54c0bc33a7b6434de25b7e5e7904c8ba9ee201cb03fa4003f0ae3d667325a0a8

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 06:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
done.html
Size 1.2MB
Sample260810-g6basaee57
SHA256 54c0bc33a7b6434de25b7e5e7904c8ba9ee201cb03fa4003f0ae3d667325a0a8
MD5 3428c2c8225e5720ded395ba5a7dda5f
SHA1 df8cc264320a977c1165ba5e2a4c0fea32a071e4
SHA512 7e026207a8e481a51fe847328b703040abae00be811e0351c0a21abba291b6ce11d7382604f8d42eae0afbdd54441e412be7c5347268f63cb692f187305f96d4
SSDEEP 24576:W9+Db/9J9s9N9p9QDb69WDbT9NDbq9+Db/9J9s9N9p9QDb69WDbT9NDbM:/hnrThnrM
TLSH
T182555A44F22655B9A97B133B73CBA58D6220B403EAF2E595B2CC15005FCBEFB141778A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
804	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134308166932343768"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{73EC3080-06DE-43A7-8971-42852A683D81}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2164	msedge.exe
2164	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe
4356	msedge.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 4356 wrote to memory of 4136	4356	msedge.exe	85
PID 4356 wrote to memory of 804	4356	msedge.exe	86
PID 4356 wrote to memory of 2208	4356	msedge.exe	87
PID 4356 wrote to memory of 2208	4356	msedge.exe	87
PID 4356 wrote to memory of 2208	4356	msedge.exe	87
PID 4356 wrote to memory of 552	4356	msedge.exe	88
PID 4356 wrote to memory of 552	4356	msedge.exe	88
PID 4356 wrote to memory of 3288	4356	msedge.exe	89
PID 4356 wrote to memory of 3288	4356	msedge.exe	89
PID 4356 wrote to memory of 3288	4356	msedge.exe	89
PID 4356 wrote to memory of 4596	4356	msedge.exe	90
PID 4356 wrote to memory of 4596	4356	msedge.exe	90
PID 4356 wrote to memory of 4596	4356	msedge.exe	90
PID 4356 wrote to memory of 5088	4356	msedge.exe	92
PID 4356 wrote to memory of 2832	4356	msedge.exe	93
PID 4356 wrote to memory of 5088	4356	msedge.exe	92
PID 4356 wrote to memory of 5088	4356	msedge.exe	92
PID 4356 wrote to memory of 2832	4356	msedge.exe	93
PID 4356 wrote to memory of 2832	4356	msedge.exe	93
PID 4356 wrote to memory of 2540	4356	msedge.exe	97
PID 4356 wrote to memory of 2720	4356	msedge.exe	98
PID 4356 wrote to memory of 2540	4356	msedge.exe	97
PID 4356 wrote to memory of 2720	4356	msedge.exe	98
PID 4356 wrote to memory of 2616	4356	msedge.exe	100
PID 4356 wrote to memory of 2924	4356	msedge.exe	101
PID 4356 wrote to memory of 2924	4356	msedge.exe	101
PID 4356 wrote to memory of 2924	4356	msedge.exe	101
PID 4356 wrote to memory of 2916	4356	msedge.exe	102
PID 4356 wrote to memory of 2916	4356	msedge.exe	102
PID 4356 wrote to memory of 2916	4356	msedge.exe	102
PID 4356 wrote to memory of 1332	4356	msedge.exe	105
PID 4356 wrote to memory of 2396	4356	msedge.exe	106
PID 4356 wrote to memory of 1912	4356	msedge.exe	107
PID 4356 wrote to memory of 744	4356	msedge.exe	108
PID 4356 wrote to memory of 744	4356	msedge.exe	108
PID 4356 wrote to memory of 744	4356	msedge.exe	108
PID 4356 wrote to memory of 5104	4356	msedge.exe	109
PID 4356 wrote to memory of 5104	4356	msedge.exe	109
PID 4356 wrote to memory of 2824	4356	msedge.exe	110
PID 4356 wrote to memory of 2824	4356	msedge.exe	110
PID 4356 wrote to memory of 2824	4356	msedge.exe	110
PID 4356 wrote to memory of 2072	4356	msedge.exe	111
PID 4356 wrote to memory of 2072	4356	msedge.exe	111
PID 4356 wrote to memory of 2072	4356	msedge.exe	111
PID 4356 wrote to memory of 1636	4356	msedge.exe	117
PID 4356 wrote to memory of 1636	4356	msedge.exe	117
PID 4356 wrote to memory of 2164	4356	msedge.exe	120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\done.html
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x254,0x7ffc3d9ec188,0x7ffc3d9ec194,0x7ffc3d9ec1a0
  2⤵
  PID:4136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1980,i,7432006959450245789,10835978416249263459,524288 --field-trial-handle=2116,i,7736060499377075436,2199732075622719634,262144 --variations-seed-version --mojo-platform-channel-handle=2192 /prefetch:3
  2⤵
  - System Time Discovery
  PID:804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1760,i,10969293008171787080,13776906129280023288,262144 --field-trial-handle=2116,i,7736060499377075436,2199732075622719634,262144 --variations-seed-version --mojo-platform-channel-handle=2108 /prefetch:2
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1360,i,13772337702401083549,11759138805977400514,524288 --field-trial-handle=2116,i,7736060499377075436,2199732075622719634,262144 --variations-seed-version --mojo-platform-channel-handle=2572 /prefetch:8
  2⤵
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,12505331663265549191,11401964002974833061,2097152 --field-trial-handle=2116,i,7736060499377075436,2199732075622719634,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:3288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,12158481575158374448,14280641537430359158,2097152 --field-trial-handle=2116,i,7736060499377075436,2199732075622719634,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4236,i,4667768762327533756,2296381888049556507,2097152 --field-trial-handle=2116,i,7736060499377075436,2199732075622719634,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:1
  2⤵
  PID:5088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4252,i,6249979242297794158,9598695064724206597,2097152 --field-trial-handle=2116,i,7736060499377075436,2199732075622719634,262144 --variations-seed-version --mojo-platform-channel-handle=4280 /prefetch:2
  2⤵
  PID:2832
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3600,i,7072656668101000171,10096170933304190655,524288 --field-trial-handle=2116,i,7736060499377075436,2199732075622719634,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:2540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3588,i,15020476470423556477,2741432625077343385,524288 --field-trial-handle=2116,i,7736060499377075436,2199732075622719634,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:2720
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5772,i,452959252847654012,9894594328465759111,524288 --field-trial-handle=2116,i,7736060499377075436,2199732075622719634,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:8
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5772,i,452959252847654012,9894594328465759111,524288 --field-trial-handle=2116,i,7736060499377075436,2199732075622719634,262144 --variations-seed-version --mojo-platform-channel-handle=5700 /prefetch:8
  2⤵
  PID:2616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6192,i,5557143577110779030,11972836143599247778,2097152 --field-trial-handle=2116,i,7736060499377075436,2199732075622719634,262144 --variations-seed-version --mojo-platform-channel-handle=6088 /prefetch:1
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6368,i,17542166760276231065,7139584472964601854,2097152 --field-trial-handle=2116,i,7736060499377075436,2199732075622719634,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:1
  2⤵
  PID:2916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4328,i,11339095022188068390,3983100243964044975,524288 --field-trial-handle=2116,i,7736060499377075436,2199732075622719634,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:8
  2⤵
  PID:1332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4280,i,2492189122887387690,469079925892166872,524288 --field-trial-handle=2116,i,7736060499377075436,2199732075622719634,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:8
  2⤵
  PID:2396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4320,i,1009233908022325757,944499731578297282,524288 --field-trial-handle=2116,i,7736060499377075436,2199732075622719634,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:8
  2⤵
  PID:1912
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=5864,i,11706445663070451033,5577490890918341288,2097152 --field-trial-handle=2116,i,7736060499377075436,2199732075622719634,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:1
  2⤵
  PID:744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5100,i,16269146623453710112,14064359409638130021,524288 --field-trial-handle=2116,i,7736060499377075436,2199732075622719634,262144 --variations-seed-version --mojo-platform-channel-handle=4352 /prefetch:8
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=5944,i,9890918070774990330,12529757510892607977,2097152 --field-trial-handle=2116,i,7736060499377075436,2199732075622719634,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:1
  2⤵
  PID:2824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=5204,i,3762986705769097501,14618847858271563487,2097152 --field-trial-handle=2116,i,7736060499377075436,2199732075622719634,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:1
  2⤵
  PID:2072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=700,i,942972725656856844,15172543771321989008,524288 --field-trial-handle=2116,i,7736060499377075436,2199732075622719634,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:8
  2⤵
  PID:1636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5904,i,11378818930240882541,10696841011602842341,262144 --field-trial-handle=2116,i,7736060499377075436,2199732075622719634,262144 --variations-seed-version --mojo-platform-channel-handle=6812 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2164

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4600

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 4fbc0660f9f3056d5f36574b4004c58e5bf7b4539c8ad0bc0c3c5f5c791c776f
MD5 8410891e1250217cbd9dbe647ad5529f
SHA1 327802c1c5a4509900f7fe24316e0c502f8cbc38
SHA512 5034413d9345fbf305700f2a174f9c14d56e658cc489c615bb3e81afc0edbb449127f4aef51732eedfa1d11fb6ffa8cb919486fe9b500b19c34cebb226d0b956
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7x:fwUQC5VwBIiElEd2K57P7x
TLSH
T1C6B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e2b315c59b1bfe8e547b0017a92548af7c81e08409e987a2628ad74667b4fec
MD5 7ab616f55807e9de5195a40c50f65e5b
SHA1 917a7797f800e5f30a1b9b8125127968246d7ce9
SHA512 da10f29803a072f42a2c102da0bee745cf1b1d47836e3d30e38b1e66beeb1abeaf2eb47b6c07b23682098f70fe2a4b29a0777eefa1380d0fff2509ff32d9b356
TLSH
T171D08023771D7182F35B41759053D7025A1680756463B701B325D41C9A740C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b976ac8901ffd41ec02a04aa583bc9d11350f0f9f714fb92d3341bb0bde4629f
MD5 504ce80b644a85a7e68d85bd24169289
SHA1 1f740a722dfa97fc8fb30626b0e3d6217e4a9864
SHA512 9406464a4f6becd85591c12af8a97fdecfa2208649138f347fb50d3e28f1583adec061050924fa0405e46eb75af7e299e6564c2ed039db9d82c50326da32a3c5
TLSH
T19ED08023371D7582F75B41759053D7025A1680756463F701B325D41C9A750C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 a408b368e12f66bb5968488acd25146652af7f8dcc8a499c90d712475506781d
MD5 d13be4d54bda35a7f10d3e74bea8152b
SHA1 7881285fec423ff78c46c7256ca35b687d25e2f2
SHA512 c4db76928070a9014ae1ab0815183cacacb24225ac11a9d13c78b5538c2c9119d5b874bad063f2de02eafb05f3ff7efa2bf7c2b3e45b969dbca40535908d7a5b
SSDEEP 48:eqcHSxa2Bdy8GutlkZpCGnkZiiyS7lWKfhlsmM9bBalxJ5B8Xi78fShx67NM6cUO:K+a2+1pCg12fr9AVanJ5B8yGwUfO
TLSH
T1B38194362282C8F1F3712071BCD8626DB773A5C7F9936EE152D27C362906FA39517258
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 0c1405e4e4901de739e0dbd38c079d6b1f32a5b5ced3d5546ac24ec83a030212
MD5 69e6beb0c9c7ef23081431ef82b3ab0c
SHA1 f1d09328744670de63acbb874ca77a710753fb15
SHA512 d2ab9980e1242e8360ba2f55af729be56b245ee3c5c7ad08eb41d6dd21fdc1819b6f6f14ba2aaa5268ee90a7ae1749757e8a1ac510a0c482c2b26d62b99a26f2
SSDEEP 48:dqcHSxa2BsMy8pKdutlkZpCDSnkyiiyS79WKfhlsmM9bBalxJ5B8Xi70cPShx677:9+a2koKZpCDcA2fr9AVanJ5B8yzwUp9
TLSH
T12491A5763186C8F1F7312071BCD8665EB733A1C7F9935EE212D26C362806F935657258
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 013b3159e22abc7809cde0df60eb83a97e18a5d98cc235f4d6376a69e967aeb4
MD5 8064208c7265583e34aa1da0a3cc29d1
SHA1 da7caa979f56a32dbdc14ed241d1c9d31069dd4e
SHA512 d093ca2df74a5656977f2b35b1cccc6b0644a043a7d9058818fe4c8dde0d4383919a40515ff2e63e471104270389f8e6e77651973cbbef0aae116ee328447603
SSDEEP 48:8qcHSxa2BsMy8pKdutlkZpCGnkZiiyS7lWKfhlsmM9bBalxJ5B8Xi78PShx67NMf:M+a2koKZpCg12fr9AVanJ5B8yewUrK
TLSH
T15391A5362286C8F1F7712071BCD9626DB733A1C7F9936FD212D2AC362906F939517258
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe588911.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe588911.TMP
Size 3KB
SHA256 885d3d082abe4ca0811e4f001557b2424da29f09d470ade1a4622a27a3174470
MD5 85cd5b9264299887abbe79b52dcbe2ea
SHA1 161dfd6cb8c1d310a9eee40a914bd124a542a2b7
SHA512 7a968e450fac6556d377dc9af98bb0032464df83a3a6d08f67724bd17e3538b9af90a60c7ddd10e3cd20e28f852b8a33943f9fe13500f7bce1ac984d51a311d9
TLSH
T1847170351286C8E1F3710032BCE9526EBB73A5C9F9A7AEE151D0BC376508F92964715C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 8489d11c49fe169b944aa5aa889f6e371d65dea6028201d7b59c9b91fd59d104
MD5 b7616617b25e140287a000ae71f3ffe2
SHA1 8e735d6236d626487e27971177ba44f0105251ed
SHA512 a66a561e22b07c6d2b80acaa339bf919d54c1bd04a712e333d9e89cf7d034b0d1d20e4f2dc06dbf1233ce38cb08d15ddb1c93b7be6225d4e8d4f549690dd68cb
SSDEEP 96:D3lO8BeZszB3bI02bvdtBRsX0rJLcqemp/4ywB3KAEdx:D3o8BeZs13bI02bvdtBRsX0JAqemp/4k
TLSH
T1ECA14AB783F8963E9E3152F99A142E1BCD8C0525032C38B7C6F4AE16A7E2970E14165F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 c0f4fe22218d60b025b0c4192a33c25098308cf700b3d76835090ea0a406e27b
MD5 52d47d9322963a23b2b6127c61b91edf
SHA1 3180b9172f2cf3e0ad2a9894d4e2240858c222e4
SHA512 d9cbf6e270eee90415c9effe7a8d52abaaab700b13ef19c6664bc5dc989b49069dc49eeba215d0b3183827e973a066f754f8acc2657bd828bec4e14e79ee38e7
SSDEEP 96:D3lO8BeZszRG3bI02bvGwitBRsX0rJLcq43bm5:D3o8BeZs9G3bI02bvGftBRsX0JAq4rm5
TLSH
T1EB8129B783F8963E9E3152F59A142E1BCD9C0515032C3CA7C6F4BE16A7E2970E14165F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 eea7a67bec79d8d6219ce63c8440d68a8bdefde00bd768c090990ac8b9e86885
MD5 7a635fb38cfc86c3b8d33278466d820e
SHA1 4dfcb556334c5d8b30a4c017ce075719e9fb3c24
SHA512 998bc8f75224057de8d9ae6ab015705efebcc8cc39166fd8b925d8224b6992fa0912396cbdbbbf9d90abc58006d4437aa0477db9fbe4795c7a243932f543ef95
SSDEEP 192:sxZ7RVyM/jK1Ml8MkL/f7sOjPKIdpdfXHW6+WNGYIkaOrIgrJ:sxZ7LML/f7sOLDZHbGG9
TLSH
T15A4209116B34697BCCCBD20DFA55BF53D6F84572A2900E54A9FCDA1C04E6AED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 59f3706ff26bfe23e4e9f2684641941142b4e894018c6f95342131de193e35d6
MD5 a740490ba514e69111a70754df3b6e87
SHA1 fbf94aa3278efba8d1e0db20cdfe5f98feeb3ce6
SHA512 8140f45888ba50df0093bf3ee605e5eb5e666774de18e5772299978d51b2a24a7dae3b77d1fd8932ee3502955f12ca5968f3ae82d86bea9917ad12fcf01b8bf1
SSDEEP 192:sxZ7RVyM/jK1Ml8UQ8kL/f7s/jOpIdpHfXHW6+WNGYITx1rIg5WJ:sxZ7LqHL/f7s/ai/HbG1o
TLSH
T13B52F8116A345977CCDFD20DF941BF53E6F84572A2900E54AAFCDA1C04E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 5a16acda165cb1a889b7a766a3a21e6b307cc7c4e52c34652a7e67e4da16fce8
MD5 7815531cb5d93eb3450fbc85ae818b51
SHA1 e696169deb99a989ba3f1dc87878e9cce4a903f6
SHA512 010eab9bf8a81ba713f7281f8e168c2b4b2398912a20a8effae93d0844ca172279fcd85f4914fd783f1ccceeeefc1c067382731da294c475971031c6b40be99f
SSDEEP 768:RtsqxXlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR9EroduQ:RtsqxXlWvJD6Tu1ja54LAs9Pdb
TLSH
T16AD21B3B694CC77E4F840E6CEC266FD76ED801CBA6988D5447FA884C03CB2EA51165DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 6KB
SHA256 da7c783ab8de12785a753dbb2f8ec63469c639924eb455baf4da083261983c11
MD5 da4bdc59be30344302930c69df9000d3
SHA1 5946e4aadd762898fde2b1e5a65ac482dc47c124
SHA512 a1e3569efe1f4ce58ea0507288d3f297432803c63bddbccb9fa9e52be85d9188d002629a959f44d1605430f23c47ed147923789a508eb01a008b80e011aec0bb
SSDEEP 96:KYbaKYIK6G0K/ai2t6KWElUgKxmSONaK2AuYJEIWH:ExH3ZFDNP
TLSH
T16CE1441B313A076238BE2948B2A6CA3B4F4231637118A57F7F7850A55D6EE114DFC8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 49c62fa47fb175f8736b914c88bee95026a1c5e57ac8fec34e8034bd3432fd50
MD5 be06a5de42c1240062a52734ac393de1
SHA1 8c43dd9b6cfb10ec8dd6eec2c755e2bced1361b1
SHA512 6567e7e94c1c1449423a25e0fcbb420378f47220a407b8ac6ccd787a5572e9bdd1b0254e61eb14ca3ed930d8635ab362115d48925e2375ef480b4bf530bc04de
SSDEEP 192:uvLsN/AQ2XMxlkRbD6QmiU1aUs4VRN5Om5o9nz9d+2fudSRezqU7U8:YsN/AxMmbi9jVRN5Oj9z9d+2fuEefU8
TLSH
T1463229366C285C365EE6A941F48736039FF8516BDAC93F90D1DC6B1C01EF6AC231B91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 79e43510539a8f4f30966da7ea05cf21e71daf795b15d343ca4ca6263d3dc082
MD5 1aba86753bd967626643ffda63abd669
SHA1 1668a3b25b9390e6f8e5e33ef708d15108b625e5
SHA512 4c7463bc8ec377552af8dc3f68bf05a29c7eef8ea052488d646be811ab2b26f38f17b29d7654a1d0439831b7c8956337512127cd21b1e0919598de9ac4d49bb0
SSDEEP 384:lGzsN/TxMmbi+jVRN5Oj9z9d+2fulefXw:cWxBH5Oj9z9dlmlefA
TLSH
T11982C4F568E71C32C9AE5743A77E2D035EBCC127B5852A50B3D86A0CCD9A1BFD306806
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 eccfeab4ff51515e611ea6fef6cd5cf2ae41f83ca32093596056a4ae3e76850f
MD5 c613c03fc658dee2277d08da16a46b38
SHA1 a1b270aa24584c2f5f99f9eeb9a2a2c0231128c5
SHA512 835b2f5582e496060615a516ae80cf17bcd987fe32d13606af8dc33757841fe6da5672a1fe48254dbcb0bb497f162323acf47691b136b834ba803100f423faf8
SSDEEP 384:lqZcI6zsN/TxMmbi+jVRN5Oj9z9d+2fuxefXy:+SsxBH5Oj9z9dlmxefC
TLSH
T1F5A207F158E71832D9AE6703A77E2D034EBCD127B6852A50B3D86A0CCD9657FD306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 d3a3ffd6525f3d08f9427d5566f2e8bd3748fff41d266c461e3124d5fa2f7ae5
MD5 20f16d23215e6ed969d13b00ad5026d9
SHA1 c25662d7d49cdb442da56d59cf5bfc74a8527281
SHA512 b884d8db2d6a3b3a410069188fbb5f3b4d8a8b0aaa3c6678fe23f56784d0efefdd8804bea545cd3e1d5840dc816e58d88295d2eeaca89f637632b37ca68831f5
SSDEEP 192:tONiD6JkRtQmiUybZW+RN5Om5o92h3eFRXU6:tONiD6UruW+RN5Oj9+eTU6
TLSH
T1C702D8356D386C779EF66E0AB98737175FA4207BE9852F80E6E81B0C01D769C2347826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 f04afcc374d43826f8d2217adac064becb400f9c3ade5e0cb0128de7d986c776
MD5 0048628357327674ad2f6249c9c26f43
SHA1 d36035ad594a1ac4c96a690660aa9247f3623f58
SHA512 20292a0694e873acf82ab8e2ad8822e13e7a09825799050e48d81a689d7305e8d82cdd72bf18d3b2de847aa2f23a4ddb68e4622cd5fd33e4c18c78e8b407defb
SSDEEP 192:uULsN/rQ2XMxlkRbD6QmiU1aUs4VRN5Om5o9nz9d+2fudSRezqU7Ut:hsN/rxMmbi9jVRN5Oj9z9d+2fuEefUt
TLSH
T15A3229356C285C364EE6A941F58736039FF8512BDAC93F90D1DC6B1C01EF69C231B91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 ed07d0fbdb79837313346c5389ff7bfb6e1879f18737e2a4dcc8bcbc44c30d81
MD5 3cfcea5d03f4a5c97cfa42c8b51e0c9b
SHA1 b14fe615be5eef7e373de052deba9d84339b4c3c
SHA512 0cd13686088604a1651cd7507434d8d36ae5e2f2693857499cb9e8219eaf20872ceb5ee97b0324b0a25b9fc87858131b5629acb9f52e1db5c5977cf717cecb06
SSDEEP 192:uULsN/TQ2XMxlkRbD6QmiU1aUs4VRN5Om5o9nz9d+2fudSRezqU7rbnw:hsN/TxMmbi9jVRN5Oj9z9d+2fuEefXw
TLSH
T18E42393668381C325DEAA946F54B31039FB8916B9AC92F90D1DD6B1C01EB69C230B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 a76dec5150c8508a5baac8c36f649368d2f8528eea260a2964abf6ad06da371b
MD5 434ad624ac052dcec1285ff810ddd93c
SHA1 4d5b8433fbc2fe0b32895277b3e0ef99c4d5ad94
SHA512 a419f3e42abe642b1b521d243308ba091c41a60f047ea3f9543b674c52c90a86bca95086123ab75a29bf4f6eae7233dcff27a8bb320a9aca912c823ca78fcdd9
SSDEEP 192:/ONK6JkRMQmiUycZx+RN5Om5o9nz9d+2fuoVcezqU7U6:/ONK6UcDx+RN5Oj9z9d+2fu/efU6
TLSH
T1D01229356D385C375EE6A945F48731075FA8512BEA897F90D1DC2F0C02EFAAC234B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f721a8e7-c7c0-404f-98bf-426bfe0236cf.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\f721a8e7-c7c0-404f-98bf-426bfe0236cf.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 28006a76e1f11792ee32c8384dbe75b1d842c1b6925aa5dfef3800be0b5b6b8a
MD5 fa81cc04af8a151680e2b9535c1857ad
SHA1 736ae84db40adf4b796ffa73a03ec46499664d6d
SHA512 d90c2fd8c21cf11c60074df2f3d2437a2abd893df499038be6e74a67d21dd97f20a35bbc44474360e51765fa0d84c568cb21374b3ae3695caa385bda4d0ca4f8
TLSH
T12441D35CB6EA1148B3B76F5BABF6A96E447AB8772E06D45D00010D4E0A62A40C9B1B37
MD5 SHA1 SHA512 TLSH

Submit Download