hxxps://bit[.]ly/4aegs9S?r=qr

Analysis

user interaction
yes
max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 12:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://bit.ly/4aegs9S?r=qr
Sample260810-pg217sybkh

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5056	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134308379392207620"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{24D5EB2F-3D05-40AC-9495-0DB59469A2C9}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
764	msedge.exe
764	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 10 IoCs

pid	Process
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe
2320	msedge.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 2320 wrote to memory of 1340	2320	msedge.exe	86
PID 2320 wrote to memory of 5056	2320	msedge.exe	87
PID 2320 wrote to memory of 640	2320	msedge.exe	88
PID 2320 wrote to memory of 640	2320	msedge.exe	88
PID 2320 wrote to memory of 640	2320	msedge.exe	88
PID 2320 wrote to memory of 4908	2320	msedge.exe	89
PID 2320 wrote to memory of 4908	2320	msedge.exe	89
PID 2320 wrote to memory of 4616	2320	msedge.exe	90
PID 2320 wrote to memory of 4520	2320	msedge.exe	91
PID 2320 wrote to memory of 4616	2320	msedge.exe	90
PID 2320 wrote to memory of 4616	2320	msedge.exe	90
PID 2320 wrote to memory of 4520	2320	msedge.exe	91
PID 2320 wrote to memory of 4520	2320	msedge.exe	91
PID 2320 wrote to memory of 3552	2320	msedge.exe	92
PID 2320 wrote to memory of 3552	2320	msedge.exe	92
PID 2320 wrote to memory of 3552	2320	msedge.exe	92
PID 2320 wrote to memory of 3528	2320	msedge.exe	93
PID 2320 wrote to memory of 3528	2320	msedge.exe	93
PID 2320 wrote to memory of 3528	2320	msedge.exe	93
PID 2320 wrote to memory of 4000	2320	msedge.exe	97
PID 2320 wrote to memory of 4000	2320	msedge.exe	97
PID 2320 wrote to memory of 1784	2320	msedge.exe	98
PID 2320 wrote to memory of 1784	2320	msedge.exe	98
PID 2320 wrote to memory of 4204	2320	msedge.exe	100
PID 2320 wrote to memory of 2296	2320	msedge.exe	101
PID 2320 wrote to memory of 2296	2320	msedge.exe	101
PID 2320 wrote to memory of 2296	2320	msedge.exe	101
PID 2320 wrote to memory of 4484	2320	msedge.exe	103
PID 2320 wrote to memory of 4484	2320	msedge.exe	103
PID 2320 wrote to memory of 4484	2320	msedge.exe	103
PID 2320 wrote to memory of 4324	2320	msedge.exe	104
PID 2320 wrote to memory of 4324	2320	msedge.exe	104
PID 2320 wrote to memory of 4324	2320	msedge.exe	104
PID 2320 wrote to memory of 1836	2320	msedge.exe	105
PID 2320 wrote to memory of 1836	2320	msedge.exe	105
PID 2320 wrote to memory of 1836	2320	msedge.exe	105
PID 2320 wrote to memory of 2768	2320	msedge.exe	106
PID 2320 wrote to memory of 2768	2320	msedge.exe	106
PID 2320 wrote to memory of 2768	2320	msedge.exe	106
PID 2320 wrote to memory of 1572	2320	msedge.exe	115
PID 2320 wrote to memory of 4776	2320	msedge.exe	116
PID 2320 wrote to memory of 1996	2320	msedge.exe	117
PID 2320 wrote to memory of 2680	2320	msedge.exe	118
PID 2320 wrote to memory of 2680	2320	msedge.exe	118
PID 2320 wrote to memory of 764	2320	msedge.exe	121

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://bit.ly/4aegs9S?r=qr
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffcdd16c188,0x7ffcdd16c194,0x7ffcdd16c1a0
  2⤵
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1940,i,13655879947005537972,13459668259149111534,524288 --field-trial-handle=2068,i,2450277842292181713,11743691807995282451,262144 --variations-seed-version --mojo-platform-channel-handle=2180 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,14230505605918060744,13196910483239020043,262144 --field-trial-handle=2068,i,2450277842292181713,11743691807995282451,262144 --variations-seed-version --mojo-platform-channel-handle=2056 /prefetch:2
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2476,i,1016599153289897090,13897091628858567288,524288 --field-trial-handle=2068,i,2450277842292181713,11743691807995282451,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:8
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,3619893250165830073,17574470182481720586,2097152 --field-trial-handle=2068,i,2450277842292181713,11743691807995282451,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:1
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,3919637081104050091,2656644228225238886,2097152 --field-trial-handle=2068,i,2450277842292181713,11743691807995282451,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:4520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4168,i,3619949251654538316,11024737221551426437,2097152 --field-trial-handle=2068,i,2450277842292181713,11743691807995282451,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:1
  2⤵
  PID:3552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4228,i,1894194323465236318,16543294677138817120,2097152 --field-trial-handle=2068,i,2450277842292181713,11743691807995282451,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:2
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,16141537796087978282,13431021931994933957,524288 --field-trial-handle=2068,i,2450277842292181713,11743691807995282451,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:8
  2⤵
  PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,14507777438548250560,2363809161668899722,524288 --field-trial-handle=2068,i,2450277842292181713,11743691807995282451,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:8
  2⤵
  PID:1784
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,12313740590861248593,11046958247863510900,524288 --field-trial-handle=2068,i,2450277842292181713,11743691807995282451,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5912,i,12313740590861248593,11046958247863510900,524288 --field-trial-handle=2068,i,2450277842292181713,11743691807995282451,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:4204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=6000,i,9575157891522300522,6248689727530064679,2097152 --field-trial-handle=2068,i,2450277842292181713,11743691807995282451,262144 --variations-seed-version --mojo-platform-channel-handle=6004 /prefetch:1
  2⤵
  PID:2296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6368,i,15452570695565275031,3307307252115682729,2097152 --field-trial-handle=2068,i,2450277842292181713,11743691807995282451,262144 --variations-seed-version --mojo-platform-channel-handle=6396 /prefetch:1
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6572,i,3487144742405688406,28613560816778859,2097152 --field-trial-handle=2068,i,2450277842292181713,11743691807995282451,262144 --variations-seed-version --mojo-platform-channel-handle=6580 /prefetch:1
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6776,i,1861728201897452320,17934860792670137071,2097152 --field-trial-handle=2068,i,2450277842292181713,11743691807995282451,262144 --variations-seed-version --mojo-platform-channel-handle=6792 /prefetch:1
  2⤵
  PID:1836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6916,i,9701692529067366505,11020413427138271451,2097152 --field-trial-handle=2068,i,2450277842292181713,11743691807995282451,262144 --variations-seed-version --mojo-platform-channel-handle=6876 /prefetch:1
  2⤵
  PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4456,i,77099612826616613,13108256896434399666,524288 --field-trial-handle=2068,i,2450277842292181713,11743691807995282451,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:8
  2⤵
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4440,i,4918502159014482368,6661090389808584559,524288 --field-trial-handle=2068,i,2450277842292181713,11743691807995282451,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:8
  2⤵
  PID:4776
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4444,i,12075516152693709622,7109695671661004531,524288 --field-trial-handle=2068,i,2450277842292181713,11743691807995282451,262144 --variations-seed-version --mojo-platform-channel-handle=4448 /prefetch:8
  2⤵
  PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5692,i,6511513971601865057,16147488638291223271,524288 --field-trial-handle=2068,i,2450277842292181713,11743691807995282451,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:8
  2⤵
  PID:2680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3636,i,5029600042192091451,15572994200885370333,262144 --field-trial-handle=2068,i,2450277842292181713,11743691807995282451,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:764

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 4fbc0660f9f3056d5f36574b4004c58e5bf7b4539c8ad0bc0c3c5f5c791c776f
MD5 8410891e1250217cbd9dbe647ad5529f
SHA1 327802c1c5a4509900f7fe24316e0c502f8cbc38
SHA512 5034413d9345fbf305700f2a174f9c14d56e658cc489c615bb3e81afc0edbb449127f4aef51732eedfa1d11fb6ffa8cb919486fe9b500b19c34cebb226d0b956
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7x:fwUQC5VwBIiElEd2K57P7x
TLSH
T1C6B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 39b8627875fea5ac5c5bfb887da12c15116e3fe81f200852c71d5699102c9044
MD5 e3962be2eb3bd350a67bf6309159a1cc
SHA1 c10632202b95ed6f7f4475b6483bf5196e4c5578
SHA512 d12d4acc23b51c071fbc9bf4db2f0575a6b43ec7894b272035e4c01dfce30099cd3ef90a1009dd1e6284cfbcf7a37fd3b79490739946700a2c61ec578374cbe6
TLSH
T173D08C677A0E7815E72F8231A413E360A76B4072A5629702F324C81DA9BC8D85BE63D7
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a59087fbda784cffb013f4e2a0bf13a7fca483c48e8a7fc15fa022402eb25d72
MD5 dd54db185d82309b854bfa7657ba4600
SHA1 d01c14e8b4dec85ed2e1671545a868fd7ad4fa95
SHA512 f014ab84dd934b90e006883b74ad349d05f60071e57d2cf0bdf8a9bce118654c92139263e082094b602f6900a71e9a7848754994a2ea88642b2376121b581d07
TLSH
T165D08067354D7815E71F42319413D350576B4072A562D702F314C41D957C4D857D53D7
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 11e02f4bae6323be8b7756132d6752e069729e9637358c2fe62198e2adb0025f
MD5 bf734fc590f9fa919821d07b08b8039b
SHA1 7f4b375c796fc7bc2a8132054f20d837df66fff9
SHA512 f3b2e243cad339eab1431259e7e8313a1cde82dd1ec4b806b7ebe338d5b716a6498943edc865d0fbb7aa4d31544b1fd62e360879e31a84e030dc22f429f67582
TLSH
T1A5815E36095188B7FBE81071F0F60A6B3471C8A66F97DE761D00D9FE311AF1282925EC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589834.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe589834.TMP
Size 3KB
SHA256 a7481e1c4d9857dc5d86811f03bcf638c9b979266c8f65dcb34c53203b53906a
MD5 8940fe81941ebade3820b460455c6087
SHA1 bec7bf06a274e61b3215ebcd9153ec124da21b8f
SHA512 60c0da3d823a4206b5a4f283c6042a8445814b895edde86e36117244d2d8a4b07b0bc924145d16dd89d6c96281329bb56a102d8f3a69bfebb111df0c8a44de5c
TLSH
T1F96129360E5684B7F3A81171F0F4066B7571C5862FA7EA761D10D6FE311AF1280D21EC
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0ac7e79a-4ca4-418f-b73a-11b6a93f9ffd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\0ac7e79a-4ca4-418f-b73a-11b6a93f9ffd.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 74828b6de85d64d4901bfaa57e1ebd3e94035157de74917da2bd9383fd650d38
MD5 f3344dfe4c6c918c01fa68632a8f70aa
SHA1 f6c385fb682b598c4ea35510d8086f27b8688794
SHA512 d4ddd1cd1acc92f715e1903e1ec6c8322ad87e62f75b1c4faa2d13a05d8c0f4e7eed070b9b77d1cfad6132b5d65fefbc9166754850d08a657c5814db19257f31
SSDEEP 96:DAOTe1GzBVeBj/aCI28zZ4gDh17Bb7RtLi3iG6ID3pYCBpBAwQ:DbTe1G1VeBj/aCI28t4gD7Nb7RFi3iGM
TLSH
T16AC1ABF783B54A7E8E1292F1EA142F5B8E5C0617435C3C1A86D89E57E3E2971E180E4F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 f33a7e363d55cc7dece9692a53c037621e03aa7b18c87a51985b5b6e62e68d44
MD5 c3d5d966941e6a2fd2f5a0ec8c3c7cdc
SHA1 487f0ad2c2830e1b647c7e7252c9d6b3eb66fc43
SHA512 09010372f67e5203301ea6bea54238f16230cce754633a99c61a42319e6eb09e708a033d0908babe995c3deaa4ab4d66f7a56445ad19b2dccb43f9b6f1b0c3cc
SSDEEP 192:sxZbR+yM/jK1Ml8Mkj/fOstc7IdpxfS3HW6+WN0ADY/YHSRdJIgrJ:sxZbMMj/fOstck6HbW/Z9
TLSH
T13452FA166A345977CCDBD219B945BF53D6F90462A2900E589EFC9A1C04E6BED2303C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 2b89e697e5c94f7e78bc451ff92584f83508ee68478244db458e734cec8e191f
MD5 ae4f2a236ad50ddd37b034c646b9646c
SHA1 2012aa16bb59c12edbea1ae6ce40ffb6cce97481
SHA512 1e12643091f199f2cd95b409f60cf517948799cc0e334ed225ce759b0820cae182a882f442997da5998b4d51d787e36d7570f0e0e2255d82b3a6e791025f9847
SSDEEP 192:sxZbR+yM/jK1Ml8UQNkj/fOswa7IdpTfS3HW6+WN0ADY/YHOsXJIg5VJ:sxZbMqmj/fOswakcHbW/y5
TLSH
T18E62D95666345977CCDBD219B941BF93E6F90872A1900E58AAFCDA1C00E6BED2303C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 493249702c4963048330e55c06e43b8b2e3861579b698ee315a6947609106c9e
MD5 e9dbc36b3896bc19b9373e196bd78816
SHA1 0d666d570315dbb36ac84f42d56dc8ea43f2916e
SHA512 c9fc97cc678e8e7fa65886ec56529b0f3394a5bb95fc99c9687eecb0025619f3c792318cb714ff3a75d1def9579724ddabc56807a10fba5b419d161079b97b6f
SSDEEP 192:sxZbR+yM/jK1Ml8Mkj/fOswc7IdpxfS3HW6+WN0ADY/YHSRdJIg5HJ:sxZbMMj/fOswck6HbW/ZH
TLSH
T1A852EA166A345977CCDFD219B945BF53D6F90462A2900E589AFC9A1C04E6BED2303C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 d8dbff9e168f2e974c52187fbfc1b96a7da2883933b6075648a664ae41e1909b
MD5 232b690899751c97b7b97884554ee1fd
SHA1 e41cd8a70e5b1b2665e67a602242d75467869d2c
SHA512 6e671abf1e3f53076efa061308f9f3eaba1370b1da577bd33fd86e2ea46009e33027ef12796ec036ed230a980a6e70d3ecaafadddd82df99fa8a470af80a09de
SSDEEP 768:fmUZYTMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4RYroVD0og:fmUZYTMWvg0Pou1ja7eLZmRjCog
TLSH
T14DD20B2F280CCB7E4F844E5DEC2A6F967ED801CB5A984D5447EA884C03C76EF512B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\534ac8fa811925c74cff4ded87750e6a894fbecf\57e8afb9-f7c7-411b-9dd4-214899c82c8d\index-dir\the-real-index
Size 72B
SHA256 3e863a868894a24143131aaaac52f9e958f25604e1d054d41fc434ec2d8e44f8
MD5 433e679ae76c01c985626ca3799d8852
SHA1 c2f27804a01bf7bc94806a65aabcfe6cfe7344db
SHA512 c7ac01c840f783304a7a9f8c2c8341b9a776f839b3722b634062e4849c2d53569516bba73310a0fdc6f981edf48dd01105d50941c8b96220a5ab2e7477a9b3a2
TLSH
T10FA002955960854ACD5D037152571550723259709E0DCAD750D100D79C50190D113110
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58841f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\534ac8fa811925c74cff4ded87750e6a894fbecf\57e8afb9-f7c7-411b-9dd4-214899c82c8d\index-dir\the-real-index~RFe58841f.TMP
Size 48B
SHA256 670bf8c099e0e5019975ace02a8940b9d5f22397311fbb8ee1f23c3d767e2559
MD5 f56f9a0a5e871a854d8db9470a7cec70
SHA1 d72b9128579ad4587f5c2ea1f00130bf4df6d9b0
SHA512 6dae3622d78e72b4fb6d5f34f6eacb431984712e59b4f77af23336d4e0c316c2b3f6b09bcac63a7dd91be1e7ce1d07e4e6706ca87e281e79502f5c7a5d3123de
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\534ac8fa811925c74cff4ded87750e6a894fbecf\d7c9560f-4d43-4836-9699-65c1e3d8589f\index-dir\the-real-index
Size 72B
SHA256 f79b9c9a0fc962c3c24fc57fb2d2fd53b8716c4b136e529c850e786e16dfd4cd
MD5 acab0a1ef7a176c41605cd754f17d7d2
SHA1 2156af4d2b4c28fa5a30bd0836fcfc80535c324f
SHA512 7a3e61b533c35db5654635cbefb24e3e481114460d68e104295f85691c20eca7434c66de32ae26a651e3cc9691437ac076c1495d7faaffc8c5539fa63894436c
TLSH
T114A002A409C858E3DC11A2F025B1839176195D6C09151206C89D01AAA8A5392D553101
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe587d97.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\534ac8fa811925c74cff4ded87750e6a894fbecf\d7c9560f-4d43-4836-9699-65c1e3d8589f\index-dir\the-real-index~RFe587d97.TMP
Size 48B
SHA256 6725e31a88f0ea71b803a1a4ab39aa20eee78480dd2985918a642012d471608a
MD5 697f915b6595d68b8dd675cd4ac7d88b
SHA1 783dafedce9c236de574b75bd8e97ccbf99d85c3
SHA512 b8ed39a0f42053ffe368e99b03190db6b0190e36eb1db7a8c253fc18728fa4466de0f82850cbb7c8240e531659443d01fca15493143fcfc168a0254eb2db5f13
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\534ac8fa811925c74cff4ded87750e6a894fbecf\index.txt
Size 243B
SHA256 2f3d1f2c52d7a2c2f91fd208f6ecc1c63bc739a620b6b0efdd29a33a3584f46c
MD5 b69e0e7c86a22c50e0abc7951645e81d
SHA1 01a139e051e4279b17e4cac79b56a4700b6eb751
SHA512 b88e6d23e6cea78747a970e6bbd0c9188024e5393a3e6d469dbea1a495b772b951a88bf37d784ab0b5b4a294c378d85bb943243ff0f61fa2a6b8b58dadf12acb
TLSH
T143D095F3E03D5F0AF3765712805DC711DF1B160F0810B03D0445D10D11B55C5C386321
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\534ac8fa811925c74cff4ded87750e6a894fbecf\index.txt
Size 248B
SHA256 e8ede3002511f2caa4f93abd668e6a2324488324dc93d95a0fdc724822790331
MD5 da0d17ef0589a5fa84896c3fc3910028
SHA1 05dbc5d54b9bec457c42172c55b0c56e07dcac32
SHA512 1fdd7320ddebdb618b06e52b2d0a356cbe90b86a1d80fd7bc40a80e0a43daec14dc88dcbd34fb495c44543ebd3bceca2061e12bfdaaf1f4e9b8e2cb601c47187
TLSH
T1CAD02BE390395E06F77A1622805D8641DE2F1E0B1C10A12D0406F10C11B4586C386321
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe5835e0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\534ac8fa811925c74cff4ded87750e6a894fbecf\index.txt~RFe5835e0.TMP
Size 155B
SHA256 b2927f106120c4f08992911e73ec7a5f7de0078903d6f7440050642edfc8e76c
MD5 722a2dc91b76f7a0f6d3e417ff946931
SHA1 5ee42c2e23c0daa4fe0f65d76aca81fd7194139a
SHA512 90db65fdb9fb5aba3a39720890d075e21ebfe8c17c8c871d0661ee2d9d13c96fb8fa16db91bc9f0744853debca572d59d594b824c1e05ea8b144975b649735ae
TLSH
T18FC08CB3E0361E82F33A22A7800AD225EF2A8F0F1800A16C150AB10C21349A2C3CB722
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 b184628e19bf24ab103f57329131ca58e6b16135592405c229fd9892fb8f955c
MD5 9a71bab0dfc37bfbd1a2bf957eeda5df
SHA1 dc98998086f9cf5a426b82f0ee7781a92c5f2e73
SHA512 6020056eb8d37ce43b45733b7dff9bdd4b0fb461dac1bdda24d45dc68f5d0063f505827c38e3ddbd3c5143d4dddff70eec929108c3e13c87306c14551c5f307b
TLSH
T14AA0023501A4C747D0000B7AB0430AC57E345DA533811331C0E5C0B888B93858663084
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe587d3a.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe587d3a.TMP
Size 48B
SHA256 fbad541226c5c4e84fca4e423e18d00d5d92a0c06425d4b24b48c978f16efd95
MD5 721d207adf841fb24295a61ed3ac62fd
SHA1 f88eb3e54dca4eaaa0004ec69b15ce755c2d4d44
SHA512 465ed96974b2c1f920d86dcad2d4ddf3b5081faad19da6ab90b1dd73547c6fca6242c0598b3e551b511d0960221494787cc7643fe908675c9556d726dc391212
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Shared Dictionary\cache\index-dir\the-real-index
Size 72B
SHA256 f81d0a4a2ed9ad60f11eac95653cd0269dcd1b355b0791d97cd2806e7e5fe7a5
MD5 71ef70977021356d01dbfdcdc26911e8
SHA1 b2b86722f903959ab7fdb02c61c45d10dccf86d9
SHA512 5e6056b77cff9e3be45bd32e3b780cea19c696a875f00174c3607525e85f5b800ae35ac2580f11da368e20e9bdd2f97f34fa11534e318d7fb375510cdeb9f6ea
TLSH
T10FA0022203D13805C0000BB43E8D42C5B310E9608343525A64D05055DC682874735601
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 7KB
SHA256 276f6fca685a727bdb63e9a423bd3800bf4ca1099f18eb6c2ff48d4b743a3293
MD5 0069a34dfdfc8855e116c1817bf10ed9
SHA1 7fc38961ef10d5462c5ea948351a8d1099468413
SHA512 218c7afd1dc707dc49a8eb1db9d53aea3fb50f57f8f1ab1c942a58c751d4c47d9366a4bcd877de1e0d2b6afb2a9dc44ca7b5d9860cdf8d7dc0ec4d375d71936d
SSDEEP 96:KA1eK2A08AK92uywgK1WKN2KeI6SUwKJGyqoKLaSg:EuvzgxD+Hg
TLSH
T191F1785675BA02413C7D2A4D826487269FC171A73028A86B7FAD04B25E67F21CFFD8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 19KB
SHA256 ee29e635fd68ecc7292f7887c44fd77cb0919210b71f45d7402669772d536d21
MD5 3f40ac01a152e333eaf3a3cf9c1178be
SHA1 b83819b8dea8b68e24174d13b0795036f163048a
SHA512 f196cd0d5964cedd9763156d35bae28d0c83c82ef4ae7483085ec10218cdc13a81e3c9ce21d90e610b82166900e50f8cafe06b7cec85a9ebf5c5d014fdec9eb5
SSDEEP 384:QZcIhsNH27yFqLwzX5od+F8rAXn76HlytEDq1X07:uh7L4OIn7oy6Dqq7
TLSH
T14D927C3194786C325EFBB055F44A36138EF88463EBC86FD495ED6B2C00DA5E9130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 e16f39346243e5eae11bb63f3b14c123ba2672169cd594725f31983206bae789
MD5 82914d1fb1848f74789ddb7045235149
SHA1 79ea777227d46fcd6279268b6c9d3f5b3e452dcd
SHA512 f1cecd37626edad6f5bdc1f2daf57f918d9654a048776f2af352f3ad035ea7b5847a65f55b60c0728ce1e147f2e29900bb9f36ea5a6d96e4b74d660b10ef1ccc
SSDEEP 384:eqZcIxzsNHxyFXLwzX5od+F8rAX176HlytEDq1X07:JBHL4OI17oy6Dqq7
TLSH
T1FEC229F154E76832D9AEA307A77E3D128EBCC423B6845A94B7EC561CCC855BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 1921924198e271d5ebe4816af05a865838adace25f0de11610ac8a54271c1e56
MD5 42ba7da5b95d745994e93a7d8bf287ea
SHA1 012898ca3dd762a69163a934ffa3d8eacde04d58
SHA512 72f1a4241fb3c529a575920cbc88ed58f70e404d859f240776a3414095dc46210bc34ee9cab0d769eb885944bb60b2a564acf5dec3f0625488131da96930c471
SSDEEP 384:QZcIhsNHxyFqLwzX5od+F8rAXn76HlytEDq1X07:uhaL4OIn7oy6Dqq7
TLSH
T1C9927C3194786C335EFBB155F44A36138EF88423EBC86FD496ED6B2C00DA5A9130BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5dec3ebfa1c8b078094ae7f07cda240eb353b43152cb4ed9b4707d8c80050871
MD5 bcb7e58a45b6f6cfc92c7362fae5c71f
SHA1 1d76ce833351a597585375c978297dd3b2c69c65
SHA512 240c6509b09c75b48629a7d81eb54a018517f2211946be44f042434fb805a63a3a2d0f7ec1b9b8854dd76a20b8f48a6e2d81416e0c797f6738b0aadae43c768e
SSDEEP 192:yONr61VWQmiUy0tgGX5Obd+jVjzorr+/a23GSU6:yONr6WTgGX5od+F8rN7SU6
TLSH
T16D02C83568686CA78EF2BD59B48B37235FE4106BEA552F84DAEC1B1C00D769C2346C37
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0d6e1b199d8c093cd5e8ce25fdf7d7c444a4601c17e9489a02523ec3007b2f18
MD5 273b438473d1669ca16372cb78156eab
SHA1 3c380ee78833aaed7d1c0441397535192e9a5d9e
SHA512 39b13f866339a6e81a94dfdfcc08a2956805b10e332b0f94047c7c77312d445c2d726c1a18402e9eeebaeba5bbfe78a5489e6fc502ccb878024b6fa44d8d1e2f
SSDEEP 192:AONC615WQmiUyitwGX5Obd+jVjzorrAXKrjJEq9U6:AONC6yTwGX5od+F8rAX+7U6
TLSH
T194120936A468AC675DE3B455B48B32239EE95167EF847F90D6EC2B1C00DB5AC530BC23
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2af77bf3-2f11-435d-9ae6-cd33ac7926fc.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\2af77bf3-2f11-435d-9ae6-cd33ac7926fc.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 5abff39b1013f7269f804e3abb80a507a15a76f3d23619a10f67eebc14a05894
MD5 28e8898f8a4fad27e093e68d95c4cd23
SHA1 a9acd052070fa09fcc7d1d43c5fd7ee87a2a0351
SHA512 5184c93bdf75fa78fa06e8048eb3dc6b33ed971c6db74040294f39c5ce48bc767896685c02dd72d7ce14367cc518ed25ebd50c97a3bc2f2d7fabb9a70832c9a6
TLSH
T1A2410758B6E91148B3B77E5AABF7A56D447BBD372E0AD45D10110D4F0A62B40C8B1733
MD5 SHA1 SHA512 TLSH

Submit Download