hxxps://getexescutor[.]com[:]443/real

Analysis

user interaction
yes
max time kernel
508s
max time network
507s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 15:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://getexescutor.com:443/real
Sample260809-s2ryhstvfx

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1560	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307635720602337"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{86A1D182-26A7-4974-9518-43A8DCFF4621}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
920	msedge.exe
920	msedge.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
656	Process not Found
656	Process not Found
656	Process not Found
656	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe
3632	msedge.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 3632 wrote to memory of 4416	3632	msedge.exe	86
PID 3632 wrote to memory of 1560	3632	msedge.exe	87
PID 3632 wrote to memory of 3052	3632	msedge.exe	88
PID 3632 wrote to memory of 3052	3632	msedge.exe	88
PID 3632 wrote to memory of 3052	3632	msedge.exe	88
PID 3632 wrote to memory of 1892	3632	msedge.exe	89
PID 3632 wrote to memory of 1892	3632	msedge.exe	89
PID 3632 wrote to memory of 4900	3632	msedge.exe	92
PID 3632 wrote to memory of 4900	3632	msedge.exe	92
PID 3632 wrote to memory of 4900	3632	msedge.exe	92
PID 3632 wrote to memory of 1640	3632	msedge.exe	91
PID 3632 wrote to memory of 1640	3632	msedge.exe	91
PID 3632 wrote to memory of 1640	3632	msedge.exe	91
PID 3632 wrote to memory of 2352	3632	msedge.exe	93
PID 3632 wrote to memory of 2352	3632	msedge.exe	93
PID 3632 wrote to memory of 2352	3632	msedge.exe	93
PID 3632 wrote to memory of 3768	3632	msedge.exe	94
PID 3632 wrote to memory of 3768	3632	msedge.exe	94
PID 3632 wrote to memory of 3768	3632	msedge.exe	94
PID 3632 wrote to memory of 3928	3632	msedge.exe	98
PID 3632 wrote to memory of 3928	3632	msedge.exe	98
PID 3632 wrote to memory of 3928	3632	msedge.exe	98
PID 3632 wrote to memory of 956	3632	msedge.exe	99
PID 3632 wrote to memory of 956	3632	msedge.exe	99
PID 3632 wrote to memory of 956	3632	msedge.exe	99
PID 3632 wrote to memory of 4612	3632	msedge.exe	100
PID 3632 wrote to memory of 2400	3632	msedge.exe	101
PID 3632 wrote to memory of 4612	3632	msedge.exe	100
PID 3632 wrote to memory of 2400	3632	msedge.exe	101
PID 3632 wrote to memory of 3332	3632	msedge.exe	103
PID 3632 wrote to memory of 3256	3632	msedge.exe	104
PID 3632 wrote to memory of 1680	3632	msedge.exe	105
PID 3632 wrote to memory of 2096	3632	msedge.exe	106
PID 3632 wrote to memory of 3848	3632	msedge.exe	109
PID 3632 wrote to memory of 3848	3632	msedge.exe	109
PID 3632 wrote to memory of 920	3632	msedge.exe	113
PID 3632 wrote to memory of 2292	3632	msedge.exe	117
PID 3632 wrote to memory of 1016	3632	msedge.exe	118
PID 3632 wrote to memory of 2292	3632	msedge.exe	117
PID 3632 wrote to memory of 1016	3632	msedge.exe	118
PID 3632 wrote to memory of 1116	3632	msedge.exe	119
PID 3632 wrote to memory of 1116	3632	msedge.exe	119
PID 3632 wrote to memory of 1676	3632	msedge.exe	123
PID 3632 wrote to memory of 1676	3632	msedge.exe	123
PID 3632 wrote to memory of 556	3632	msedge.exe	124
PID 3632 wrote to memory of 556	3632	msedge.exe	124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://getexescutor.com:443/real
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffa448ec188,0x7ffa448ec194,0x7ffa448ec1a0
  2⤵
  PID:4416
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1864,i,16028793443780134611,9102812503330148880,524288 --field-trial-handle=2352,i,7843178088607686690,2620827626356122034,262144 --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,9222195266165979923,12370829448255847516,262144 --field-trial-handle=2352,i,7843178088607686690,2620827626356122034,262144 --variations-seed-version --mojo-platform-channel-handle=2348 /prefetch:2
  2⤵
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2268,i,12495516568650597884,7310118682276019437,524288 --field-trial-handle=2352,i,7843178088607686690,2620827626356122034,262144 --variations-seed-version --mojo-platform-channel-handle=3084 /prefetch:8
  2⤵
  PID:1892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3464,i,927201876786890292,12562166682032724986,2097152 --field-trial-handle=2352,i,7843178088607686690,2620827626356122034,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,15037668458418913909,18173035191007587680,2097152 --field-trial-handle=2352,i,7843178088607686690,2620827626356122034,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:4900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4212,i,1723290298194116619,12863786693997881065,2097152 --field-trial-handle=2352,i,7843178088607686690,2620827626356122034,262144 --variations-seed-version --mojo-platform-channel-handle=4244 /prefetch:1
  2⤵
  PID:2352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4228,i,2692365598585305127,8073739897946558807,2097152 --field-trial-handle=2352,i,7843178088607686690,2620827626356122034,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:2
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5132,i,3527114078255662726,12253185185259052672,2097152 --field-trial-handle=2352,i,7843178088607686690,2620827626356122034,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3920,i,2460966914731823437,15326297735269792078,2097152 --field-trial-handle=2352,i,7843178088607686690,2620827626356122034,262144 --variations-seed-version --mojo-platform-channel-handle=5292 /prefetch:1
  2⤵
  PID:956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5260,i,8265862865556570844,438838671336368070,524288 --field-trial-handle=2352,i,7843178088607686690,2620827626356122034,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:8
  2⤵
  PID:4612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,3773115648985030956,2792153708914052304,524288 --field-trial-handle=2352,i,7843178088607686690,2620827626356122034,262144 --variations-seed-version --mojo-platform-channel-handle=5452 /prefetch:8
  2⤵
  PID:2400
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6500,i,16791324178660486054,5935133179657574503,524288 --field-trial-handle=2352,i,7843178088607686690,2620827626356122034,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:8
  2⤵
  PID:3576
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6500,i,16791324178660486054,5935133179657574503,524288 --field-trial-handle=2352,i,7843178088607686690,2620827626356122034,262144 --variations-seed-version --mojo-platform-channel-handle=6516 /prefetch:8
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4252,i,1388548584908838553,9672484688394357707,524288 --field-trial-handle=2352,i,7843178088607686690,2620827626356122034,262144 --variations-seed-version --mojo-platform-channel-handle=4424 /prefetch:8
  2⤵
  PID:3256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4448,i,15618528497690104498,1236790541133490770,524288 --field-trial-handle=2352,i,7843178088607686690,2620827626356122034,262144 --variations-seed-version --mojo-platform-channel-handle=4416 /prefetch:8
  2⤵
  PID:1680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4436,i,16068471482176183185,12301939667451635083,524288 --field-trial-handle=2352,i,7843178088607686690,2620827626356122034,262144 --variations-seed-version --mojo-platform-channel-handle=6464 /prefetch:8
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5500,i,7280755826144573737,4970185704036748059,524288 --field-trial-handle=2352,i,7843178088607686690,2620827626356122034,262144 --variations-seed-version --mojo-platform-channel-handle=2160 /prefetch:8
  2⤵
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6548,i,16123574833869048666,17367455829010857122,262144 --field-trial-handle=2352,i,7843178088607686690,2620827626356122034,262144 --variations-seed-version --mojo-platform-channel-handle=4420 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,14765016463664644060,2558676191869137594,524288 --field-trial-handle=2352,i,7843178088607686690,2620827626356122034,262144 --variations-seed-version --mojo-platform-channel-handle=5448 /prefetch:8
  2⤵
  PID:2292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5604,i,14945968736550018482,883025507908208579,524288 --field-trial-handle=2352,i,7843178088607686690,2620827626356122034,262144 --variations-seed-version --mojo-platform-channel-handle=6492 /prefetch:8
  2⤵
  PID:1016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5592,i,13058548113268661852,15863979083814324257,524288 --field-trial-handle=2352,i,7843178088607686690,2620827626356122034,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:8
  2⤵
  PID:1116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3904,i,12554580449545112452,6410179249206305237,524288 --field-trial-handle=2352,i,7843178088607686690,2620827626356122034,262144 --variations-seed-version --mojo-platform-channel-handle=3892 /prefetch:8
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5988,i,8749167694811989778,3357209622202650353,524288 --field-trial-handle=2352,i,7843178088607686690,2620827626356122034,262144 --variations-seed-version --mojo-platform-channel-handle=7068 /prefetch:8
  2⤵
  PID:556

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 6130c8553b6b7a2db7b2e45115438707d58889218f67855fd135e735b457363a
MD5 12be8df10fec41dbf27a25c1c279b0c1
SHA1 33b90875d0895cce19bba03a50342a2ac338b0cf
SHA512 048871038871b434c649aecafc4bbbe60a8a78f34616d97c98e037db9c3622825294e8f24d0f7f5626a5b30b862451ae61f9803a791c84140586e516e5f58d6d
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7C:fwUQC5VwBIiElEd2K57P7C
TLSH
T136B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 1cf5625e17c2e0bef4e004bbe2dafc6ab1c98ae62f05eb9f2666610f2ae29115
MD5 72f118f552a8260874f33af02d0b3a21
SHA1 5453b12162a8522dc2fe5f3c81326b8213f6efbb
SHA512 08b3b3543c1c8210b7de3e075d2fa722c7bcfb64bcc490e8b3163fff4d886480857a6592d79add85efe3a793c22d635cfce91bc656635f4efc3d0b2085f8bc5f
TLSH
T127E026CC0ACAC2AE9600A5CB62786B4CC2C0370EABC8FE1A2710D4873205490A7D39A1
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 494dfda1864387d2e8b54cc0124a9b0cc0b20a06294b4465604be0f52740c328
MD5 9577dfa0a56b1ac08a2e27c5173be014
SHA1 8680922d31949233336ce2cd768a2fc830f0e89e
SHA512 57633414d1393f1e24210f586321cc2ddc3208e5ff79e423acb88b2a665214bf8c9e1662a4b6ed8641eb94f5197ffd999cc7779af6043ef06a9910bdfc8ba387
TLSH
T13771F9590E15549DEFD31631D5D123B93AB4B3878A8FBE56461CC8BE6A35F3246C600C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe586750.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe586750.TMP
Size 3KB
SHA256 e15637aaa744bd41c1fc2d5ba9a3d0a8f363bc4216567f6b4ec93f4617d105b1
MD5 63c30ada966feb5f56c4a2dbdc49e424
SHA1 abf50d0c94dd33e5c5e4166bcbc708c9d46eba28
SHA512 25a28e33d201d523e44852440b4baacd18016e0fa1ac2c3025fbc4ce8b6d6cb888bcb8ae8da3e7a63e01e695baee6f662b79263f31c94ef596b4f854aabff200
TLSH
T12B61F9190E05549DEFD31631E9D123B83AB4B3978E8FBE5A421CC8BD6A35F3246C604C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 4aa0be8ad6102c7c3ff7d19a2f72b640c90d1750a782c5d5d49010b98db07203
MD5 133cbc756972550cb7137c120168502d
SHA1 a690d980e54a2dbca823bc222b34c82456e2c160
SHA512 06fb874f11972baad15ac0bc933099b619fe0d6d16851170457b86c5678a6c8c02ebf2da4f383d380298a08ebfb1495d11f61d7c9dab1de26be677f3b509613a
TLSH
T1DC51BBB682E5AB5EA81056F0AB14AE2BCE1C0529432C3C69DAD5FE47D3E3470D111B5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 097dc79db284155c6dc49bc27ec66d4dbc6a16c0b2537d868865fe4ca13ab802
MD5 0e27dc70d362344f275019b89f794b63
SHA1 55b35703a401bab3c188e13986df39eb202aa3ac
SHA512 b04b2a4f3923f88e7c808c22513214f225da2024b4e777aab926e9ddbfd7b7c81015a3de8a0a582ec5ac12ca4bbed173bf4667f0749c8597d8b72ae1b8974f8f
TLSH
T13D51D1A6C2E5DB6ED81117F06B146E1ACE1D0A2943283C5EDAD9FF4BD3E2870E11154F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 f46605173e39ffc9a305fc3485fe737a3a1a9b6d5f10ddd244896c31b7bc47f6
MD5 d138d02e85e9f31df1a5caa86f826b28
SHA1 4779a66d23041028ed3dd3ea60aed423d57f7459
SHA512 c58413cf4f6f72c40fb700c7e35642443192c6665c047a0197a22af25d0ea98dd3ae327cb2d502937bb37cd34241c7365f68cd5094f386afc63c2b6edd4611a3
TLSH
T1C251E1A6C2D5DB6DD82117F06B146E1BCE1D0A2943283C1ACAD9FF4BD3E2871E11164F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 cfe7642b8401371aca8ed75f557461eb5bf17b36457232b4fb8d778247f68735
MD5 456519eb2125aaeb47c112cabe125e04
SHA1 e370bd28c99191420568eeb0b22bc82d19edf339
SHA512 aac619a66e4dcf96c2559d9802c92333ac8fe1d44d7dbbcb22e89d011f8fde590e5b0b8f84e08b5d491e5f09128c86e2bcb7745db3bead8ba9249b13470601aa
SSDEEP 192:sxZmRGyM/jK1Ml8MkK/fgs48qEdp+2HW6+WNN3U/YHKU2IgrJ:sxZmsMK/fgs48NpHby/v9
TLSH
T18942E7526A38A977CCCBD209F9517B53D6F55472A2900E84A9FC9A1C04E7AEC2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 b8c7325a504456e1fe926e3bbf47a6170670b70a128005db2c83b8abc7e27cbe
MD5 8e6d655dba32d00f0b399ff882bd76e0
SHA1 567c314515be344a652fe67547a2719bd6f9e200
SHA512 8ae5952f5adfbe9b42e18f0e421e44bfbb4dfc7e27ba87a4354bed0a22471949dcc82f3057e14c416ac8db4868ca58380719f24752aa9ce2d4ea2cd4256d9e26
SSDEEP 192:sxZmRGyM/jK1Ml8UQukK/fgsPhFvIdpQbHW6+WNNJmXYHq2i2Ig5qJ:sxZmsqFK/fgsPhFAGHbKXYE
TLSH
T18C52E7526A389977CCCBE209F945BF53D6F5147292900E44AAFCEA1C04E7AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 0e41f335b0020ab97a35df9f817752702f463cc26da0144f88f0aea14f13e3ff
MD5 82a0e5a2c26ce9e3e048e42536e27ee4
SHA1 aa8eb3e99774196e961c20cfb504163f5ddc1a75
SHA512 ff56b3a1e5e6e72678a7d46e6d2554d064978c2066fec1be567c80b0aecce867cc0d00a143804b59c07acd373ac99471cc5fca8e0b1d2b411d69b14aa8e9a26c
SSDEEP 768:HeUZYTMWvg09o8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4RgroVk0B:HeUZYTMWvg09ou1ja7eLZmRrZB
TLSH
T14EE20B2F280CCB7E4F844E5DEC2A6F963ED801CB5A584D544BEA894C03CB6EB512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\53f0f5bd-7408-47e8-b6a3-5aa7e69ac4b4\index-dir\the-real-index
Size 2KB
SHA256 308396b88d4f7219a9ce239846d105ba457f82cdd2fbaa6b6d7f53b923b1fd68
MD5 7239c1173b2286e35fcf7622faf6f99c
SHA1 15c0813bedc0515745f111816d573722f73ab5be
SHA512 2ad9f788f49397a4d0a28c3dbf415cb3c02ef93eb1c93c229f8da86270b8891ce063d394ab03cdf9501123a55d3d90c1dac5c79ce094539b687f3e7c36457739
TLSH
T17C51B58D4E924B2BF8AC52B314F25494337018DD0B6196236CBC1135BE4322D2A9A2AD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ca485.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\53f0f5bd-7408-47e8-b6a3-5aa7e69ac4b4\index-dir\the-real-index~RFe5ca485.TMP
Size 2KB
SHA256 987d8d3a33e21f625c5584ad984736b738d86c74d5a6f399ee0c9f9f4e697641
MD5 aa3bd5330513960f6f577e95f854151b
SHA1 6af0c685006d658e8a7abf6c246022d05ed60a09
SHA512 ec787bac638b27e06e7c9d576c7edfbdc97239ff26ba2e5a09fb6ce3086d781f5d208de334e0fa9292b39ba637f873769f7c1a790b09e12a85c3cf94785ccba2
TLSH
T1DF51865A4D824639E894417709E3A4B437391900C719BB5374FC9636ACD37AE3E1E2D9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 bfef92348b1b20b33854610dd3042d6711bd967aa8ddb4de13e650bd505592c0
MD5 62f9d4a3bbb6f3a77e2a41e67d3b1eb0
SHA1 c7a0800b4d280112c5d08e1388b20154eeabff78
SHA512 3f90f4f38737315ff5399270e025793dcc11b376eababca9397d2154e946f29578d419926d16538e55ae7219b3cf2931d537ee300a60f50030be39d109042f46
TLSH
T151E0C0F77DFB1810AD7FC7D74471B4A401013CB8C64CAD8F00AAB2A310B23002806C72
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 7KB
SHA256 bba2719ff5024ca6bd90a11aae9218caaf297999951fccea3109bc81bf7f1552
MD5 7d9407220eeeb316d5480470d3ddb422
SHA1 69ff7d5f7f1e39b753c473e29727642e9c78535e
SHA512 4d7c150576deb75ad6186b3453f137042fb092e9085d8e18fab6bc1b57da00c033e034b99ce009c91e34721e43d11a690d881db31d4b669b5265476d24a39d05
SSDEEP 96:KA1eK2AUqIKLSqKAIKheqWkKzC2W7KKU0/LiKE0Wg:ES3D2rZlxg
TLSH
T12EF1390232BB02033C7E6958A2AA97764F85B1E33454F42BBB6844B64E66D341DFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

favorites_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\favorites_diagnostic.log
Size 1KB
SHA256 cb9d444e901247cc2b5afd1378887800396ef736bc43914788ea4059d5e438da
MD5 cde1f3f8430f597acc91d2ea8fe1df68
SHA1 5889ac76e1bbce2174f9f3612eeca8148ca11e68
SHA512 9146b811ee8e7915600f85fd0f84e78b8b1330973953a45bd7f51efc20e9ab9a3610393302ea4823e0d17d88a95ccbc1710f12591368d33ab8faab566adc1a89
TLSH
T1FD314180A3ED10A57E8AFA55C22E5813E4B17E76270F9972631E44F44F84C241B6FE26
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 b73a31949cdca5cf1a77b5dee1742a13986d63b477fa6ee3c4d597f685870717
MD5 72188a5762f20dd13d8eae0676d58688
SHA1 4b3cb797495a0bc9c1411dd84ae6a033e40d092c
SHA512 f08833c1d6fa881401e4d64a1e2340dc915eb6ddbfbd3c46cb825f4a00be4ddfb7cb829a5af66b968c1434a865fcb38a2aaecc2de71fafde3a19abfe818cac70
SSDEEP 192:uLsNTbn/fQ/KcUaQ+KtP6aQmiU1TqOi4zX5Obd+jKOImy904QJqKdjqC2:ksNTDfEpNxwnRNzX5od+2OU9Yh32
TLSH
T18B422B72B868AC775DE2B585F44736138FB860B7DA846F94C5EC6B1C01DF6AC230B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 13KB
SHA256 02b4d0a70ccf1d8da864742a7018b2191187c5eb8d23e9247bd1d0af29b6acbe
MD5 2cacf24cafb0e903ebe6a381a1a360d2
SHA1 aeef258eb6f2e10dd452a0284371ef5e85ea4fd8
SHA512 b4226b109bb282704635728072220e7255cd59c63ef8e4ca93bf9e35bf921cdcb795ee668d75f4c1db427ee7a82cd7726df6fc55ffeafa6a3baec5b7df812b68
SSDEEP 192:uauspzsNTYn/fQ/KcUaQ+KtP6aQmiU1TqOi4zX5Obd+jKOImy90IQJqKdjqC2:DBzsNT2fEpNxwnRNzX5od+2OU9gh32
TLSH
T139522B72A868AC775DE3B585F54736138FB86067D6846F94C2EC7B1C01CF6AC230B91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 c5fe5e00fb8e753efa49359d9214bac76c3795ec4e17614ef83c2526520e77c3
MD5 1a19d84596ff3cc4653f3bffe6d2f416
SHA1 d8d6587ff8011a86cddd45ef380a8d936b0e35c8
SHA512 e44ea1152ba3f994fdbac1c52ce4c8b8c1dc11da42ad13bd312f740c63fd60ad09675b0a1f88b26685e62defb2753cd0f8f91f673340ab0f1a00175f7d7c8f09
SSDEEP 192:uauLsNTYn/fQ/KcUaQ+KtP6aQmiU1TqOi4zX5Obd+jKOImy90IQJqKdjqC2:DksNT2fEpNxwnRNzX5od+2OU9gh32
TLSH
T125522B72A868AC775DE3B585F54736138FB86067D6846F94C2EC6B1C01CF6AC230BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 8af2163dcadced075431bd48f7c0644e09b3066d7012aafac14b101fa34ae25b
MD5 0933f99fe265e1da6da5544102f580a6
SHA1 c16d651551af71caf23c0191d1e72dd64b619a8f
SHA512 8e2365103e984eafbdfb4d0ab223e386a4c2ec4499c9cef2df041db1bda34a15bc34ff8784ffdd9071d4a07599b5e5c2c8e569e4a778dd1929c80e835cdf7f2d
SSDEEP 192:uwhLsNT6n/fQ/KcUaQ+KtP6aQmiU1TqOi4zX5Obd+jKOImy904QJqKdjqC2:r9sNT0fEpNxwnRNzX5od+2OU9Yh32
TLSH
T183422A72A864AC775DE2B585F44736138FB86077DA846F94C2EC6B1C01CF6AC230B916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 b52e7dba590980efbe28dc678c6701140d437b14d43a9798c1698caf9560ecb3
MD5 61391d3ea2e5150ff243cf8f51df144e
SHA1 82eb426c3ec7027fbadeff71169838cc8bc99d5a
SHA512 2bf9cf43203410c05fe34c8878d39d742be0769840c8a8897fe8a64fa083e83f71627031cdb958242c1b88f443172497e844fc1857a5210db1ef033b724e5ada
SSDEEP 384:DtZcIIzsNT2fEpNxwnVNzX5od+2OU9WhnTKwBODNZOCN5n:D10bMhilOTOU0hnewBKZOCn
TLSH
T1B2927E7168386C779DE6F549F84B32078FB86077E6846F94D1EC7B2C01DA698230BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ccb1d3bf18d34b46effeef44b0b06f96a10833c46a9b3c1fe65076a683391bca
MD5 dfe8e6dff23a43195354236fc510e858
SHA1 7cead428a245fb8f210d99b3cfc15a2cd21ee23c
SHA512 05c872a18becbcc6e657bb1af65ed97cef6ff544853894201e7c829cbdd17b240c8adb324133287b48bee2d318e4b202384a6e77d7553206cfb25ce0eae12804
SSDEEP 192:yON061VWQmiUyT+FgGX5Obd+jKOImm/aV3GFU6:yON06WxgGX5od+2OTgFU6
TLSH
T19602E83568687C679EF2BE49F48737135FA8207BEA546F84D6E82B1C00D769C2307827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 14776fc1115d1898d88fab92cf6e4dfd0c79bee272a9ac29d176b5f2417d29b6
MD5 d576ad73ef9d631439adb431e1523a2b
SHA1 e6eb1ea3643b15be7cadc50da3f21a5d6aa0cf5a
SHA512 c92ed38b739da6521968a9561052c2144eed3a67528c819fa0a21c616d90cd789b227d5ebd3221067b5e0f69b45bb5d178edf5517ea45f47eef19da107af8004
SSDEEP 192:PON2612WQmiUyTAFPGX5Obd+jKOImy95jJJqKdU6:PON26bpPGX5od+2OU97hU6
TLSH
T17512D832A568AC675EE2B555F48732139EA96167EA44AFC0C1DC2B2C01DF6AC230A856
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4c9e8e32-49ae-4694-a68c-a6330d8019ae.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\4c9e8e32-49ae-4694-a68c-a6330d8019ae.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 119b6a38668e4f39042e3628c69efcbce4cd4d2e9d2a7ef034bd1955b7065d9b
MD5 6da57306487108cbb85d96208f54c178
SHA1 5bf367b02580746424f1f82461b4e9bb4ddb9e57
SHA512 562ec0d69bcfdff4b3e0d6f3558412c107d15b71666d17822becaf679203e7913df44921a56810a6e7a7df0415a7f540ca366b6f1f3e23ef8f97fc71071764e5
TLSH
T1B941F858B6F90148B3B36F5AABF6686E487ABD372E06D09D10110E4F0A27B00C871737
MD5 SHA1 SHA512 TLSH

Submit Download