hxxp://grafam[.]com[.]co

Resubmissions

09/08/2026, 18:19

260809-wyeesstckc3

09/08/2026, 18:18

260809-wxm1jswxex3

Analysis

geolocation tags

cacanadananorth-americatoronto
user interaction
yes
max time kernel
298s
max time network
299s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/08/2026, 18:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://grafam.com.co
Sample260809-wyeesstckc

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3060	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134307731863964937"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{41D9A729-505E-42C4-9E74-F6078BDB04D7}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
5304	msedge.exe
5304	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe

Suspicious use of FindShellTrayWindow 40 IoCs

pid	Process
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe

Suspicious use of SendNotifyMessage 38 IoCs

pid	Process
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe
1984	msedge.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 1984 wrote to memory of 1676	1984	msedge.exe	84
PID 1984 wrote to memory of 3060	1984	msedge.exe	85
PID 1984 wrote to memory of 1292	1984	msedge.exe	86
PID 1984 wrote to memory of 1292	1984	msedge.exe	86
PID 1984 wrote to memory of 1292	1984	msedge.exe	86
PID 1984 wrote to memory of 3048	1984	msedge.exe	87
PID 1984 wrote to memory of 3048	1984	msedge.exe	87
PID 1984 wrote to memory of 4360	1984	msedge.exe	88
PID 1984 wrote to memory of 4360	1984	msedge.exe	88
PID 1984 wrote to memory of 4360	1984	msedge.exe	88
PID 1984 wrote to memory of 4392	1984	msedge.exe	89
PID 1984 wrote to memory of 4392	1984	msedge.exe	89
PID 1984 wrote to memory of 4392	1984	msedge.exe	89
PID 1984 wrote to memory of 2276	1984	msedge.exe	90
PID 1984 wrote to memory of 4472	1984	msedge.exe	91
PID 1984 wrote to memory of 2276	1984	msedge.exe	90
PID 1984 wrote to memory of 2276	1984	msedge.exe	90
PID 1984 wrote to memory of 4472	1984	msedge.exe	91
PID 1984 wrote to memory of 4472	1984	msedge.exe	91
PID 1984 wrote to memory of 3132	1984	msedge.exe	98
PID 1984 wrote to memory of 3132	1984	msedge.exe	98
PID 1984 wrote to memory of 3132	1984	msedge.exe	98
PID 1984 wrote to memory of 1960	1984	msedge.exe	100
PID 1984 wrote to memory of 2872	1984	msedge.exe	101
PID 1984 wrote to memory of 1960	1984	msedge.exe	100
PID 1984 wrote to memory of 2872	1984	msedge.exe	101
PID 1984 wrote to memory of 4904	1984	msedge.exe	103
PID 1984 wrote to memory of 4000	1984	msedge.exe	110
PID 1984 wrote to memory of 4000	1984	msedge.exe	110
PID 1984 wrote to memory of 5716	1984	msedge.exe	120
PID 1984 wrote to memory of 5724	1984	msedge.exe	121
PID 1984 wrote to memory of 5732	1984	msedge.exe	122
PID 1984 wrote to memory of 2752	1984	msedge.exe	125
PID 1984 wrote to memory of 2752	1984	msedge.exe	125
PID 1984 wrote to memory of 2752	1984	msedge.exe	125
PID 1984 wrote to memory of 1732	1984	msedge.exe	126
PID 1984 wrote to memory of 1732	1984	msedge.exe	126
PID 1984 wrote to memory of 5304	1984	msedge.exe	130
PID 1984 wrote to memory of 4568	1984	msedge.exe	132
PID 1984 wrote to memory of 4568	1984	msedge.exe	132
PID 1984 wrote to memory of 3984	1984	msedge.exe	133
PID 1984 wrote to memory of 3984	1984	msedge.exe	133
PID 1984 wrote to memory of 5664	1984	msedge.exe	134
PID 1984 wrote to memory of 5664	1984	msedge.exe	134

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://grafam.com.co
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x25c,0x7ffef4a8c188,0x7ffef4a8c194,0x7ffef4a8c1a0
  2⤵
  PID:1676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1848,i,2317109050950733450,9138358899016238393,524288 --field-trial-handle=2340,i,12637586095310391938,6850371175370107293,262144 --variations-seed-version --mojo-platform-channel-handle=2232 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,10979472040266856624,6896813947369406328,262144 --field-trial-handle=2340,i,12637586095310391938,6850371175370107293,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:2
  2⤵
  PID:1292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2476,i,681754125624228303,6177231889778316592,524288 --field-trial-handle=2340,i,12637586095310391938,6850371175370107293,262144 --variations-seed-version --mojo-platform-channel-handle=2456 /prefetch:8
  2⤵
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3416,i,17098422862705225076,3396923194550054837,2097152 --field-trial-handle=2340,i,12637586095310391938,6850371175370107293,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:4360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3432,i,17699551796841747724,14193261323765230139,2097152 --field-trial-handle=2340,i,12637586095310391938,6850371175370107293,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4204,i,1379782089158841128,16591662686809421849,2097152 --field-trial-handle=2340,i,12637586095310391938,6850371175370107293,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:1
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4216,i,16721571503149168272,18030396968875441493,2097152 --field-trial-handle=2340,i,12637586095310391938,6850371175370107293,262144 --variations-seed-version --mojo-platform-channel-handle=4632 /prefetch:2
  2⤵
  PID:4472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3620,i,17060638977754332452,767852299856256167,2097152 --field-trial-handle=2340,i,12637586095310391938,6850371175370107293,262144 --variations-seed-version --mojo-platform-channel-handle=4848 /prefetch:1
  2⤵
  PID:3132
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3496,i,11444681720534614488,409737874953909535,524288 --field-trial-handle=2340,i,12637586095310391938,6850371175370107293,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:8
  2⤵
  PID:1960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3460,i,7507465644636080368,3501231312469359917,524288 --field-trial-handle=2340,i,12637586095310391938,6850371175370107293,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:8
  2⤵
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,15951704884006562471,13028379057792973133,524288 --field-trial-handle=2340,i,12637586095310391938,6850371175370107293,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:8
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5916,i,15951704884006562471,13028379057792973133,524288 --field-trial-handle=2340,i,12637586095310391938,6850371175370107293,262144 --variations-seed-version --mojo-platform-channel-handle=5596 /prefetch:8
  2⤵
  PID:4904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6384,i,2065579245490937634,12689327590123148876,524288 --field-trial-handle=2340,i,12637586095310391938,6850371175370107293,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:8
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6580,i,4521128171973234552,5295434867644136583,524288 --field-trial-handle=2340,i,12637586095310391938,6850371175370107293,262144 --variations-seed-version --mojo-platform-channel-handle=6588 /prefetch:8
  2⤵
  PID:5716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6584,i,3888717165381323482,11665697704397410605,524288 --field-trial-handle=2340,i,12637586095310391938,6850371175370107293,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:8
  2⤵
  PID:5724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6572,i,16794339996159469162,6213392693672122068,524288 --field-trial-handle=2340,i,12637586095310391938,6850371175370107293,262144 --variations-seed-version --mojo-platform-channel-handle=6632 /prefetch:8
  2⤵
  PID:5732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6416,i,5620427205229614416,14999667221188554385,2097152 --field-trial-handle=2340,i,12637586095310391938,6850371175370107293,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:1
  2⤵
  PID:2752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6656,i,1461467117914910839,4146394555218327746,524288 --field-trial-handle=2340,i,12637586095310391938,6850371175370107293,262144 --variations-seed-version --mojo-platform-channel-handle=5264 /prefetch:8
  2⤵
  PID:1732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5860,i,1024542950379026612,10297628000669884036,262144 --field-trial-handle=2340,i,12637586095310391938,6850371175370107293,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:5304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3672,i,9652909661392044107,5122475846726388465,524288 --field-trial-handle=2340,i,12637586095310391938,6850371175370107293,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:8
  2⤵
  PID:4568
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5540,i,7789693965649151802,13006102802810208277,524288 --field-trial-handle=2340,i,12637586095310391938,6850371175370107293,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:8
  2⤵
  PID:3984
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3504,i,6625820708824038383,9976377332220354038,524288 --field-trial-handle=2340,i,12637586095310391938,6850371175370107293,262144 --variations-seed-version --mojo-platform-channel-handle=5128 /prefetch:8
  2⤵
  PID:5664

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:816

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8c5b1a407270ca9ae8bec8f20cc56244f3bde6f042890a4cabcdf4df3d21fdad
MD5 16f782e6f4d4592598936b2f29b6b339
SHA1 5c8c22b7f56af2b2e0d9978418f077cc8fd13c41
SHA512 28b2f7186b910539fa22408b47131fb16874b4c2192a721a69393efd7812da561ea9977b8af678cd3a9e37c23f186f876d7086a20afe28b16659db70955cf16f
TLSH
T15DD09232B7C9E241E14232BAA81447826E2A4A68259AC2176478844CEC6984AA79D28B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b28cb7be2bb68a6cda7ff7689f0ec4acdf8699e4818545d4dd692148ce1d64d2
MD5 a712889d00fb4f0945d13b925681156a
SHA1 1448cbfbc2c620e016aa5e6fccd0ac75e74ef2d1
SHA512 65f51cf451d5f77c9e695462e66abc873922db3c3999c172526727c2356a5a29052ce4b77ead44b02780ca80f6b290696b7633f537570254f36e7374ce0d04a5
TLSH
T12ED09B3277C5D541D5423276A41447816E164568159AC2175474444CDC69445579D147
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 ee2f2ec9ba147d2ea47b5de76bb7dd0b5294a67e84d246fe4fe94bc17d8505fa
MD5 b12deca9344a0272ef33d74635f051f5
SHA1 ca5b94e74686dc279e7c62504d0fd38a3c674f7e
SHA512 733aec32fdd2c2bfb6ae3657c53c95c082654d7b6b822197a0a33aa3e817089db011a2675960cec26ab9fc22aca9055ff20f1d55c5e82873f0ad831bca3aee15
TLSH
T128E026C905CECA2EBB42A44755FC670CD2D1376F9BC8ED9E5704D88C7601840B3CABA0
MD5 SHA1 SHA512 TLSH

Submit Download

f_0000a8

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000a8
Size 32KB
SHA256 aeaa3a2ed58dc962ea49b585e755ec502d45cc0fa3fc04cf976ad54b622e57ba
MD5 61db335cc1010349b102d5effcfb32e9
SHA1 274d54d243430c1347f945e00206be0564760b07
SHA512 99ea4818fe9f4f0e43dec7cdc206591647c0f9bc39cabe286bcd4ef6b79632e618477a639bc5d217794b915dc8d3e540d2728a41c13aba40a3ae5f6d11dd301e
SSDEEP 768:M+2iWkjpOIMf8hjfKXrCpVTVXO3a7A7ipkUqNQu+PAc47n8K:M+2irjoIMf8hj6CpVTVO3a7fkUUQu+P0
TLSH
T148E2F14531B3D0D54EA73D1D3D4DA15C4B7C4CB73B82162F8A1E0A9F67C9A7C2A87082
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 4KB
SHA256 7f7cd8859f08d44293c70d04eff7503aa3d8262c398ac03065da5280ae699b3e
MD5 b0c005a4ff9ac0b6c84bef91bd8f93f7
SHA1 a22cd17faa45f936b423c24c6556eef8203ad2d3
SHA512 03086429d18f2bd6d61e6c26402b89cf25a26550fad0aca9eb0c5026d809b56d254dff40f697f2696806171bb27e48f410a8df1b67a9c4e6e5a9dc8b9415d643
SSDEEP 48:F6PdZDMWsbtDVm9hv49TzKlc/Yhl7iBbJVEihpG80U/2c6XG0E2oX:FiINV4qlzKW/Yhl7iBlLpFcbGuw
TLSH
T101913D552382A8A9EFE509BFCCE106C0B9317046591B8E6719705FBD2FFC31E4DA008C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 4KB
SHA256 8f7a679722d871c542f6dd61e92bf4429718f18eca62043e1f712a928871ce09
MD5 e008199e515bff07ee070db969567f52
SHA1 182a9e949b16e760349fad35c8757c6acd6a015f
SHA512 ec9d631558945ef95b7aee3d39608a1b55e9f1fdac33b0c5ea69d2d5931a12d11a3f14c5edb1460d317ba30ec71e71159c3fb55bf4fc312bde8f5841b6213ab4
SSDEEP 48:7PdZDMWsbOQDzm9zv49TzKlD/YhlFiBbJVEihpG80U/wc6XG0E2okU:zIJz4ElzKB/YhlFiBlLpFObGuA
TLSH
T1A5914F456382A8A9EFE104BFCCE119C0B9317046590B8E6755705FBE2FFD32E8DA018C
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 cf361f73c226e787e1b24db2875a17a688e0e67c71069ada1e6a1a367ba3c122
MD5 7e66de85fcda62ed466a7cf26a15915c
SHA1 978b94765eace0c59e292ad9f28f27dd0df898b2
SHA512 6c9700363317182d51b666cefac9f507e388b76802f8c883781d8a585ba57075ce93f9df016768c80e0caf3f45ce70c6071fb34a6b9b39383087524671c3d862
SSDEEP 48:KPdZP7WNZtf5CBv49TzK3c/YhW7idbJVEiOGKHoU2c0Xi0EDo8:SYD5CKlzKM/YhW7idlk7I3RiL7
TLSH
T1CB813B59238298A5EFD6003ECCE21AC4B871B18A991B1F6719705F7D2FED36E0C204DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58e886.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58e886.TMP
Size 3KB
SHA256 f8eab7ebc3719e893bfb2b028a10a007d7a72db0b03116e3ec3d527e9f31aa7a
MD5 b58d10f295ae33118c2efccd9e941cb5
SHA1 1720f8542940f41104f29be9d7ed8d155d4fc89b
SHA512 7e8eb3c6fa840d6a442d610a8cfbee4587a9f469873716b0b0128216f4495ea03c47b6c4e3f9effbb7487c0506b55d9fa4c7b5adf7f0722abfa2a912aceb39f5
TLSH
T1DC71F755334248B5EFD6013DCCE206C57AB1B199491B0E6A15B05F7E37CC72F0C2048C
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 73af9e4479e53380276553b984e6cf186020c507ec834425b1747b08337dbc39
MD5 370c9e94d647de81685d9fc681470c28
SHA1 b1fcb68d5b4992836f75b97e2e2b05b1d2a9cb9b
SHA512 bbddaac621157aaf64c662fa21100d88114aa28aadfe1b98adc10a3733247d25b00fe8739f1d3411cbeb54d9fce5f9ac8c0399829c3817baaccb744a8f1f5498
TLSH
T1CB51F2F3C3D4D66ED85516F16A18BE1BCE1E090982143C2AC9D9FF5B93E2472E21164E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 a82b6f7a900b4626b22773bdd5e2ce35951ad9fde91aaed85893cc0e94df7fc5
MD5 be1a096b73a45b752b04baf9f476c898
SHA1 795aa6c568fa118fa7e143ad48c2e7bf6d0fbcf3
SHA512 ca6621b46330fa709ddd4458f312f81e33dff56603c0916bdbddad8bcc7320d4262a8ef18591fc02441af954c4cafbbd43ca34d7128b38054817a058d1693843
TLSH
T16B51F2F3C3D4D66ED85516F16A18BE1BCE1E090982143C2AC9D9FF5B93E2471E21164E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 98dfbae641dcc4feafb5ddab1ae043b8bee1e0b8b8c66239530467f697df9d4c
MD5 08ceff594f75686361b9925b9b5da785
SHA1 159cd9451a7c3d51ee27693ba755c6d70c0817eb
SHA512 8d8f49a3b6640f667d57bbfc875c98380f54f05e11aab4384ca05f2ca17375159c4aba56f2209cdc48c6599b4e4795267180cafa99848e08d2f7c7b1c55f4095
TLSH
T1EB61E0F3C3D4D66ED85516F16A18BE1BCE1E090982143C2AC9D8FF5B93E2471E25174E
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 216B
SHA256 ede9f21b31c3a029b023287cb49cb53a5f4404739b3a0b705d9e6a2d4784f1da
MD5 140468637b939f529fe5864192a3ec8a
SHA1 def2e17a11f60e84bd2576bd24b235d167180af7
SHA512 74c5d620de80d8ffc13fb898749a56464e820ed8072f3d1c236dcbe526c3e5472505332c4a8be18aa4bff56eda5de337c85416100cc8843229da60aaf6ce6a2c
TLSH
T1CED02233A24070B299193EC5A02FFC4FC72318B82403CAC600C0EC4E8A3293E4A1F9A9
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries~RFe598023.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries~RFe598023.TMP
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 38e8cb1b2cca285e677e851f179207918dba7c1000dd10238a40e7494e4ba626
MD5 9e6ab7b0301c696c2ecd1e272b5d8406
SHA1 eb54c2744d4150183118c3cb2ef88a2cb6585d22
SHA512 12911c954d7fc49035c0203d8b1b626e689b424f45f3d7980b37a8f10645e276c75fca8ad73e8e275d86f25f02e1e8fec75b3ad1f27a02c31c81e3ee3e5fe888
SSDEEP 192:sxZnROyM/jK1Ml8M9r1/fjsw+8YIdpqlCHW6+WNtulXY48V40GZIg5EBJ:sxZns1r1/fjsw+8p1HbKX+iWL
TLSH
T17652E9116A38A977CCDBD209FA457F53D5F50472E2940E54A9FC9A1C04E7BED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 4333afae780259f5d297a42df838901297d144a9c9053f606e84f182c77281a4
MD5 0d24ff4d86e36b681ba4e03c043024f4
SHA1 1bb1cf2109da92e9387e130385dce74c47a59c72
SHA512 a010e7695a547f65976b83159efd20faf3c862bd808c5f739a8141f91dc18c9f49a1b7caa4e8a7ad9686a57dc67ab040b1a90caad49fd02d98bb8ed39406e675
SSDEEP 192:sxZRROyM/jK1Ml8UQn9r1/fjswaXWdpYlxHW6+WNt2UnY4gd0GsIg5C0J:sxZRsq9r1/fjswaX2wHbrnfw4
TLSH
T10E52D8116A389A77CCDBD20DFA457F53E6F54472A2500E44AAFC9A1C04E7BED221381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 5da8a6deb7e4f875b1f0e0c0f658e11e0780de2c9e73214c5ae37af1b6a1d727
MD5 eda54863c045ad574c675a83d200c2d4
SHA1 efcc0686cf1ff268796aafe242a6d56fd1e5db36
SHA512 3fe5bb8abcbc490a8a3559354dfa45a63975bf506a05784edae65e54e350db2c5bfafb16e04d9ba91e6d157cb41f9fe2c89f19126f05a2baa911594e05af4236
SSDEEP 192:sxZRROyM/jK1Ml8M9r1/fjswaKWdpYlYHW6+WNtgfFY4yd0GsIg5C0J:sxZRs1r1/fjswaK2pHbmFxw4
TLSH
T1D752D7116A385A77CCDBD20DFA45BF53E6F54472A2500E54AAFC9A1C05E7BED220382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 4f3e3187bc548a22a4c8b96a6292e7e3ae1d4a3cdf53df57a4af1e6fdb3a078a
MD5 ab09d2b4a64651385885cf9017c9e312
SHA1 8254685689f527fe0fb76735bf0415fcfe552606
SHA512 fd9c7377325b914ab3dfb02f2ba2130143d1913ae2316f670ebbb95a0b00d7944a5579729f511341c589380d346a24bc667ce7cd70e813d7e7cf37d0532a23cd
SSDEEP 192:sxZnROyM/jK1Ml8Mkr1/fjsD+8YIdpqlCHW6+WNtNC/Y4940GZIgUBJ:sxZnsMr1/fjsD+8p1Hbi/gUL
TLSH
T1CA52E9116A38A977CCDBD209FA557F53D6F90472E2940E44AAFC9A1C04E7BED220381F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 8267801391c899a7a70a957460c5f1d6a01a6d40dfc0bb52dcca4fc132cdc5fc
MD5 035c203150c0d4b8ecc6ce0778eb47d6
SHA1 a7469850781130c1a64e02bfe07f13a1a3f425d3
SHA512 33c42079f2c1ee51010b046ccb2d4bca71fd2289faf188a6f13b4874d6893ce0d5c767c71186fabb36c5bea38d300fd55d12c7243e019181a7fc43116a3626d9
SSDEEP 768:g+8iJPNWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsALl6opdaroDkIUnR:g+8iJPNWvx76ru1jahALocdRbUR
TLSH
T1D3D2FA3B680CCB7E4F844E9CEC266F966DD801CB6A984D5447FA884C03C76EE51269DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe595ba3.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe595ba3.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 86c89866426a10195ee66ebee1066ae51cf08f75caf3b942edc3b4c4d5e5ac60
MD5 22361d4be5b27166d3cf929792c003a8
SHA1 feda2367526faac3345b8a7a477f9f99503f6186
SHA512 5dc83f1b3182174f93c64ee193c8b44075c2080585a15a384f1bd19f96e2bb5e66803edb836789ebe1bd9773fe50aeed3068916053d15f7000ee02e470be8c27
SSDEEP 384:j3yFaeO8yjsNkC/YrVYHkM8YyEXWUiEYLUbFrVQ:j3IzhGcMMtiEEKo
TLSH
T1EA928C3668386C2B99A3A945F44B3727EFB0441FEAC93FD4D5EE5B1C05CA1D8130791A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 7e5e70fbd3bdc41288d7069521cfdc2346bc8704f95aaacdca7bf074b7a5e39a
MD5 85debbe57fd6255349f7af82e560caad
SHA1 4e9ac1971475761f669a78857ab88824e2f23998
SHA512 892e471a27f79079c37cb98e9b95a5ed2aebb585eba43c217974cce2a21ded9cf8b718ad5d78a70ab7ea4ed1c21c29da9d44c308eb548b594a85e2401a264181
SSDEEP 384:o3yFaeO8WsNkC/YrDYHkM8YyEXWviEYLUbFrVQ:o3IzhWKMMYiEEKo
TLSH
T18D929D7668382C2B9A63A945F44B3727EFB0841FEAC93FD4D5EE5B1C05CA1D8130791A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 2ff654eca6040b9ced35d20410e2654687da69f6ba49c3884dba100b0856f59f
MD5 a79015ec218d450ae3466793901efadd
SHA1 ad0cb6e8dc28519931f0a3d34e7597232962fa12
SHA512 b0519f4379c2f27d278eedb290c1f5276c478897486165c5754584b4fa609ba62532989faca6fa6d848c70ae29b5c4837897d2da0f33901c4399891c37fe5bcc
SSDEEP 384:03yFaeO8WsNk3/YrDYHkM8YyEXWviEYLUbFrVQ:03IzhWxMMYiEEKo
TLSH
T1D1928D3668382C2B9A63A955F44B3727EFB0841BEAC93FD4D5EE5B1C05CA1D8130791A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 97b619b7483f930baebf8528998a499769f1e01a68193ff8afab0ac5a0684e3c
MD5 50179fadf02280b4503d2fe9179bb860
SHA1 83d088a47b1f5c9e43a5942b43594d4c5266468a
SHA512 28aa31b4db7edd2d4699a15b8b343becf6e0ff4b80eb618178b7d67ce737fb65d736734d8c69aff353eb992640f772e42c260312d6e6652ffffdcd8f727855c7
SSDEEP 192:gONS6kDfQmiUytmZ903tjzorYbracQiirzU6:gONS6ghdZ9M8YyKivU6
TLSH
T10B02D83568782C6B8EE3AE49B44A27275FE4112BEA952F84DAE81B1C00D764C1306827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 3936500068e6d4d11d45f677965cbc1a268d3070aa8e3b494bcc292c7b92aaaf
MD5 025577c4692ef280c84454e67ae36076
SHA1 44c449ab83fa7e2189c6a24f72fa919f265e603d
SHA512 2a6ed59f2cf7f2ae1d71f3e79f12c462215a7c3a9d83ee601115f2f3b085b38c5d56095e995073f0c80d9c41638a6c40ddb0d07d3bf46615b0df78f1b119d2c6
SSDEEP 192:iONt6kJQmiUyVm1903tjzorYbraEXH6FCcRiKqMU6:iONt6aH19M8YyEXWviEU6
TLSH
T1F8122B3268786C6B5DE3A955B44736239EA5412BEBCD3F91D6EC271C00DF29C130AC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 9f41de165f87cc0c9181b310a7628363b703a6c44953e3998045cf6b7a877d3d
MD5 30388c6d7bf3be71891d7d113f167aa3
SHA1 49d1e7f58863e58b51084fac4849968db2c5313b
SHA512 c92992346eb7481bec708d82f23d54c702ff38a8f592ccde8ed922cb40bb4b4fdee5dd2cbdb637e5f46ab38c496ea76663ee07890738788957bb2acb73b21729
SSDEEP 384:DZiFZ3yFaeO8yjsNs8TUNTUlIlC/YrVPHkM8YyEXWEiEYLUbFrVQ:DwFZ3IzhG1wgdMMbiEEKo
TLSH
T1FAC219F258E7483AD95E5B43B73E2E139EBCC01BF5856A90B3895A0CCD861BFC306805
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 117cd08deae6ec2108b38f5013c55f4e14c720ca8e25cb089ee924e5355261be
MD5 f52f3f219c1f8292bc553dd2639e52c6
SHA1 e27c64edb9628c3b3f5ffda407b1afdcd38b5640
SHA512 a572552c366050d07ac51ed71386eb29193c9e56ad355e29bdc6271d8f3418796ae9d6446458305ee8dbe2571a24ee946b5bfd50fd3c48e5a3976707fe852bf3
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter~RFe5a31fe.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5a31fe.TMP
Size 392B
SHA256 cba78de228af841b9dde005339f472cfd63cf70078dc43a3313d7885de75d142
MD5 6e22c8bdbcf06ffb140aa4639bae6962
SHA1 d6f25d7e2924075c14f93d61454fd8bba32e2072
SHA512 aaf2802215c00f683327a98367425830a6678212bd394fdd46c44e6ec972c1ef62bf26a5f8dc21a89459d0e34b958d4ab3cb44bb9756840655d4b5dddb841402
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 c1a1a269f09b70effd1b274f349fa1078652c19b387f2474a1c3ef17ce16fe2b
MD5 bda8780c6003f7b5667cd42a8690aad9
SHA1 7eeb997fcfd1b6d3ce9d79f2390d80a0ae76dbbf
SHA512 d2bacacbc5051f6e780d9af831c9d1b92d9d1ca2f1c9564175981fc5bf2cb48656e6597baab7dc6d2c87108beb67da0310e9fc87752b40599287a18f32039b0a
TLSH
T13041F658B6E91144B3B77F569FF6E86E487EBD732E16D46D00010E4F0A62E40D8A1737
MD5 SHA1 SHA512 TLSH

Submit Download