce4
SHA512 58ce9ed1481fdb08a1930d6d1ac8d61244046a32ce633c813aae087640e377f2ed3870104e233ee4ae553953b7dac16e340eebc7ed1e9d70ef7090de42e2c992
TLSH
T1EBE068B23AE32814FCBF93F52434A8A405507954C848AC8F611A93C200F1216385AC20
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

53b280ae-7283-4f28-a72f-ff3b9cb8f469.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\53b280ae-7283-4f28-a72f-ff3b9cb8f469.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 fff1b3e631c25f583303b9bac56b6016c7d128dc3547943734a45cb76cedc70f
MD5 3278b427afdcb154f77d60c3b23f3269
SHA1 fa71be28c52812c090334db00d9368c4ee4038ed
SHA512 c0d109435ddef268b90aeb00d61c07fcf2b443065048be38c5b8704cd5bf3ad43b36e82cd980dabb8f1b834d598e2fa1759c9b2122f7fe1d3f73f6af61a101eb
SSDEEP 768:Yrv+4UNbdz3tC/TBOWQtt2EONXyer1IRCzniwweVH1SK7:YbsbV3gcSIqnMEH1l
TLSH
T1CF03BF3291A8DE338DE2A3D6B04B72437FF8505796840B90EDDA2F4E069B59E130F957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 011ce2ed7aaf2d2a2dfed5168f0a8f8fcfa3167dba80629c8b5ccab1fe92c451
MD5 eeb63ef08b8da93ddb907bea7faed129
SHA1 b56d85df393e0a499c335f9cbc79bf494d814326
SHA512 7bfc2dd81e841edd2773d24817ae9a4a660da725518ad2e43831c4fc74a2f1d4965d850d477e32bfd2befa84d011e8e13c7c80bc1f83d4b96c29f599af7a5c95
SSDEEP 768:krv+4UNbdi3DrQ/TBOWQtt28ONXyer1IRCzni9woJ:kbsbM3D8USIqnroJ
TLSH
T19C03BF31E4589E338DE2A3D6B10777437FF8605785C50690EADA2F8E068B99E230F957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 aa6fbfacd993f834e5e54933fcd9e00c18331ab13c79487c60151e4626b24f39
MD5 bc7ccf598dc9bd0a375f4580bc1ccb90
SHA1 720d4cf3dde845171a7bcc53d982e73ecfbb63f6
SHA512 f382f88d0eeb3bb0becb1f06df9ca81ba8ce2d1d513768cae5e2c52553b0ff51c955c7df29f48b732047b0af4b7fdd471096b1a7b550ab0acbc23016c05237cf
SSDEEP 768:Bh3DQQ/TBOWQtt2UONXyer1IRCzni9w2ewBKZO/r:Bh3DbcSIqnr2evZM
TLSH
T113F2BF71D4689D238CE2F396B50A7343AEF89063E5C40664AAEE6F1D019795D230FD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 7d1210a74657a32edc1d43a40b3cb1f108b189ec5db9f3b7709ccdf874888d09
MD5 d5ceef03ce2f6c9321b5af62ccb87af5
SHA1 e0e549e3c94278d911c05695ad0ac6c8443d1b6e
SHA512 b6dbd30b35e003fb08bc8a6c12942413dc144143677b1bd736504a9b6a385c84e73ed868e456b78e5950fa471588720e21a6228a0823f65476aae6cf467d2e01
SSDEEP 768:Ah3+QQ/TBOWQtt2UONXyer1IRCzni9w2ewBKZO/r:Ah3+bcSIqnr2evZM
TLSH
T170F2BF71D8689D238CE2F386B50B7343AEF89063E5C40754AAEE6F1D019795D230FD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 03c01874c4270e5742483e5fb76724057353fd556472b78c13bb5aae3a35c6e9
MD5 298811680c642c363d5fbe0ab64c0a90
SHA1 5d3a275952495ee4d5b7ac54fa0d56a6a15efd10
SHA512 6744c7c4bf321bdfdfbef62446af811f326358f97511a0002b05d9a3bf1a85ba0993301b0ca30a347da7fcba66de3083492ef2e0f1d71ac5978499956dc79751
SSDEEP 768:8FQo31wgFQQ/TBOWQtt2HONXyer1IRCzni9w2ewBKZO/r:vo3hbfSIqnr2evZM
TLSH
T16003BE7288989E379DE2A7C6F60A3343AEF45063D5C49660EBDE6F1D019759C130FC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 7851987e76a77bd133ee00350261260a68893988ca509b2a042d72afd885b4d5
MD5 4600b12be6410865fc7f5414ef51e72d
SHA1 99bba03acd96603a4e32fcf4b613256a7fb8fd0e
SHA512 6ccfb02e7dd88f049108266b2ec3d76c5f5f974a427aa3658a6b1519ca1ccef571945a99ec31908f86b47dd6d0241b4a0cd1545c20c51f69ad5af01c0a88969f
SSDEEP 768:hrv+4UNbdz3rY/TBOWQttgONXyer1IRCzniB3eVH1SK7:hbsbV3EbSIqncEH1l
TLSH
T19A03CF36A4A89E338DE2A3C6B14777037FF86057C6840790E9DE1F4E069B99D230B957
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download