hxxp://34[.]196[.]3[.]244

Analysis

user interaction
yes
max time kernel
329s
max time network
333s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/08/2026, 00:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://34.196.3.244
Sample260813-apsp6swvht

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4152	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134310542334512445"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2370214745-1838013427-2987045292-1000\{1A12E12F-3C86-4EA1-A18E-89041C8B4A07}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2370214745-1838013427-2987045292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4044	msedge.exe
4044	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 7 IoCs

pid	Process
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe
1332	msedge.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 1332 wrote to memory of 1504	1332	msedge.exe	85
PID 1332 wrote to memory of 404	1332	msedge.exe	86
PID 1332 wrote to memory of 4152	1332	msedge.exe	87
PID 1332 wrote to memory of 404	1332	msedge.exe	86
PID 1332 wrote to memory of 404	1332	msedge.exe	86
PID 1332 wrote to memory of 3572	1332	msedge.exe	88
PID 1332 wrote to memory of 3572	1332	msedge.exe	88
PID 1332 wrote to memory of 3016	1332	msedge.exe	89
PID 1332 wrote to memory of 3016	1332	msedge.exe	89
PID 1332 wrote to memory of 3016	1332	msedge.exe	89
PID 1332 wrote to memory of 3920	1332	msedge.exe	90
PID 1332 wrote to memory of 3920	1332	msedge.exe	90
PID 1332 wrote to memory of 3920	1332	msedge.exe	90
PID 1332 wrote to memory of 1732	1332	msedge.exe	92
PID 1332 wrote to memory of 1732	1332	msedge.exe	92
PID 1332 wrote to memory of 1732	1332	msedge.exe	92
PID 1332 wrote to memory of 3864	1332	msedge.exe	93
PID 1332 wrote to memory of 3864	1332	msedge.exe	93
PID 1332 wrote to memory of 3864	1332	msedge.exe	93
PID 1332 wrote to memory of 4188	1332	msedge.exe	97
PID 1332 wrote to memory of 2928	1332	msedge.exe	98
PID 1332 wrote to memory of 4188	1332	msedge.exe	97
PID 1332 wrote to memory of 2928	1332	msedge.exe	98
PID 1332 wrote to memory of 2464	1332	msedge.exe	102
PID 1332 wrote to memory of 2392	1332	msedge.exe	109
PID 1332 wrote to memory of 2392	1332	msedge.exe	109
PID 1332 wrote to memory of 2392	1332	msedge.exe	109
PID 1332 wrote to memory of 888	1332	msedge.exe	110
PID 1332 wrote to memory of 888	1332	msedge.exe	110
PID 1332 wrote to memory of 888	1332	msedge.exe	110
PID 1332 wrote to memory of 4196	1332	msedge.exe	112
PID 1332 wrote to memory of 2280	1332	msedge.exe	113
PID 1332 wrote to memory of 3060	1332	msedge.exe	114
PID 1332 wrote to memory of 3052	1332	msedge.exe	115
PID 1332 wrote to memory of 3052	1332	msedge.exe	115
PID 1332 wrote to memory of 4044	1332	msedge.exe	118
PID 1332 wrote to memory of 2692	1332	msedge.exe	119
PID 1332 wrote to memory of 2692	1332	msedge.exe	119
PID 1332 wrote to memory of 4756	1332	msedge.exe	120
PID 1332 wrote to memory of 4756	1332	msedge.exe	120
PID 1332 wrote to memory of 3624	1332	msedge.exe	121
PID 1332 wrote to memory of 3624	1332	msedge.exe	121
PID 1332 wrote to memory of 3280	1332	msedge.exe	122
PID 1332 wrote to memory of 3280	1332	msedge.exe	122
PID 1332 wrote to memory of 4404	1332	msedge.exe	123
PID 1332 wrote to memory of 4404	1332	msedge.exe	123

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://34.196.3.244
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2a8,0x7ffa5408c188,0x7ffa5408c194,0x7ffa5408c1a0
  2⤵
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,17908347915794148685,15951832171591391850,262144 --field-trial-handle=2164,i,12905948275531228264,2675771092464292709,262144 --variations-seed-version --mojo-platform-channel-handle=2160 /prefetch:2
  2⤵
  PID:404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1916,i,1056241197108090494,6788918911399422327,524288 --field-trial-handle=2164,i,12905948275531228264,2675771092464292709,262144 --variations-seed-version --mojo-platform-channel-handle=2196 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4152
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2580,i,14275717459855532656,12557724476147977834,524288 --field-trial-handle=2164,i,12905948275531228264,2675771092464292709,262144 --variations-seed-version --mojo-platform-channel-handle=1720 /prefetch:8
  2⤵
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,7633270622353949350,18225536165459121427,2097152 --field-trial-handle=2164,i,12905948275531228264,2675771092464292709,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:3016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3456,i,13425793956431056190,2365368818057607356,2097152 --field-trial-handle=2164,i,12905948275531228264,2675771092464292709,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:3920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4180,i,7804196671278761576,14735197510611747505,2097152 --field-trial-handle=2164,i,12905948275531228264,2675771092464292709,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:1
  2⤵
  PID:1732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4200,i,7246913171620004622,1508079587015861969,2097152 --field-trial-handle=2164,i,12905948275531228264,2675771092464292709,262144 --variations-seed-version --mojo-platform-channel-handle=4304 /prefetch:2
  2⤵
  PID:3864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4964,i,18350756881918580190,9748974465419696706,524288 --field-trial-handle=2164,i,12905948275531228264,2675771092464292709,262144 --variations-seed-version --mojo-platform-channel-handle=5148 /prefetch:8
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4544,i,14454132779552888497,2279227620600399022,524288 --field-trial-handle=2164,i,12905948275531228264,2675771092464292709,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,9976218604025910871,13517561109942071513,524288 --field-trial-handle=2164,i,12905948275531228264,2675771092464292709,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:8
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5804,i,9976218604025910871,13517561109942071513,524288 --field-trial-handle=2164,i,12905948275531228264,2675771092464292709,262144 --variations-seed-version --mojo-platform-channel-handle=5824 /prefetch:8
  2⤵
  PID:2464
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4316,i,2034541319215215665,13568336997973454962,2097152 --field-trial-handle=2164,i,12905948275531228264,2675771092464292709,262144 --variations-seed-version --mojo-platform-channel-handle=6208 /prefetch:1
  2⤵
  PID:2392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3456,i,7184263359950217462,12406640941426232358,2097152 --field-trial-handle=2164,i,12905948275531228264,2675771092464292709,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4320,i,6531994532587609749,17331889766772168998,524288 --field-trial-handle=2164,i,12905948275531228264,2675771092464292709,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:8
  2⤵
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5676,i,8735563271325293989,15688274564644955072,524288 --field-trial-handle=2164,i,12905948275531228264,2675771092464292709,262144 --variations-seed-version --mojo-platform-channel-handle=4268 /prefetch:8
  2⤵
  PID:2280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3716,i,4994257582746287806,7251106137953695901,524288 --field-trial-handle=2164,i,12905948275531228264,2675771092464292709,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:8
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5184,i,1375527093556318243,5139506531053192434,524288 --field-trial-handle=2164,i,12905948275531228264,2675771092464292709,262144 --variations-seed-version --mojo-platform-channel-handle=5744 /prefetch:8
  2⤵
  PID:3052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6084,i,14532295442937763510,5242960819390130572,262144 --field-trial-handle=2164,i,12905948275531228264,2675771092464292709,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5496,i,16184299245408577286,14290452833653526735,524288 --field-trial-handle=2164,i,12905948275531228264,2675771092464292709,262144 --variations-seed-version --mojo-platform-channel-handle=3964 /prefetch:8
  2⤵
  PID:2692
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4984,i,17156065289395552393,14209626803624823696,524288 --field-trial-handle=2164,i,12905948275531228264,2675771092464292709,262144 --variations-seed-version --mojo-platform-channel-handle=6196 /prefetch:8
  2⤵
  PID:4756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3968,i,11100975766536049173,11588852356229504676,524288 --field-trial-handle=2164,i,12905948275531228264,2675771092464292709,262144 --variations-seed-version --mojo-platform-channel-handle=5204 /prefetch:8
  2⤵
  PID:3624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3620,i,11843008974876643690,17433342561023222631,524288 --field-trial-handle=2164,i,12905948275531228264,2675771092464292709,262144 --variations-seed-version --mojo-platform-channel-handle=6332 /prefetch:8
  2⤵
  PID:3280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5472,i,6553622782811363645,15660951779977168069,524288 --field-trial-handle=2164,i,12905948275531228264,2675771092464292709,262144 --variations-seed-version --mojo-platform-channel-handle=6276 /prefetch:8
  2⤵
  PID:4404

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 a8557436792d10423e36183e9c26745a47246781bd6b0f1545a1b710eb834b61
MD5 11ff8da3b3d46ec7c5363da75461ac70
SHA1 84baea46df7c0bb207999ec416f62a82a4f8571b
SHA512 c7322e3c16d8fe36dff645695adde0462fa169f6abf075440d7f474efed676abe93e10afe7e0e7e18728a337596e6769534da2acfc9b1079c8821dbf4a35e6e3
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7s:fwUQC5VwBIiElEd2K57P7s
TLSH
T1ECB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 a612efa1a3f1d4ee262abb96d63f3b4a31c2ad6c544574be7246db0f52212e1d
MD5 e0045423d265fbb4204e2ccf9cf4e729
SHA1 5cd430c76a965b7d49eb6f686349a92180871674
SHA512 e0fe72d7795acfb0a22d0da2bf0fda4779e67429fc7f0868abc95950b557948a8b07360e9f45a7446cbe79ca28b10086e9e6f63cce1bc4e718efef8261f1e913
TLSH
T11BD09B55754D7415D31B01315411E360955A4462A172D2457120440DB97C81857E5257
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 6KB
SHA256 e52929c9becb61bf3271572eab8a96d7eb7c21dbc54743505c6efc2f233a344e
MD5 7c4b5a387599e6c2fc281fad66de0991
SHA1 206247b3493c5b221e7bba89a3469c3803220b82
SHA512 5d5fab2915ce30ab300a08b94e17c83419113b6c48e628f7f245440d1d064adf4adc7589ab04ca6327bd666688515729edf6ab0169aeb688313462d42f6b2d09
SSDEEP 192:NyjoOmtm6KmupuDuDuUuUuUududueueueu3u3u3uZuZuguguguguguWuWuRuRu+V:NyjoOmtm6KmupuDuDuUuUuUududueueW
TLSH
T125E1C90682D5D69ADF0630CB4DA1739C00B1374DEBECE5481BDD8DEE304E8DEE5A66A1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 83f6236dd6ba60d783d88ca11c91e2d6194acf887bc434eacfe38a3981c79dd4
MD5 2dcbaa899f9404ec2e60f9d0b37b6430
SHA1 7e1226bc25c9f7d7ec9664c1926bb055bb02b402
SHA512 4081211050cc1f9f3380593ded5832edd16ae963d3d3855364fc99683d59da7f570a00d75c254e3d9581a60b5228168b1019ac171ece5e8a92fde17ee826be9a
TLSH
T1F5714EF912AB34A1D7248230D4D306FDB4774455DB237E51C1009DBC6AC6BD993EEC18
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 e17a9c478b52cb774e57bcc729ed2161d93894c1e5674874f3b288fc3967fab5
MD5 a12e08f0cf37d69b4ab8a412ceb8902e
SHA1 eee5ffb33484aeecca51941ffd551bd75efc4a8e
SHA512 60166ba21308ad4df830c00e70bd3f4b7e6810bbc55cf7569aa3a19279d48141b1c3ec7b0b56cf6bb354fbe8ef3f8261e9772b1015a35ec66f95175d54387a1f
TLSH
T1C67170F912AB3460DB609230E8E305FCB4774055DB237E51C2409DBC69C6BD597EEC18
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588d57.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe588d57.TMP
Size 3KB
SHA256 33d0ed9cee06d60188f685c7514ebf6b030f2d0738e7672c729001a50f3d0489
MD5 55c0b365b6d858e3d1e3565790fdecd5
SHA1 23035c53fe9ff2073f2717c5922f2719c8639fd1
SHA512 7a9d18dccb491d475bae38ba254d4ea7cc94e932bec6f90961dbcfa747617e98a480031c8d85df43de93b6ef74debdbd49d3d7bec04c35a61f548659a2e29251
TLSH
T1C8714DF912AB34A1D7248230E4D306FDB47B4495DB237E51C100ADBCAAC6BD993EEC18
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 2d4ecafd7e74fb5bc5b0fe7d5fbabbe57bfa52b3eed6b5854b452712c9d51859
MD5 ed55bb4d953616001d8970d6b31bc6fb
SHA1 4fdb2ed04937245389ab1c8ce4748e09e8de44be
SHA512 590e198ff894b90d756a444dd4f143ef778e9d04576fe65d9b42a36fa8a135a35279639c414ac0e5e30e7beb2f24be97a7bae323d60ba2d207d660e209c3881a
TLSH
T113318BF787E4C63D8D1166F46B296E2FCE1C051943287D29C9E4AE6F9BE2470E10164F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 e47f6737b3cbf762878c6b6efbd8b99a3eec7b285d268fd49b5887d98715d7d8
MD5 75002d03815f6038e860e8cc13365327
SHA1 87cf0984054552b4fbd4a9dce6413f81452fb100
SHA512 59b7ea8f25e2e790737c4c504c6940a78e028427fe9468db4260d7b487c85abe6aef5b924daf527a428ce3b04c0db10d711c48af9d6022538ee9118323d9888a
SSDEEP 192:sxZoRTyM/jK1Ml8Mk4/flssfzIdpJHds56+WNGYHl+n8ZIgrJ:sxZo/M4/flssfsJHddGe9
TLSH
T14242E6166A34A977CCCBD20AFA457F53D6F50472A2940E44A9FCDA1C04E6AED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 ecba6fa6e340c2bb105d9f3a8608bdb7f1e4063de9a41c5446499e1d5ad20900
MD5 8107b72d3f9b123acb1ec1e766fcb081
SHA1 9422aac681302439eda26a65a6074466b1c4fe35
SHA512 6ef56abfe6c07c6b0f96f8fef0a44d95f75a87533c87e1a35678d802888ef00a16d4869a219f5b17f2995e42d3b28a1eed3f3c4b07c15d1827ba4a3c2bd1663f
SSDEEP 192:sxZyRTyM/jK1Ml8UQpk4/flsru5IdpG5HdsB6+WNEyM/YHH+WHZIg5KHJ:sxZyZqq4/flsruSGHdVe/AY
TLSH
T16652C615AA34AA77CCCBD20AB941BF53D7F54472E1941E44A9FC9A1C04E6BED2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 ecb7ea8a2ef509bb63ea94b6473e95b5c17af85caedd0864cd44fe66cc3aca07
MD5 e016a642a7a80285ad147950267b9920
SHA1 63e609f4db8bb2dde3bf71ae1d31517cb54441e4
SHA512 982ec1e0979f1b5af932e541bad53f75bdf59103a9a72671b0d62ab58ae541d34617c1ed931b2c0b263c5da02e6d797a9d03c7d818cbac32ff07d4a01063cc90
SSDEEP 192:sxZyRTyM/jK1Ml8Mk4/flsru5IdpG5HdsB6+WNEyM/YHH+W8ZIg5KHJ:sxZyZM4/flsruSGHdVe//Y
TLSH
T19652C6156A346A77CCCBD20ABA41BF53D7F54472D2941E44AAFC9A1C04E6BED2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 f2835357270758696bf6db7a14052ba002ccd373c8312fbfdc55e5030885d5a9
MD5 50229a57127aa49427d762e088f77ed3
SHA1 d18fb106e67f333076140259c0177bb0bec76fcf
SHA512 0d98b2a5d1b036482a9f7d04ecd75edbeabbacbdfc130f65ce1ae9fc9a857186a3aac96bb0a91deba2097f18e38d9f3cdba59fca6c1750d817ac167fc0ee2f3b
SSDEEP 192:sxZyRTyM/jK1Ml8Mk4/flsru5Idpk5HdsB6+WNEyM/YH9+t8ZIg5KHJ:sxZy/M4/flsruS0HdVe/gY
TLSH
T11D52C5156A346A77CCCBD20ABA417F53D7F54472E2941E44AAFC9A1C04E6BED2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 581510dc430c429eb62a3523af6a27aec297705b5aa2d696a8a9a7ac55806b39
MD5 60945a842a2bdc241dcf02cf26a99abb
SHA1 e371426c24ce745ebee8a64ac6d53d4dae384da5
SHA512 89476e6c86423598b6ef14dc12634632f509eba2fc86fbc65e929ab9639f49086985eb4161afdf3083688ab4cd65abbca16405f8d7957b3aee1a3e650bcf9676
SSDEEP 768:PWUZYTMWvg0Po8F1+UoAYDCx9Tuqh0VfUC9xbog/OVOeLlPZ4RhroVo08:PWUZYTMWvg0Pou1ja7eLZmRa58
TLSH
T10ED21A3F284CCB7E4F844E5DEC266F963ED801CB5A584D5447EA884C02CB6EF112759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 b98efaf3a7ccafafa0ab95d5fd427137306031775476180cbedfaae3af7d324f
MD5 4771a2e72cd6d3d0b6838c6ce8ecc775
SHA1 df9ebdf27c9413e5d0a707a4bb2b7a2371f15fb8
SHA512 05fdea1b57545d836c9f66fb09d8d16745b0dd985a1fdf0989e0b1f89caeef541f54df742e2daf1d5ba5ec0fc25db72b42a4ab2818d0cc50a5ecfe0d57055654
SSDEEP 96:KA1eK2Aoz2Ksom9WB9v3Hm1XoNX+TKvKX4Tz8UDS6wqUti+sOSb1iTqXmbKviXQi:E0BFlL
TLSH
T1EAB1260332B712433C3D2908A2A9973B4B45F1937424A4AB7FA944B25D66E741DFD8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 bb72a9551ad5fdfe505959a536b0c2d6dfcbc35613619a5fcd61946d11498c4a
MD5 ee7773603bf11faa055627d9f5bf0558
SHA1 40d4cf96f3106eeae760f270479f5f137760803c
SHA512 c2339530c944442fe52c9b7d8d5c3bd2b5d5fbf495cdf2b60f1bcafb2f36cbf002a7031fcb965d9e7d46c01f23b7d943dbe7e286a7f7ae152bdda3ef35975a88
SSDEEP 192:u9LsNHl/QaHQb5LGAtzS5rQmiU1pBT4zX5Obd+juOFm0beD4QxEq+U8:KsNH59Q1LRzQ1czX5od+KOr2xcU8
TLSH
T144320A366868BC774EE2B545B44736139FB41137EA897FC4D2EC2A1C01EB69C231BD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 4a7d8a744bc9999c335ac819a84c890d99381baa94f114b47d0e83e637b64b69
MD5 5cec4b0783798018142b1da0cf2fdf0d
SHA1 00436a8ca88f9e5c7c0b294a40a3e9b54c1a5aac
SHA512 6d7db55581488bacc377980a98b0dffc9c84e2891230870f6d4a85ecd140f51eab02a98cc02f92cbfea394d0a95fe494828a557ce97c05a238f86f4820d9954b
SSDEEP 384:pqZcIYsNHU9Q1LRzKyczX5od+KOrkxcOOPrXLpe8C/G:qYLuLp7UOzOrkxcOi9Pd
TLSH
T106C229F154EB6836D9AEA747A77E2D034EBCD023F1842A8473D85A1CCC9657FC306822
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 39eaf2bcdf0c5164d0c58acb98fdd0878212807cb40499ab2b77c70c7e350a20
MD5 da56e0145748b4ef0db5c355f0c4b694
SHA1 5496cd500ae3c5692cde259a93c363805ac38e17
SHA512 b5d4404248fa6cbb6f1b83e6a87b62fad6c39bcac652a31f4608c2fc498593a81fa94cd11e3d2dc65736be3a5091f6e6ac2fc18d079185cf6b99fd697620e780
SSDEEP 192:yONc61VWQmiUyC7gGX5Obd+juOFmI/axU3s5U6:yONc6WbgGX5od+KO6x35U6
TLSH
T1E102E83569687CA78EF2BE49F48737135FA8217BEA546F84D6E81B1C00D765C2306C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 452c0e1adfe9b263756fe23990364c29d8f8473c820d258be5781ccd3a3d8366
MD5 ea9558c3152cf72afb4b867a9fe705b3
SHA1 474d7867857b65a7c8e7a486ed9ef9503aef4f33
SHA512 c883b1dd9b139125b9496cb022eb8f8b4b1c20fdf5ccd35056a52d7aec07d5ab90a7d6e4912727c4cfcd337d23e59bea7740d6169b298327a08f2d249e2a08ec
SSDEEP 384:bZcIdsNHU9Q1LRzK1czX5od+KOr2xcOOPrXLpe8C/G:DdLuLpYUOzOr2xcOi9Pd
TLSH
T159927D3168A87C679DF6F686F94226139FF85077F6C82BC492ECAB1C01DA59C1307C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

aa879321-c73b-4f8b-a0f8-fb194c2ca349.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\aa879321-c73b-4f8b-a0f8-fb194c2ca349.tmp
Size 8KB
SHA256 5b944bf23c9cb8947f27bd476239f1f5c22f25910cba63019faadcb852838bc6
MD5 b9309f45681526ffbadfba909c3216d8
SHA1 f3a387090c0532443069813c4e93548ccb17f593
SHA512 4b060963048773a65e46fe89bc4cea4a20088c1240c8c7b8ff2a66aaa90b154fe6340dbfc5b5b5ddab176d7d4bfce31c1df2b93aec42dcc609b488098ad4ab76
SSDEEP 192:0ONy61FWQmiUyT7MGX5Obd+juOFm0beDjJxEq+U6:0ONy6GkMGX5od+KOrgxcU6
TLSH
T10E12F93668A8BC679DE3B585F44735135FA55177EA887FC0C6EC2A2C01EB69C230BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 228e8efb11d8c81f88bf8c5ab3759bd700e24dd77f92e19a53f465b5bf4f991a
MD5 ab22d0793653c7b965c1161ce202a9f7
SHA1 964ae7f9074ea9473519968bbd5b9679058180cb
SHA512 39887596a58e58dbb59d51142017a82534f368ad4511dc56131bd0bdb9e4b925a823be0d220fa4f99f3cfb7934064a4c00d8b65bb5b54f52a9a9f8ad0942cb03
TLSH
T1A8414C9CAAFE1108B3B76E16EBF6A86D487F79672E06D49E10110D4F0623A01CD61B37
MD5 SHA1 SHA512 TLSH

Submit Download