hxxp://example[.]com

Analysis

user interaction
yes
max time kernel
900s
max time network
734s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
13/08/2026, 20:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://example.com
Sample260813-zbfacsyalg

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4608	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134311267714829412"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{8E731605-946B-4794-AF3E-6D5B5D8FF291}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3668	msedge.exe
3668	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe
964	msedge.exe

Suspicious use of WriteProcessMemory 47 IoCs

description	pid	Process	procid_target
PID 964 wrote to memory of 3320	964	msedge.exe	85
PID 964 wrote to memory of 2024	964	msedge.exe	86
PID 964 wrote to memory of 4608	964	msedge.exe	87
PID 964 wrote to memory of 2024	964	msedge.exe	86
PID 964 wrote to memory of 2024	964	msedge.exe	86
PID 964 wrote to memory of 3768	964	msedge.exe	88
PID 964 wrote to memory of 3768	964	msedge.exe	88
PID 964 wrote to memory of 3336	964	msedge.exe	90
PID 964 wrote to memory of 3336	964	msedge.exe	90
PID 964 wrote to memory of 3336	964	msedge.exe	90
PID 964 wrote to memory of 536	964	msedge.exe	91
PID 964 wrote to memory of 536	964	msedge.exe	91
PID 964 wrote to memory of 536	964	msedge.exe	91
PID 964 wrote to memory of 3772	964	msedge.exe	92
PID 964 wrote to memory of 3772	964	msedge.exe	92
PID 964 wrote to memory of 3772	964	msedge.exe	92
PID 964 wrote to memory of 4496	964	msedge.exe	93
PID 964 wrote to memory of 4496	964	msedge.exe	93
PID 964 wrote to memory of 4496	964	msedge.exe	93
PID 964 wrote to memory of 4032	964	msedge.exe	96
PID 964 wrote to memory of 4032	964	msedge.exe	96
PID 964 wrote to memory of 4032	964	msedge.exe	96
PID 964 wrote to memory of 5112	964	msedge.exe	98
PID 964 wrote to memory of 2168	964	msedge.exe	99
PID 964 wrote to memory of 5112	964	msedge.exe	98
PID 964 wrote to memory of 2168	964	msedge.exe	99
PID 964 wrote to memory of 4460	964	msedge.exe	101
PID 964 wrote to memory of 4448	964	msedge.exe	110
PID 964 wrote to memory of 4504	964	msedge.exe	111
PID 964 wrote to memory of 2736	964	msedge.exe	112
PID 964 wrote to memory of 4880	964	msedge.exe	116
PID 964 wrote to memory of 4880	964	msedge.exe	116
PID 964 wrote to memory of 920	964	msedge.exe	119
PID 964 wrote to memory of 920	964	msedge.exe	119
PID 964 wrote to memory of 3668	964	msedge.exe	129
PID 964 wrote to memory of 408	964	msedge.exe	130
PID 964 wrote to memory of 3496	964	msedge.exe	131
PID 964 wrote to memory of 408	964	msedge.exe	130
PID 964 wrote to memory of 3496	964	msedge.exe	131
PID 964 wrote to memory of 1612	964	msedge.exe	132
PID 964 wrote to memory of 1612	964	msedge.exe	132
PID 964 wrote to memory of 2104	964	msedge.exe	133
PID 964 wrote to memory of 2104	964	msedge.exe	133
PID 964 wrote to memory of 3480	964	msedge.exe	134
PID 964 wrote to memory of 3480	964	msedge.exe	134
PID 964 wrote to memory of 2524	964	msedge.exe	138
PID 964 wrote to memory of 2524	964	msedge.exe	138

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://example.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffcee24c188,0x7ffcee24c194,0x7ffcee24c1a0
  2⤵
  PID:3320
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1880,i,5740871043790486572,11404812896281158971,262144 --field-trial-handle=2268,i,4322299571339440124,6471851343560755744,262144 --variations-seed-version --mojo-platform-channel-handle=2248 /prefetch:2
  2⤵
  PID:2024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1976,i,8342854506486717628,10505586568845516030,524288 --field-trial-handle=2268,i,4322299571339440124,6471851343560755744,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4608
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2568,i,8977394895392093754,8458842533094873518,524288 --field-trial-handle=2268,i,4322299571339440124,6471851343560755744,262144 --variations-seed-version --mojo-platform-channel-handle=2580 /prefetch:8
  2⤵
  PID:3768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,15944304181604734136,8372710145861693884,2097152 --field-trial-handle=2268,i,4322299571339440124,6471851343560755744,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:3336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,5887808691159731480,12970115332501247515,2097152 --field-trial-handle=2268,i,4322299571339440124,6471851343560755744,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,4484088230447829199,17830335768113366778,2097152 --field-trial-handle=2268,i,4322299571339440124,6471851343560755744,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:1
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4280,i,157368195900541660,6826037610024416266,2097152 --field-trial-handle=2268,i,4322299571339440124,6471851343560755744,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:2
  2⤵
  PID:4496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3604,i,850803793175565620,8569971114348580875,2097152 --field-trial-handle=2268,i,4322299571339440124,6471851343560755744,262144 --variations-seed-version --mojo-platform-channel-handle=3684 /prefetch:1
  2⤵
  PID:4032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3460,i,3219645351202372925,8906769408735027320,524288 --field-trial-handle=2268,i,4322299571339440124,6471851343560755744,262144 --variations-seed-version --mojo-platform-channel-handle=3584 /prefetch:8
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5216,i,14730474650598984897,704036112985949570,524288 --field-trial-handle=2268,i,4322299571339440124,6471851343560755744,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:8
  2⤵
  PID:2168
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,12727881178763135422,8497257529474417558,524288 --field-trial-handle=2268,i,4322299571339440124,6471851343560755744,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:688
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5828,i,12727881178763135422,8497257529474417558,524288 --field-trial-handle=2268,i,4322299571339440124,6471851343560755744,262144 --variations-seed-version --mojo-platform-channel-handle=5836 /prefetch:8
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5904,i,8483514712693352498,12998942311736644808,524288 --field-trial-handle=2268,i,4322299571339440124,6471851343560755744,262144 --variations-seed-version --mojo-platform-channel-handle=5920 /prefetch:8
  2⤵
  PID:4448
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5900,i,10664521900010814772,10273974966620136605,524288 --field-trial-handle=2268,i,4322299571339440124,6471851343560755744,262144 --variations-seed-version --mojo-platform-channel-handle=5892 /prefetch:8
  2⤵
  PID:4504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4884,i,11748574335369546020,2529099050161833745,524288 --field-trial-handle=2268,i,4322299571339440124,6471851343560755744,262144 --variations-seed-version --mojo-platform-channel-handle=5888 /prefetch:8
  2⤵
  PID:2736
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5456,i,15311584307990877693,2507807543296523277,524288 --field-trial-handle=2268,i,4322299571339440124,6471851343560755744,262144 --variations-seed-version --mojo-platform-channel-handle=4432 /prefetch:8
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,4858186257147546800,9412459557952594306,524288 --field-trial-handle=2268,i,4322299571339440124,6471851343560755744,262144 --variations-seed-version --mojo-platform-channel-handle=5468 /prefetch:8
  2⤵
  PID:920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6156,i,7323847343269300202,6939744392041187490,262144 --field-trial-handle=2268,i,4322299571339440124,6471851343560755744,262144 --variations-seed-version --mojo-platform-channel-handle=752 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3352,i,17637945194105372852,16008592651278158430,524288 --field-trial-handle=2268,i,4322299571339440124,6471851343560755744,262144 --variations-seed-version --mojo-platform-channel-handle=5268 /prefetch:8
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5500,i,3862958281422692252,686522517660276045,524288 --field-trial-handle=2268,i,4322299571339440124,6471851343560755744,262144 --variations-seed-version --mojo-platform-channel-handle=1300 /prefetch:8
  2⤵
  PID:3496
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5628,i,2542398249112866494,9053980362219632143,524288 --field-trial-handle=2268,i,4322299571339440124,6471851343560755744,262144 --variations-seed-version --mojo-platform-channel-handle=6156 /prefetch:8
  2⤵
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3780,i,5674509090578356428,12511347833454480171,524288 --field-trial-handle=2268,i,4322299571339440124,6471851343560755744,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:8
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6308,i,17520007111214788437,12442697493829163070,524288 --field-trial-handle=2268,i,4322299571339440124,6471851343560755744,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:8
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3528,i,4045468071364722741,11847402904357760168,524288 --field-trial-handle=2268,i,4322299571339440124,6471851343560755744,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:8
  2⤵
  PID:2524

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2028

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
MD5 8c7cdfea4284ba987d295d82a9c7ddd6
SHA1 7d1a3a66f2d64a383b230196ba89a263ce7ee957
SHA512 59c8229e834c944265aed4131c79f41f9f940a48651b9fb18800cef5bae36d17c7fd5880120c6fee8ce22a157b65bc63846b65765bc4dc86e15926dcce400d0d
SSDEEP 12:sf9iXhV0xoUZxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxoUZxWMk8xVTeYWI31BtXP
TLSH
T105724C85B34498FFC8835E7189BD27903774F6DF1F02866B6A6A760E2E271C84F44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 81240d13af4ca099e1358c75991e3fa5640dbb3aac72c2d98006f6159bf74aa0
MD5 96dd753cd2d8557b97ab2cd76f7fc6cf
SHA1 81697ccb13fb04a07bd47b552b3607597251f36d
SHA512 355c412a688a71b124e85c0527177b3f97efceb2a5553f8428e0913940daffd3bd176f5476b940c64eee52d543f0568112ac073984d9a64015adc15cbef552de
TLSH
T174D09224BA29A149E282007AA881EB565219DA95296B9622E620C44DBD2B925A3851C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4bf0783d55eb083b4adaa03ed8b76a2bd35b0819c8ad2530a78e1b8d6856010b
MD5 7a50c2e276f05b686e8cb6c95b86650f
SHA1 bc892af04a9d6b1bee8047f67518d676df864301
SHA512 f1d02fd9f067323214d78de08172e1a78028eba76f4754436f4d77b849e8422865dcea22be13f21c36ac2c5807b393c1dffdb0a3217c3353a517a0467461a474
TLSH
T19BD022203A28A008E282003AA880EB020208CA80282BC322E220C00CAC2B820A3800C2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 17901b0b9acee5446808245a4eb0b9bfee9592041d4a4eb45fb12a4c7c2c5419
MD5 9f82b5e21294daab194eed800283b4e1
SHA1 4a3d579fd05480acbfa73ce68c358fd188f519b6
SHA512 96774cbe469d66c0967d4c59368b2a3d3f8a7482311730a91c0edc9620e47baf7cfef3644fe28663d9477879ef3f1144896f34a16e896be5a3b7e7db72df4074
TLSH
T139E020CA19C4C37DDA40AB4B536D434C81C0360AE2C4FA052B0084C571C2094E7C79F0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 2e3f118127f2346d0cf4099b8fe0f2cfc4b97c6237e65586760eb6e7c0353232
MD5 22f023ae8b1a8818219d1e5572430e60
SHA1 e51bf1ec677e891049163a91b7485ff7706f36b3
SHA512 400a670275522524d33421778fa8625cb0fe67918cb6d3c3cb7a437c3b471baa4501cbfb3d6383699a1e881bc8b4bb29d985b2c09ae23038e0ddcdb94131078f
TLSH
T11DE0208D45C4C75FDA506B47516E438CC1C0360FA2C5FE451B0184C57141884EA8B574
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 77f21076bd519a7d50994305f79c785d220a740bdbc8f7060de78da16b744ecb
MD5 51a6303a82a8021cae9db248e1b70181
SHA1 35f998f77a85ab8e1f5272fb9a78d77a7625c449
SHA512 ca76e7e45c318e5f193b3cfd5cf8e2067aa1dedf4b044f06c72c22e3c20fd9da703867b3f0a2228d3a929da5ec12f5a3efead3897660f2d238d8102c0eba0219
TLSH
T1E2E020DC05C4D73DFD40654761B9575C85C03A0EA2C4FA151B05C4CA7205480E2DF770
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 947f00db335b7102ede4963f1ba2e0e353bd0081f9881c85e537ca94442aa4b6
MD5 ec15d5ecc85c9ce16f8b97fbdd86453b
SHA1 81ddda7f71eb37a09d10d39aa12f50feefb5863c
SHA512 e29b5d0f16e2ee978f297a300e70a4f2899cb276b1600cc28786e496159caebdb302490717ec412f36420022526268749be690b704204900b0a540ff1fbf20ce
TLSH
T12E712836E90081F4EF25523090E3177578F7D0DCF8072EF212A728F56B28736636A28A
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589ac4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe589ac4.TMP
Size 3KB
SHA256 db6b2a1edd4df4006a6b6faee028821599f9e536e71f40355bdadb016f70d7b6
MD5 a12943e2000bef2e0a942605579a05f9
SHA1 c95c991a087316c40772927a048fe812a4c17cfb
SHA512 54893f762afc49778840ae5863e00da36ed8eeb96a5e4ca8cd79e0f9882923a33e7196ccec3bd44a2138fac4e9aba2ebb74e3749aea718d5581c42cf1d825c18
TLSH
T163710836E90081F4EF15523190E3177578F7D0DCF8072EF252AB28F56B28736676A28A
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 817B
SHA256 1d87c2f1d5b08db344ef4c31308769d23900e9b52753147303c6b33d9e67de27
MD5 b6fcf6214dc925a77ae21e785d22477e
SHA1 e2bcd8d1e601ee8b334ad15deb82c4e11a3a4c36
SHA512 406e535e0b67b28f96e45a1c983643426dfe05a18aac70f83e410dc7c82ad841b90fd418865c260dbf3c80fd9f08d0361a0ba0d654caf693fcd257605f4d4c10
TLSH
T154016BF383E1866E890156F09A28AE1BCE2D0506431C7C29C5D4AF2797F3576E001A5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 e673ff273abc94b6438bd894bab46d2f9bb87efa2ac663eb2f9f4372625f2900
MD5 feecce89795ec6bbbe980ecb79885296
SHA1 4ea0b4766b9d2ccf5020dbd130c9881ba8cae2ea
SHA512 f1a03737925bb3329dfc36181220245f4f0996eae3141ac3f9e148475fbe7d4e984c28e7c0dc7762e82cc44c57b58c7107e4d59de3e7400d282f6f8225dcc4f9
TLSH
T1E5218BB683E186AED91156F09A18AF2BCE2C0505825C3D6A8AD4BF5797F2071E102E5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 5d9c66e2c4555081805621e6804af1f87a886a80cf04010590fc5ff5b06fa031
MD5 8e62f9a12e8869bad1e5f6fb31676e8f
SHA1 594bed20a0b1a081798fc6497ba69aa069780317
SHA512 4303c05eb79958b090168c1ee6493a154bd50f394700ff130a41c8669701f46a069aa090eb83c4fe034132f6a5de18bb713f701587ae5e18455cdf663e90f306
SSDEEP 192:sxZE/yM/jK1Ml8Mkq/fTsMawIdpS6yHW6+WNBrIE/YCAjr4+IgrJ:sxZE7Mq/fTsMaRJyHblf/Mj9
TLSH
T17142E8116B389977CCDBD209FA517F53D6F94472A2940E44ADFC8A1C04F6AEC221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 275c5c5be16f202d8f4c7feb1705d408c2ed589ebe7fe2c08b7f7a1ef2dd7bdb
MD5 5d6cdf7962c153bf8311fcee612cd9bb
SHA1 7dabd4907500e9f3515ef1340d87f209a179c226
SHA512 772bc4894fdba5a4390b4283d0eb79a8b7c3b21564c809a3414590e6e8da5ad0e5cc0d532f777f57f705af8c8523aa3268f9a21dd545775393a7199cb3a6475a
SSDEEP 192:sxZE/yM/jK1Ml8UQ2kq/fTswqwIdp86yHW6+WNBrIE/YCsaIr4+Ig52J:sxZE7qdq/fTswqRTyHblf/gJjY
TLSH
T13152D8126B389977CCDBE209F9517F53D6F9547291940E44AAFC8A1C00F6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 6325590dc1b5e86e8ee65de3ce033629f336650d2dfedd0f4afc3208ffa96570
MD5 3e409e146135eceac2b405e3d558a19f
SHA1 bf9555e90898ff2335960da179869dbc58e718b5
SHA512 b6f1566c9a7368763fc6dd90d82fbf163fb84a42ec7eef34ede8b3b2e8d59695bdc0edcf450126f161fdbcd20da3188d9f340640b10128eeeaacdd3a12aaf47f
SSDEEP 768:1u8bqn+WvSCt68F1+UoAYDCx9Tuqh0VfUC9xbog/OVnZLlRTKVero3:1u8bqn+WvSCt6u1jaCZLbWV13
TLSH
T148D20A3B280CCB7E4F805E5DEC26AF962DD801CB6B988D4447FA894C03C76EA511B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dfa4cd3b-6396-44b1-9341-22ecfa35924f\index-dir\the-real-index
Size 1KB
SHA256 9e4be6001af0ccd7b5c57e5f31e533c91a13fac723eb6741e0db6c9aeec238ed
MD5 b61af6a332abbe135712be92e0a32561
SHA1 4f89bca3a71458f6101a888e16e44b4fb814a018
SHA512 710a38277c39d6a28c78691ef04e39b31d96ca1487da555a4872e5f473750dd0b8104c229447345dd4ebc3365cfd174a051b08774dfccccf6ddedd6c6c378473
TLSH
T1FE21109A4E91555BEAA54DB21473A4F433B0CECC571193531C3D337B1D213992A5B5CC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ce2f5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dfa4cd3b-6396-44b1-9341-22ecfa35924f\index-dir\the-real-index~RFe5ce2f5.TMP
Size 1KB
SHA256 b8a83821d01c015da7e12966a9c9f0c2a4899eba0758c6c16bb8f4bf8d66df24
MD5 1215c8856dd509f87d42a3b44d2ebdf5
SHA1 88b1062799f43457f84dc8e874702c60fb895996
SHA512 367246ee622818c43eb1da38810093e0f93e6174b6f2249b7125ca9c8585adbe72ead447b0390b7904a654c5d0bb5d8b89be3402d91fc31f8bb16e53e44595d9
TLSH
T1392163C64A92490FEDD040760143B4F43374CD00A332B383993E223E5C3479D5D4B0C5
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 317f3b3d0807b81dfcb903fe107a9ca709c0a6f2df71f5d4f3063b96ae428ae8
MD5 ae5e71b2166ac9100cb7865260c4e75f
SHA1 da78c0437895025fb29fae1170975af531673f86
SHA512 5a39f2d82a53aa823f445ff1cf4e148c4b09b8e9b8d20b259fafbbf1891b8311514110949bd28f70ccb4e8453caec3fe74afa5042f59ae3f26bd692581b9d3d5
TLSH
T133E0D8FA29E72860BC7BA3F5247048E042597998C986BC9F1469A2D750B33662856C61
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 a54d6be626e0b660e4ef8827ad8f6860785d3dabacaeedc8a3072a111bfcc646
MD5 f4484c22f3ec4b7411f00c62467ac30b
SHA1 1af8c1a486945b7749199f90f3c5cc7b3217ecf7
SHA512 657bc419714cc89684c5dc388755ce56ca782a62e7f47f8556bfacce4ea274911c8868ee29aa72f8f36e8b48ac2142aa08ffc6a0a73f85e2b897f922778400a2
SSDEEP 96:KM8QKlu2OXiKkII9q5trfjkzfgPZFkKBBZDk1NtArN5IhuVxHj3wz7Ul:y/9oTt
TLSH
T1A0918A2674BA43113C3E259CB156A6661F5131933059F86F3FB810930EA7E624DFC8ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4e37457a-15e0-409a-b43c-bcc7710f2400.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\4e37457a-15e0-409a-b43c-bcc7710f2400.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 624bd5b20f0890b92ff2a766fce1542e0631ed08173791b41c0ddbe78e3b9713
MD5 d9d200cf64c5587bc15bc046927a794f
SHA1 d8ba30669a24f08a189276f56d53ff5f5e3267e0
SHA512 865a6172af406b68c7e2009a1339846942e5d443d3387154a172faf81e1d39d7d3723618dd5d3acd2bae2d74445e6d23ccf8eec324e81b2d4e2fb00671dd61f9
SSDEEP 192:udLsNYUQuiD4biLpQmiU1kCW4Ea+jyOmM+JEQFahiam5qQU8:ysNYUI1Lp5Ea+mO7+JHhxU8
TLSH
T16D321A3669389C764DA26554F4873A239FE8406BDA892F94D6DC5F0C01EF69C230F92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 11KB
SHA256 d88691e6b6699d87d95a9d0f7b9365e8a14055c7286d614c023ef18dc75db53d
MD5 1364980816ee0063d443949603fcef12
SHA1 a570d4180f4ce197f996b643af1fb2a1f68ea626
SHA512 9e19a75d240929baad1de743e4503fd88f14467ba436f35a63bcfc5cfefcf4fc9429fed771482dc0a222f8b98979526c07dee9c1ea636fc81e20cbfa90843524
SSDEEP 192:udLsNYqQuiD4biLpQmiU1kCW4Ea+jyOmM+JEQFahiam5qQU8:ysNYqI1Lp5Ea+mO7+JHhxU8
TLSH
T13F322A36693C9C764DB26554F44B3A239FE84067D9896B94D6DC5F0C01EF69C230F827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 9861db5c4a874d09f62a49e6a050f10971213e148cea47853154700768d1fd40
MD5 907010e9b86e87d7ae5b45c96af45662
SHA1 9609ef581b5dd5d48e4099791634f60b16b53074
SHA512 4d00902c6a26603b71259511847ad6d2e079916c0753c77e72a69788a094ecee2a34a390be7290404a9207ff8d9b538e69b579c7b4be4d379fb7df4a7990278d
SSDEEP 192:uELsNYDQuiD4biLpQmiU1kCW4Ea+jyOmM+JEQFahiam5qQ0EJu:psNYDI1Lp5Ea+mO7+JHhxg
TLSH
T1FA522936693C9C775DA36155F44B3A239FB840ABC9892F94D6DC5F0C01EB69C230F826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 4800ef4ec776b260dae3365dea9c0cbaf06844a1282b1fd32e395136ccaa26eb
MD5 56164b6064607e357915be02a49bbdaa
SHA1 1867158040d403dc992b719c93d63a726d11f986
SHA512 7142acbf80a4ac2c2a46d35ff36017912bf6a27b475e19357c8ed42753ab0e64677515083b057a007832ef020c5ec0c046d77de2bd482aa8550af18c74fa46b1
SSDEEP 384:mZcIhsNYUI1Lp5Ea+mO7+JHhxOOPrXLpe8C/CY:0hpHSanO7oBxOi9PrY
TLSH
T18A929D31693C5CB66DB6B984F8873A179FFC8067E6C92A84E6DC9F0C01DB558130B836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 5b7018fa0170cdc186277e33010c8a93ee796dad6d633eee587a732cd455af0a
MD5 6667ad217ede449f4871d503a7654591
SHA1 bb3a8f24b1c761b77d2770412b8e73536c14da54
SHA512 f56d6bde88b39ffaf4b9bc4a8e7ea395cf9e94833a67b0d8716b6a41170bb35a0d57095ed11e8e11179a9dc81642c1c575b02f09374f574b8eaf7c5ebd66f8f7
SSDEEP 192:vON56Db6QmiUylNHBa+jyOmM+HRgYaH1U6:vON56uqHBa+mO7+Gx1U6
TLSH
T1EE02E835697C6C7B9EB26E45F88B2B279F94203BD9562B44DAD80F0C00D765C234B837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 fe932f578d008107dd492ebf01c3a48f777976d2c96fe5d52c89f436bc86a753
MD5 fcde32f3c65d252017d29f567830007d
SHA1 b529988f03d7fade64441d0d2c87410bb5e3c40b
SHA512 212cc8544ddfe742ccf84295264940d2f836b0c353f3955a0f9c14eb6bc839a81bdfedc93f05f7086a4524e2730a665c2a4315d10d71eb225539dcc82a9c9e55
SSDEEP 192:pONx6DbSQmiUy9N7Ba+jyOmM+JEQFahPNz5qQU6:pONx6Wo7Ba+mO7+JHuxU6
TLSH
T132121936693C9C7B5DA26994F8873A279FA44067D98A7B90D6DC1F0C00EF65C230B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 996682c5c0875a129263e329f15bcad3de9d35af496c899728f06e251e373254
MD5 5845b7cd211556f11855ff87010b86b4
SHA1 b8633b083f637242750cb6e4f0ebec8257f8eb9d
SHA512 0c6dc703d83ee2e62d99ba676cb8e74d82d3fcecf6b47b6b87b5cfeecb50ca5b5e24e4bcce34bcd0f62247c7d402b331f892ba8845a0eb4a86349cd86784d487
SSDEEP 384:biFiZcI4sNI8TUNTUlIlUI1Ly5Ea+mO7+JHIxOOPrXLpe8C/CY:2FQ4JwgHcSanO7ooxOi9PrY
TLSH
T194D208F259EB8876D9AE5B47E77E2D138EBCC063B4856554B3C84A0CCC9617FC30A825
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

77344793-7e3f-472c-9bd8-ac23a9448a7f.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\77344793-7e3f-472c-9bd8-ac23a9448a7f.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 7f2c5c81c76afe6fd5c2f40cebd8df8dffff4fb2c0a2ea7ccc0fff33c89fa729
MD5 9a9e9ceb3eeeadb4945b04e8ade75b31
SHA1 c2c04eeed71d571a0522b506fb0293f504018310
SHA512 84cd541001b0e39f9fd8838621d92b275d03413218a837345aa8086c9d36a304e046020fb3050303b953116c8c8cd47f42fcce2f3d6d1011914f819528634235
TLSH
T1EB413758A6E91008B3B77E5AABF6A86E847F7D772E0BC49D00100E4F0622A40C971B37
MD5 SHA1 SHA512 TLSH

Submit Download