hxxps://onthecenterstage[.]com

Analysis

user interaction
yes
max time kernel
598s
max time network
436s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
10/08/2026, 16:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://onthecenterstage.com
Sample260810-txps2ahd24

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1796	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134308528040367684"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{D5E80FA5-450F-405D-855D-9162B8FE2B4F}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2688	msedge.exe
2688	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe
4968	msedge.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 4968 wrote to memory of 640	4968	msedge.exe	87
PID 4968 wrote to memory of 1796	4968	msedge.exe	89
PID 4968 wrote to memory of 1216	4968	msedge.exe	90
PID 4968 wrote to memory of 3800	4968	msedge.exe	91
PID 4968 wrote to memory of 1216	4968	msedge.exe	90
PID 4968 wrote to memory of 1216	4968	msedge.exe	90
PID 4968 wrote to memory of 3800	4968	msedge.exe	91
PID 4968 wrote to memory of 4200	4968	msedge.exe	92
PID 4968 wrote to memory of 4280	4968	msedge.exe	93
PID 4968 wrote to memory of 4200	4968	msedge.exe	92
PID 4968 wrote to memory of 4200	4968	msedge.exe	92
PID 4968 wrote to memory of 4280	4968	msedge.exe	93
PID 4968 wrote to memory of 4280	4968	msedge.exe	93
PID 4968 wrote to memory of 4108	4968	msedge.exe	94
PID 4968 wrote to memory of 4108	4968	msedge.exe	94
PID 4968 wrote to memory of 4108	4968	msedge.exe	94
PID 4968 wrote to memory of 4316	4968	msedge.exe	95
PID 4968 wrote to memory of 4316	4968	msedge.exe	95
PID 4968 wrote to memory of 4316	4968	msedge.exe	95
PID 4968 wrote to memory of 3048	4968	msedge.exe	98
PID 4968 wrote to memory of 3764	4968	msedge.exe	99
PID 4968 wrote to memory of 3048	4968	msedge.exe	98
PID 4968 wrote to memory of 3764	4968	msedge.exe	99
PID 4968 wrote to memory of 1340	4968	msedge.exe	101
PID 4968 wrote to memory of 1220	4968	msedge.exe	105
PID 4968 wrote to memory of 4548	4968	msedge.exe	109
PID 4968 wrote to memory of 64	4968	msedge.exe	110
PID 4968 wrote to memory of 1656	4968	msedge.exe	111
PID 4968 wrote to memory of 3876	4968	msedge.exe	112
PID 4968 wrote to memory of 3876	4968	msedge.exe	112
PID 4968 wrote to memory of 2688	4968	msedge.exe	122
PID 4968 wrote to memory of 4924	4968	msedge.exe	123
PID 4968 wrote to memory of 2000	4968	msedge.exe	124
PID 4968 wrote to memory of 4924	4968	msedge.exe	123
PID 4968 wrote to memory of 2000	4968	msedge.exe	124
PID 4968 wrote to memory of 2492	4968	msedge.exe	125
PID 4968 wrote to memory of 2492	4968	msedge.exe	125
PID 4968 wrote to memory of 4256	4968	msedge.exe	128
PID 4968 wrote to memory of 4256	4968	msedge.exe	128
PID 4968 wrote to memory of 1472	4968	msedge.exe	129
PID 4968 wrote to memory of 1472	4968	msedge.exe	129

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://onthecenterstage.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff86e4ac188,0x7ff86e4ac194,0x7ff86e4ac1a0
  2⤵
  PID:640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1816,i,15373531035243155606,16535894962095440118,524288 --field-trial-handle=2580,i,15882171354924279874,18178882373478845019,262144 --variations-seed-version --mojo-platform-channel-handle=2628 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1712,i,13379696587052211398,100505727712215304,262144 --field-trial-handle=2580,i,15882171354924279874,18178882373478845019,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:2
  2⤵
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2264,i,3988195170601487133,11857704159078894428,524288 --field-trial-handle=2580,i,15882171354924279874,18178882373478845019,262144 --variations-seed-version --mojo-platform-channel-handle=2636 /prefetch:8
  2⤵
  PID:3800
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3464,i,14675777718027943654,5644250216168472860,2097152 --field-trial-handle=2580,i,15882171354924279874,18178882373478845019,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3460,i,1559400031708684509,5847478488006373218,2097152 --field-trial-handle=2580,i,15882171354924279874,18178882373478845019,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4172,i,2141649926630231411,1813810805095797311,2097152 --field-trial-handle=2580,i,15882171354924279874,18178882373478845019,262144 --variations-seed-version --mojo-platform-channel-handle=4176 /prefetch:1
  2⤵
  PID:4108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4184,i,925651939453650041,5701113783298444527,2097152 --field-trial-handle=2580,i,15882171354924279874,18178882373478845019,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:2
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5132,i,3581382444333064320,12262089156508036041,524288 --field-trial-handle=2580,i,15882171354924279874,18178882373478845019,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:3048
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5144,i,3641900187978135847,2688715746777516416,524288 --field-trial-handle=2580,i,15882171354924279874,18178882373478845019,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:8
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,18014770812212615095,329812522944271148,524288 --field-trial-handle=2580,i,15882171354924279874,18178882373478845019,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:8
  2⤵
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,18014770812212615095,329812522944271148,524288 --field-trial-handle=2580,i,15882171354924279874,18178882373478845019,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:8
  2⤵
  PID:1340
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=120,i,10665777233083382723,18422719217528768635,524288 --field-trial-handle=2580,i,15882171354924279874,18178882373478845019,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:8
  2⤵
  PID:2604
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=120,i,10665777233083382723,18422719217528768635,524288 --field-trial-handle=2580,i,15882171354924279874,18178882373478845019,262144 --variations-seed-version --mojo-platform-channel-handle=5800 /prefetch:8
  2⤵
  PID:1220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6280,i,15129043939996464805,17233214967934901,524288 --field-trial-handle=2580,i,15882171354924279874,18178882373478845019,262144 --variations-seed-version --mojo-platform-channel-handle=6228 /prefetch:8
  2⤵
  PID:4548
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,11920408902788065114,9017068030660649903,524288 --field-trial-handle=2580,i,15882171354924279874,18178882373478845019,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:8
  2⤵
  PID:64
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,12094266057489203715,16750958993070011739,524288 --field-trial-handle=2580,i,15882171354924279874,18178882373478845019,262144 --variations-seed-version --mojo-platform-channel-handle=4360 /prefetch:8
  2⤵
  PID:1656
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2592,i,15775533003277029425,10975364459071887486,524288 --field-trial-handle=2580,i,15882171354924279874,18178882373478845019,262144 --variations-seed-version --mojo-platform-channel-handle=3292 /prefetch:8
  2⤵
  PID:3876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6140,i,10543043143221240685,5666015266604753634,262144 --field-trial-handle=2580,i,15882171354924279874,18178882373478845019,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5784,i,10773619457972395487,7001596777367253563,524288 --field-trial-handle=2580,i,15882171354924279874,18178882373478845019,262144 --variations-seed-version --mojo-platform-channel-handle=3768 /prefetch:8
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5596,i,8751725390987784363,10561729400990097859,524288 --field-trial-handle=2580,i,15882171354924279874,18178882373478845019,262144 --variations-seed-version --mojo-platform-channel-handle=5912 /prefetch:8
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6492,i,18150368102453638245,12781899783935116300,524288 --field-trial-handle=2580,i,15882171354924279874,18178882373478845019,262144 --variations-seed-version --mojo-platform-channel-handle=5372 /prefetch:8
  2⤵
  PID:2492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2780,i,2360510010442481965,12064286063905419694,524288 --field-trial-handle=2580,i,15882171354924279874,18178882373478845019,262144 --variations-seed-version --mojo-platform-channel-handle=3776 /prefetch:8
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3388,i,14245139514245038487,14670383770836484109,524288 --field-trial-handle=2580,i,15882171354924279874,18178882373478845019,262144 --variations-seed-version --mojo-platform-channel-handle=3384 /prefetch:8
  2⤵
  PID:1472

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3096

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cd640af4b18734f838b65cd3f2b65e25dc669e7cc487a16f826240b353446af4
MD5 337b94f0014654439210355bd20e82dd
SHA1 26e4c8276331781253e2a807dd554b2ee3ad7e8e
SHA512 087107a51c83ccffad34c7d3f5423a0f231d30a9f78e9ed5db98eb770bada291f65c7b34d1e72284571b846a7acdf88b217ef4da25b7acff47964af1551b2e9b
TLSH
T1B6D012323B197041E71A8130E403C74017AE54B524864606A254C50D6DA90C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 85f865adbe5e58c0596a4db9b9daa509b8e2bd087dbcc9a01a5a095a266757bc
MD5 29ddc94c4e214fd03f664130dd36edfe
SHA1 10dfd57508ad6ef16445956dc1ee4d8c2bffc4e3
SHA512 fa7477f3f8068f41dae4965a930de8ad11b234c1ccfcd17a84fb2bfe4c289beebc19be8d058f75ed01b6dbe7304af8270da91d31316fc94360f4fa750ab203bd
TLSH
T13AD012323B597441E71A8130E403C74017AE54B524868706A254C50D6DAA0C592CB682
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 13521b9841f9d44b1664686bf248cb8477e260deef996382e7424bc9b9fe49dd
MD5 260eaaaf57dc67b4c91b1a3828a80064
SHA1 7648e3b923b7b15dbc90b139aaed134ccbccd1a9
SHA512 d8f390b435e458ce5204241590c09af038d900051e289c89300b7a2db192001eba158fcb9c5bab9bd8bd515f0a29cf982ade2697859c873e2227195c6509116f
TLSH
T15DE0D88D13CFC9A88D8997CBB559A3184A12600BD5DCE6FB3245605CB4019464796680
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 f803625f7089762ff6faeb3ece82729aca5f5a8ea6348ac385095f4ef1109a96
MD5 886d3a2f30ae328537f8a8495b7ac587
SHA1 7c18a459a31db22bab627b1df46f4732da5c15d8
SHA512 8d54299c0b059afd776373426c1e9e04dc2a04db5ba8722970b08f1abe9288e7b9230a4254217fff0985090db156a1f16de461ec7037774cdff0e4deaa405a0a
TLSH
T1D5C080D8BDCC845DC281187E5716F400075176119417A6170551FCC03241EE01F29120
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b7eb6ac5d39ddc77c826fff724a2ef3e3b491760630acc3c8181eb7bd331502e
MD5 7f59f1011306c286eb25cd1896cfae59
SHA1 2afe29509ab6493fc07a0f84e83115ae5cad372c
SHA512 2eac77964adaa62ad4e16d8d7a767d78fa14aa68fc9f2481680e2502d604757fd6cedd900c92e5ab2569586629b4f25779c813a4b913f3b8d8ba4e2e57182208
TLSH
T1C17173390A0E04A3E3714173A5F2024A713ACAE7FA1BAE7725F44E763A14F6583B45D5
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588671.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe588671.TMP
Size 3KB
SHA256 3766a78d7a3240cbdf82e25d8c53a278017cc3d97b6174f3fb4adb1d3ce2a648
MD5 6b04041b521abfac80a94112579e73e1
SHA1 3c5762b7e6f6ab89c1d23aad5b586b0a0fcffc75
SHA512 6587ad2b3c4789e763603887a98f42f6433a71e822f8f86fd02e8717bca96a9dbb13cc418ab9fc1f90676da3c529365872683a3fc12c386d8d94573be229273d
TLSH
T1AD7173390A4E04A3E3714173A5F2024A713ACAEBFA1BAE7725F44D763A14F6183B41D4
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 5e9e47b120ba27870693abb70709c8bdf05592b051f6ff01046382aa759a21ae
MD5 f4afdb14f5ecfad566a649d0ac19cd39
SHA1 7d67a88f66637717be698f55966cb5f46c775d90
SHA512 16a3521ad5598a5b3b88901f543b1cf5456a1c6745814b9fbe9fe508008899d36b46490472ffc3ae781ea43de05e14071945622279ad36df99af63aea085ddf4
TLSH
T13921ADF787A196AEDA1156F09A14AE2BCE1C0515831C7C6A86D4FF67D3F3071E001A5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 87a8616fcd2c980dea8e8e20f906c33abd7041feb4737a80cf23274210e60932
MD5 2417182e86a020db908b26a340503be6
SHA1 fed0c7cc0a51140b3e601e09fcc8f19e21ab3940
SHA512 bc26b193e5bed2376c68ffabb366ed5e1fea99b46e434bd87ea8c46e56e2643cc63eadf564e715c56385745cbf5ae2bc63604a048dff50c017f008aa1dd4a217
TLSH
T13C11ADF3C3E595AE8A1116F05A18AE2BCE2C0505431C3C29C5D4EF2BE3F3075E00199B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 2899fbc284622946a75fd6d2226659f08aecf5b2949ab0c8db5980653aa88649
MD5 a4c1ead1deea0e9009206d8d2c221c95
SHA1 c2714d189a88246725dd6f7db8c5ef17fe42dbaf
SHA512 fe8d5851241cab1e31ddc24e18e8c26cbb06bfc9387ebe1fab433b8c5260d81ff8d38ef7879aaaaca8e9bc75424d30d8c9f626f3e443a020b250d349640d9bfd
SSDEEP 192:sxZWRYyM/jK1Ml8Mkp/fhso/AIIdpFfHW6+WNqFS/YzJgQ+GIgrJ:sxZWuMp/fhso/+lHbJ/Sd9
TLSH
T1AF42FA126A349977CCDBD209FA45BB53D6F91473E2940D54AAFCDA1C00E6AED2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 6e2d0d6d756ca6e1216e96d6cf329eb602cbc00d0a4aa27082693faeba2d9804
MD5 869650351ea1766c64a43f075463f1a9
SHA1 04ae01e32f5e065ec0ecadeed18ec8c8aa5ea8d4
SHA512 c0a4ae4f45f39344c3dec591f212881ae8262da58dba1baa17378190b913f031fc91f2a121b18746d4e55c6257ec372e856fe3f144af2d73472c91d65ae45e0a
SSDEEP 192:sxZWRYyM/jK1Ml8UQskp/fhs8OAIIdpHfHW6+WNqliXYzKLQ+GIg5HJ:sxZWuq3p/fhs8O+/HbxXIdz
TLSH
T14E52E8126A349977CCDBD209FA41BF53D6F9147392940E54AAFCDA1C00E6AED2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 9740acf8faf88741a7c3847bb4b04b93551cb8e5ffac2ed5213f182e82101656
MD5 7dd92905a274da4fa1bfe2d8a7c8ac22
SHA1 e6ff7003b1dcf484abc50c91825d7aba9b31f942
SHA512 1edc788fc5b28d0f77cdeb5254a62d6b6b1ab8d2af8d964777c601ed6d665a6c05d82ddca77824392c3627f16ada17c866a5e575a6c7f8d2f2b12c773a0b253a
SSDEEP 768:LaW7kf0Wvqida8F1+UoAYDCx9Tuqh0VfUC9xbog/OVX5LlWYSjkroIaizY8:LaW7kf0Wvqidau1jaa5LA3jvV8
TLSH
T100D20A3B680CCB7E4F841E5CEC266F976ED801CB66988D5487FA884C03CB6EA51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4520dadc-db5b-4f2e-9026-0b551f142464\index-dir\the-real-index
Size 1KB
SHA256 25b51716c7080e9d2ec037eec3647cc21fa67864f2a263e276592a9800a6d44b
MD5 695c69ad9bb4654bfc5609d233c201a0
SHA1 49d2b08eacb99ebd62645bc9500d021ec6e9d698
SHA512 3bd8a3525b71538c565ae0d132ecfcd3c54a1efd8ea3935c6a4f98005b2731264acd24f50e2d7ddbd9e10dfba8727cfd99623110e7e45403c60a513446d82278
TLSH
T13531518A8E41D56BE9E444F214B730B433B0C9CC172162938C3C21363C663AA2E4B18C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5cd5c6.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4520dadc-db5b-4f2e-9026-0b551f142464\index-dir\the-real-index~RFe5cd5c6.TMP
Size 1KB
SHA256 fbac656f79d736afefbbdfee0e7ea078ecdf3d8c3b67df35a4cb23b438ec22f6
MD5 1744ce3d3fd2d1a140c296073b01b8c4
SHA1 6635189836a13be2a048475ef6719c5da8dca480
SHA512 bb4e2cfb2522d6be78e2537da5fd31a477b8fcdc301a344db92d7f8cc6d8970b07b661edd2d01630af96adfe387cf777b2aa240c042a0c2f01821bcdb0535ef1
TLSH
T14331B68B8B458A0FECD400B20693A0B83379D840531273C3887C62397C357BE2E5F0C8
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 c6a7989331c3444e6b934f762b575fdad249954a6000c358ddc5e8c830db4c35
MD5 f91ed5a6e7cef9fd491f85a1cb71735b
SHA1 7d907ca0076397d11503c81364214fc99a5a7990
SHA512 b66ac2078f30a16bb19c688e778c667cb0f08f4d0845671ab5bce59a0c14cbbd1689e7bb3a5d6e3dcc0943e56e347e985c7e0e56edd413d332f0522d799ea2a3
TLSH
T16BE068BB2DFB1830AC6F87C138B154A082853918D500EC0E3027A28730F2752240AC21
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 08181f3aed60c77f83e3892598d8ee0cdfadadf1b9d22271cbf03a992b5a2276
MD5 1676513243de2fe15f21c7ba2fc6f501
SHA1 dfb6dcf41de3d4ec29a634ff7ea9c81b09ca52bf
SHA512 0561244daf18735ac3e3d554bd49ff357d3882e78aabae154837b79071c55746f42db6726eeb7232709465e75ac40311c3bca78b28861cdd2ea90c616b054add
SSDEEP 48:KfSVOyIQA2aQL9IZy2KYTbwIbKxK0nyNHIhKEIcs1IZKmG:KIbCKcbwQKxKmmH6KEIT1WKmG
TLSH
T1AB917715747A1A923CBE2889A19986375F423163321874AF7FF404764E6BE620DFD8DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59231e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59231e.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 97dbf167bb2db480c05591b58357ae2558d3e29c9d7dd80897223ac1d62a6aa2
MD5 6b00fab1e8ceae39d448a534b057895c
SHA1 4f46b986c081e831ec0df464ea7eb76639e211f1
SHA512 c14277ad44017725d3d7302f3ea272ee3fff53b8546a18e4f83485e2b12e5c4c201994aed038110b2db1b26d64d7f774509b163281f7b39355f07677ab8a62ae
SSDEEP 384:AiF4zsNG8TUNTUlIlVxkYbT715CsmF+23jSPd6HlytEDq1/W8:bFE9wg33JYjlWloy6Dq1W8
TLSH
T162B2F7F248E7893AD96E5743E77D3D038EBCC067B5946A50B7886A1CCC8A1BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 8773acd207ee9275858db2bf21f9194bb30eb72e83127b492592dbaf34071227
MD5 f69419c1527f40b1aae3f95aa582cf69
SHA1 e622eb661c1a3aca209f5f0a97aa4d21ca1ff387
SHA512 cacb9847c967ca15e8756e5c0d527547f334f2fcc7dce5b4b501fd3ac476d06c8765ab7744e9d15ed3ca2387d7f81473a2eab19c17a2a57d5b6fddf5cd0c071b
SSDEEP 384:AiFiZcIszsNz8TUNTUlIRLRYbT715CsmF+23jSPd6HlytEDq1/WK:bFQQWwgAJYjlWloy6Dq1WK
TLSH
T113D24AF148E7893AD96E9743E7BD3D024EBCC063B5949A50B3D86A1CCC9A1BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 9e777f5bbdcfa7379d33647bc0f35dd82c68ed812fabb51633a7fcdedc9f37c8
MD5 b5e3e340e05ec6cd93f7ff929d3a450b
SHA1 6f41e59c889fa78eb1b3030ff4cf560f91868bf8
SHA512 6171483523aaf6c14ec16063679a837b82492065b7015a8ba204225c98f2e5e8f4d15dc845f3c1d6c25f1aaae8ef0555925baa331527d4d0b18971a4d3f3ed8c
SSDEEP 384:AiF4zsNz8TUNTUlIRVxRYbT715CsmF+23jSPd6HlytEDq1/W8:bFEWwgj0JYjlWloy6Dq1W8
TLSH
T1A2B2F7F248E7893AD96E5743E77E3D038EBCC067B5945A50B7886A1CCC8A1BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 00166ded1040d0b0ea01471edf84d66706e4e902de7297af261de02d946c8f69
MD5 e44262095abb250602dee4989f1fea1d
SHA1 bf0d490cbbdfcd1939a97ce2635b2cb9ba68b2e1
SHA512 78b3e9892e238c6bb8548ce05559a5d1650f08766f2d0dce8c3f7d6343ac81e5cbe870cc5ff4eb5e043d0a8fb7b2965a67c55a07e0b7545c89455a99443f719e
SSDEEP 384:AiF4zsNF8TUNTUlIlVxkYbT715CsmF+23j+Pd6HlytEDq1/W8:bFE8wg33JYjlaloy6Dq1W8
TLSH
T16AB2F7F248E7893AD96E5743E77D3D038EBCC067B5945A50B7885A1CCC8A1BFD306815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 b6bc2e481c33b23394791031cc6fde2e54b9972f9121f3a5c0fa0a7744628e24
MD5 37cb1ab144d6f546019b2987a0b18556
SHA1 55fd3458c22a7f031f7aa22f6e0b4abc1f6d9294
SHA512 f28b072132e89afcbca2206e8e094acdb8909d9017d0d3070e46b26bc90faa8cbdba69182e83f19114f839c586aafff1f55cc726d4b45c29268d5e0af71320d0
SSDEEP 384:OsNEUOkYbT7+5CsmF+23jJPd6HlytEDq1/W8:OvCYjlFloy6Dq1W8
TLSH
T17D726C3198748D7A5DA7A151F48E36139FF84077AAD46F94E7DC7B2C04DF2AC230A81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 463af92d1d1c890a3dd89e317a1793a85387225539389c150c89e9e4aa14ef4d
MD5 c2e45e86cd77ec0a02d463ec5a495e5a
SHA1 9efc15991c5baca4a8f7271589cce86f5f758970
SHA512 ea42b013bf3483f769af8d9d2a10a7398d6db3099d0dde23cf9769f2977c070f22808bfabb47b065e6e9d33a8c436bf0bfb8d53c23ba039c00b68484c44d7cc9
SSDEEP 384:VsNEUVxkYbT7+5CsmF+23jJPd6HlytEDq1/W8:V+3CYjlFloy6Dq1W8
TLSH
T13C726C3198748D7A5DA7A151F48A36139FF84077ABD46F94E7DC6B2C04DF2AC230B81A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 19e6796892934f6edd7f8a644800656e689f13facfd4ad15b1503cb45790c9b4
MD5 e58c1c506f270c4a953daee17f7817a0
SHA1 d91fe2eb6d8a6630f033a5c00d767ba5018ef516
SHA512 424c84ee6c4356fb0c7e56630eec405c57a46df6b4eceff1de05d1340c68314bd8683406e48c0a5819ba68a4a64081f051c5a141cf648c0def6b9c28543f3aa0
SSDEEP 192:MONH64BAQmiUyI17W5GBPKpcCsmZaD6FU6:MONH6eAfFW9smSeU6
TLSH
T1EA020A34AC796CBB9EB3AD05F48637175FE8117FA5945F44EAE82B1C00D764C234682B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 101453fc58c08c0f6c41daf08976833c8a0a099382133c92c745448dd681ce97
MD5 661d3e8c33c3e21a40201d7860fb182d
SHA1 778dca91f35321e7bb8378b2dc9d4980f03a5fd5
SHA512 005bee8983d0f55219ac0b956e4535818d0d5a2961f0d92aff0ce6b3e514f7198586d73da55213625a26d1412b5910380dd8fffab367f864176dedf361600dfb
SSDEEP 192:8ON264BYQmiUy9K775GBPKpcCsmdb+23j6WwkqJdU6:8ON26e4gi79smF+23j4PdU6
TLSH
T184122A35AC649C7B5DA2E551F48B37135FE9412BF684AF40E6EC3B2C05EF65C230A816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

23239fc9-062c-43e2-88dd-2de555bb8884.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\23239fc9-062c-43e2-88dd-2de555bb8884.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 5a6b08810cfdd112a28d15f9430c5b2ef8d26c7181c9da8bd311d2fc5bbdad18
MD5 e55198f1af1ba525fc8221ce1b2d3cd3
SHA1 6a158ae2b9befbf7d6f97d9dacfc0f3c4c381140
SHA512 0db3de9ce993cfbd898c0fe16ec5e6dbd3f61464ea9ae86b308b2f5929eb18e85a39c4a62b97c676f54acdb09726b720d6b96f329e8c091550520d4ba4a0313d
TLSH
T189412858B6F91148B3B77E4AABF6A46E447FBD772E06D44D10100D4F0A67B40C8A1737
MD5 SHA1 SHA512 TLSH

Submit Download