hxxp://acendalife[.]app

Analysis

user interaction
yes
max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
14/08/2026, 04:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://acendalife.app
Sample260814-eylensvbqb

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
552	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134311548725619739"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1074038928-2032447174-945360078-1000\{B1557761-7214-43B4-B5AB-0A27601717F1}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4604	msedge.exe
4604	msedge.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
668	Process not Found
668	Process not Found
668	Process not Found
668	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 14 IoCs

pid	Process
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe
676	msedge.exe

Suspicious use of WriteProcessMemory 57 IoCs

description	pid	Process	procid_target
PID 676 wrote to memory of 2188	676	msedge.exe	87
PID 676 wrote to memory of 552	676	msedge.exe	88
PID 676 wrote to memory of 3520	676	msedge.exe	90
PID 676 wrote to memory of 3520	676	msedge.exe	90
PID 676 wrote to memory of 3792	676	msedge.exe	89
PID 676 wrote to memory of 3792	676	msedge.exe	89
PID 676 wrote to memory of 3792	676	msedge.exe	89
PID 676 wrote to memory of 3012	676	msedge.exe	91
PID 676 wrote to memory of 3012	676	msedge.exe	91
PID 676 wrote to memory of 3012	676	msedge.exe	91
PID 676 wrote to memory of 4124	676	msedge.exe	92
PID 676 wrote to memory of 4124	676	msedge.exe	92
PID 676 wrote to memory of 4124	676	msedge.exe	92
PID 676 wrote to memory of 1796	676	msedge.exe	94
PID 676 wrote to memory of 1864	676	msedge.exe	95
PID 676 wrote to memory of 1796	676	msedge.exe	94
PID 676 wrote to memory of 1796	676	msedge.exe	94
PID 676 wrote to memory of 1864	676	msedge.exe	95
PID 676 wrote to memory of 1864	676	msedge.exe	95
PID 676 wrote to memory of 4788	676	msedge.exe	99
PID 676 wrote to memory of 3592	676	msedge.exe	98
PID 676 wrote to memory of 4788	676	msedge.exe	99
PID 676 wrote to memory of 3592	676	msedge.exe	98
PID 676 wrote to memory of 960	676	msedge.exe	101
PID 676 wrote to memory of 3476	676	msedge.exe	102
PID 676 wrote to memory of 3476	676	msedge.exe	102
PID 676 wrote to memory of 3476	676	msedge.exe	102
PID 676 wrote to memory of 3936	676	msedge.exe	103
PID 676 wrote to memory of 3936	676	msedge.exe	103
PID 676 wrote to memory of 3936	676	msedge.exe	103
PID 676 wrote to memory of 4880	676	msedge.exe	104
PID 676 wrote to memory of 4880	676	msedge.exe	104
PID 676 wrote to memory of 4880	676	msedge.exe	104
PID 676 wrote to memory of 2220	676	msedge.exe	105
PID 676 wrote to memory of 2220	676	msedge.exe	105
PID 676 wrote to memory of 2220	676	msedge.exe	105
PID 676 wrote to memory of 4564	676	msedge.exe	106
PID 676 wrote to memory of 4564	676	msedge.exe	106
PID 676 wrote to memory of 4564	676	msedge.exe	106
PID 676 wrote to memory of 2524	676	msedge.exe	109
PID 676 wrote to memory of 1200	676	msedge.exe	110
PID 676 wrote to memory of 3068	676	msedge.exe	111
PID 676 wrote to memory of 2308	676	msedge.exe	112
PID 676 wrote to memory of 2308	676	msedge.exe	112
PID 676 wrote to memory of 2308	676	msedge.exe	112
PID 676 wrote to memory of 1156	676	msedge.exe	113
PID 676 wrote to memory of 1156	676	msedge.exe	113
PID 676 wrote to memory of 1156	676	msedge.exe	113
PID 676 wrote to memory of 3772	676	msedge.exe	114
PID 676 wrote to memory of 3772	676	msedge.exe	114
PID 676 wrote to memory of 3772	676	msedge.exe	114
PID 676 wrote to memory of 1816	676	msedge.exe	115
PID 676 wrote to memory of 1816	676	msedge.exe	115
PID 676 wrote to memory of 1816	676	msedge.exe	115
PID 676 wrote to memory of 408	676	msedge.exe	116
PID 676 wrote to memory of 408	676	msedge.exe	116
PID 676 wrote to memory of 4604	676	msedge.exe	124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://acendalife.app
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x264,0x7ffbe146c188,0x7ffbe146c194,0x7ffbe146c1a0
  2⤵
  PID:2188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1956,i,3407894084188462916,16795560636564222566,524288 --field-trial-handle=2340,i,12883062810983310054,10282110627107800299,262144 --variations-seed-version --mojo-platform-channel-handle=2368 /prefetch:3
  2⤵
  - System Time Discovery
  PID:552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1696,i,14451240571046999423,9916742479073310900,262144 --field-trial-handle=2340,i,12883062810983310054,10282110627107800299,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:2
  2⤵
  PID:3792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2384,i,18441399435836794304,3477287103980713581,524288 --field-trial-handle=2340,i,12883062810983310054,10282110627107800299,262144 --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:8
  2⤵
  PID:3520
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3452,i,3435862026752975190,10491233198461913999,2097152 --field-trial-handle=2340,i,12883062810983310054,10282110627107800299,262144 --variations-seed-version --mojo-platform-channel-handle=3480 /prefetch:1
  2⤵
  PID:3012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3472,i,2428855775592606302,7414846634287153569,2097152 --field-trial-handle=2340,i,12883062810983310054,10282110627107800299,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:4124
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4264,i,5143885517025501519,7666289660423732387,2097152 --field-trial-handle=2340,i,12883062810983310054,10282110627107800299,262144 --variations-seed-version --mojo-platform-channel-handle=4276 /prefetch:1
  2⤵
  PID:1796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4292,i,2880237744449300643,2361321519742435845,2097152 --field-trial-handle=2340,i,12883062810983310054,10282110627107800299,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:2
  2⤵
  PID:1864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3448,i,16130488066612070123,9318361010636529337,524288 --field-trial-handle=2340,i,12883062810983310054,10282110627107800299,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:3592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3616,i,9667079817366180706,7051775028514463313,524288 --field-trial-handle=2340,i,12883062810983310054,10282110627107800299,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,3550767475798395221,12193169943517579882,524288 --field-trial-handle=2340,i,12883062810983310054,10282110627107800299,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:8
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,3550767475798395221,12193169943517579882,524288 --field-trial-handle=2340,i,12883062810983310054,10282110627107800299,262144 --variations-seed-version --mojo-platform-channel-handle=5852 /prefetch:8
  2⤵
  PID:960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=4396,i,13308885322044520740,3496820474941653294,2097152 --field-trial-handle=2340,i,12883062810983310054,10282110627107800299,262144 --variations-seed-version --mojo-platform-channel-handle=4540 /prefetch:1
  2⤵
  PID:3476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=3536,i,6310841839563908428,3583809404093113877,2097152 --field-trial-handle=2340,i,12883062810983310054,10282110627107800299,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:3936
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6308,i,1317023991001485812,1534129730770300532,2097152 --field-trial-handle=2340,i,12883062810983310054,10282110627107800299,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:1
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4324,i,9142218389252304901,4679486703312782981,2097152 --field-trial-handle=2340,i,12883062810983310054,10282110627107800299,262144 --variations-seed-version --mojo-platform-channel-handle=1756 /prefetch:1
  2⤵
  PID:2220
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5896,i,11725267969344652100,8899620948376028072,2097152 --field-trial-handle=2340,i,12883062810983310054,10282110627107800299,262144 --variations-seed-version --mojo-platform-channel-handle=4884 /prefetch:1
  2⤵
  PID:4564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6348,i,15185953920260294763,17650553583582609608,524288 --field-trial-handle=2340,i,12883062810983310054,10282110627107800299,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:8
  2⤵
  PID:2524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6756,i,17285851224517461337,5635945492380817407,524288 --field-trial-handle=2340,i,12883062810983310054,10282110627107800299,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:8
  2⤵
  PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6740,i,932375412052116600,16029872914130953146,524288 --field-trial-handle=2340,i,12883062810983310054,10282110627107800299,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:8
  2⤵
  PID:3068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=2568,i,14962348844015310236,12445912062556867317,2097152 --field-trial-handle=2340,i,12883062810983310054,10282110627107800299,262144 --variations-seed-version --mojo-platform-channel-handle=2784 /prefetch:1
  2⤵
  PID:2308
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=21 --always-read-main-dll --metrics-shmem-handle=4304,i,8385413602165501841,7224203806819130072,2097152 --field-trial-handle=2340,i,12883062810983310054,10282110627107800299,262144 --variations-seed-version --mojo-platform-channel-handle=4440 /prefetch:1
  2⤵
  PID:1156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=6584,i,17569099934274114354,7114819051909523186,2097152 --field-trial-handle=2340,i,12883062810983310054,10282110627107800299,262144 --variations-seed-version --mojo-platform-channel-handle=4472 /prefetch:1
  2⤵
  PID:3772
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=4436,i,9518505522931092240,3443828152810126494,2097152 --field-trial-handle=2340,i,12883062810983310054,10282110627107800299,262144 --variations-seed-version --mojo-platform-channel-handle=6624 /prefetch:1
  2⤵
  PID:1816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6896,i,11859292815897395892,8643771537737174358,524288 --field-trial-handle=2340,i,12883062810983310054,10282110627107800299,262144 --variations-seed-version --mojo-platform-channel-handle=3412 /prefetch:8
  2⤵
  PID:408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=760,i,14297847179970805332,3842227642603558682,262144 --field-trial-handle=2340,i,12883062810983310054,10282110627107800299,262144 --variations-seed-version --mojo-platform-channel-handle=5288 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4604

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2144

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8c5b1a407270ca9ae8bec8f20cc56244f3bde6f042890a4cabcdf4df3d21fdad
MD5 16f782e6f4d4592598936b2f29b6b339
SHA1 5c8c22b7f56af2b2e0d9978418f077cc8fd13c41
SHA512 28b2f7186b910539fa22408b47131fb16874b4c2192a721a69393efd7812da561ea9977b8af678cd3a9e37c23f186f876d7086a20afe28b16659db70955cf16f
TLSH
T15DD09232B7C9E241E14232BAA81447826E2A4A68259AC2176478844CEC6984AA79D28B
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b28cb7be2bb68a6cda7ff7689f0ec4acdf8699e4818545d4dd692148ce1d64d2
MD5 a712889d00fb4f0945d13b925681156a
SHA1 1448cbfbc2c620e016aa5e6fccd0ac75e74ef2d1
SHA512 65f51cf451d5f77c9e695462e66abc873922db3c3999c172526727c2356a5a29052ce4b77ead44b02780ca80f6b290696b7633f537570254f36e7374ce0d04a5
TLSH
T12ED09B3277C5D541D5423276A41447816E164568159AC2175474444CDC69445579D147
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 b73a64ecbe3b1363d8f89cbcd2594ad51c22b75734e5604340010ffde39d22a2
MD5 88a373ea432a1b1de686ab4b114a27a8
SHA1 f6b034c1ef595bf5a0f905b8c67bde167386c302
SHA512 9e57d46ba745cfe8c62b841c9697801b0c834837dfc8b722cb572bc083c49b88c504e557073a6fbeccbf858755f9f2bbf6a39793c73a3a58255a5c77d8ab0f2b
SSDEEP 48:Z76DaP7fWFzebvLFKqwx1JhdpD1yHUGE8507+Os64MpQCJh7AKF2QNFgU8klaMTJ:1hP7+FqlBwD1gjNKnJ9M4/iY
TLSH
T15191611921F90849D3D5A332F1DB1D1A3CF3A09B0E939E582B5CDCBDB0BA7B4E465484
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 d83973246f12fc4bdcf35d4419d02e15b16469635fec3d37c1339df43e40ead4
MD5 9cd4a21aa8afd58c6d2179600b602152
SHA1 784186b1db821378478dc71e1b1898433793fc54
SHA512 02ccfec677bc7526fcecec6ca12b46b925d0b5d39824f378830869f7e97137658942367323a3b5b2637fdcdcd61e953348be8d9cd87d18ba2eb8eff3fe6654bd
TLSH
T1CF712C1A01F9489DD721A330F1CA1D1E7CF3F19B0E139E49315CD8BDA53A734E4A5554
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58bb6b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58bb6b.TMP
Size 3KB
SHA256 aa521f63361568820749bac1740127ff69e65d4271d6034911558387609244a7
MD5 ac4b054876d14d15339773927dc190df
SHA1 bd4c3091a832aaa65b50e28120209769e6b0ed3a
SHA512 2af86f273868b80e25451bb6a56894e1a5024a712b5d177a819ad4c1fc82d3f70c4230c3e38cda343008ccf5fd2213a280f029351baa4467d9f5ca715c6f5e30
TLSH
T1B3712B1A02FA489DD721A330F1DA1D1E7CF3E19B0E539E89319CC8BDA53A734F4A6458
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 37d620e24359d4574dca4f3ac4b04ddfa8219a051a80c3460323a6b940ed8f00
MD5 3b1f4eb8410c7139dd469535a4c55b89
SHA1 5cbceffac30e690d56fa652e4823cbea7acaa521
SHA512 4f65dac64024adfd2807c5b3cfb8e001488e63793540ad5e5ce012f1713754e85a6e173f6afa8cebd207507fa3b362414ad27ea8028af0abef4b21dff3b5801d
SSDEEP 192:D5rW3YJheneGq5i2JbEu/AMPVRjhuOF/aP3/S49PpLv8hS6x:D5rW3YJheneGq5i2JbEu/AMPVRjhuOFD
TLSH
T1C7027BB7C2D48A6DD82157F066247F2BCE290A28432C3C5DC9D8AF5BD3E25B1D24165F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 7KB
SHA256 cfb75be40633b3d2d99a499f7c1de2ca326b6066f66fcaab335ec1e9006c4856
MD5 fe63c38f220407ca9ba18cb13a1f67b5
SHA1 872459dd4f0ddc9720ab4f71f7f535ed73c5f37e
SHA512 1f9b7c963c4cbecebe87d6fd76bbfa5328b5a573bb2d7efc7f00517ca9642249c5bf47e1c4d86bf17ca2149f4020452a709ea4cddf55eb23b70c600b785037cc
SSDEEP 192:D5rW3YJheneGq5icYWS3j/AMPVRjhuOF/aP3/S49PpG:D5rW3YJheneGq5icYWS3j/AMPVRjhuOz
TLSH
T13CE18AB7C2D48A6EC82156F066247F2BCE290A28432C3C5DC9D8AF5BD3E25B1D24165F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 bfa1b0f527d05e7882001bca1a501057313662a7e9819f498bd510608c5f36eb
MD5 cab0ab5b4f333e1559042a8d4fde9577
SHA1 e69559e3736524c3357cfdcbd250bab4d31c763d
SHA512 cad0b4947c7a289d039149b976a7f9c58d64d53b53e266cbf920910166912c5f5f0d13d10465aa7d65658746782c16bd649a2a6719b278fd833385549182345a
SSDEEP 192:sxZuIR0yM/jK1Ml8Mkl/fzLsGONkIdpJHXy6+WNGY4k91LIgrJ:sxZ5WMl/f3sGON9JHvGG9
TLSH
T13342D6116A38A977CCDBD209FA557F53D6F80562A2900E44ADFCDA1C04E6AED2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 10c95e131a3a6f62c928ec7d726e4cecdeda9e6729d73ebe6b2d36d368426c25
MD5 10cee294892a7a193e2159cfd1df3d39
SHA1 2aec329fb2276e887bbea734cd39d0e4f3e63060
SHA512 81ae036ad378574edb4bd9ca1aed3c1fba9825f1cef0dca2eadfdec73cfef934a084cc0fa373077f315154f25210f23225f35952d5016b0fa58b46812624be1a
SSDEEP 192:sxZuIR0yM/jK1Ml8UQdkl/fzLs40NCIdpaGxNHXX6+WNdjI/Y4fC1LIg51J:sxZ5Oq2l/f3s40NrPH0y/YV
TLSH
T1E252C6156A385AB78CDBE209F551BF53E6F404B692900E44AAFCDA1C04F6BED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 92c7689f741c71812342c75ab64287db5d92daae4b4bc85d01e82ac964741633
MD5 69ecf2d4c7befbbcada6b73747fddc1a
SHA1 c6f7bd5761dcbbf420a5139cffcfee8dd3379474
SHA512 eb3114a47fb1b76162e34bf1a7da7d0a751b9eb0c36ef85c483df92b3f2ee229ab4e9557c5a21d7e1b31259d0b0bb7fec241f9b5e054cbc53d0535cc32d45939
SSDEEP 192:sxZuIR0yM/jK1Ml8Mkl/fzLs40NE+IdpgGxEHXX6+WNdjI/Y4x91LIg51J:sxZ5OMl/f3s40NugH0y/rV
TLSH
T10A52B615AA3859B78CDBE209B551BF53E6F405B292900E44AAFCDA1C04F6BED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 c604307147872b17270b07959c51add9665744e6af792aa487601c4d8019b91c
MD5 9da4338d43009191f3ca213bc7bdaa8d
SHA1 1c703370caf692c0437683955bda06cf9dc15c99
SHA512 8ab31291d6631401edc626187f5980956b95bac716d1307d1de16884d1e5e1740605e3f8b400c944946a9d5db1c7dc9f866c23dce03ca5c337e7cb6399d46e9c
SSDEEP 768:5Z8iJPNWvx76r8F1+UoAYDCx9Tuqh0VfUC9xbog/OVsALl6opdarosck8Uns:5Z8iJPNWvx76ru1jahALocdR3Us
TLSH
T197D20A3B680CCB7E4F845E9CEC266F966DD801CB5B988D5447FA880C03C76EA51279DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 7dd1f7d5ca60b7a10147838e4be0180a65515ba3c2f667cc295b53192362d75f
MD5 a6bb02d36ad98b8cf7ff11831c475b8f
SHA1 1ed5817b6a2bb4af1357ab363a563f0b07e8ad98
SHA512 81b06f7521b8858deff8d7870e72f9a066f2c5114d3036952d44e74b0beeb66a3fa1afbd1c62d070e918e52a01633f934520540239ac124f83a13bd9c72637c1
SSDEEP 96:Ksg4KBW2qEgKNC6J61p7b76FTcJv56KXPv/6LpR0nZzSYJuyoC2/Fung:CXHpJ61p7b7ATcp5hPv/spR0nZzSYJuz
TLSH
T19CA1001774BA23112C7E2C0DE25A97160651B6A33218E46B3BF944B24E7BF261CFC9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 fa37c353cc418e654a1d33a52a311d52c70b0a73bb76ea6afdb8e5fc928a2caa
MD5 a223774fc4cf3e19bed595bb1c17f7e2
SHA1 eaf16ac6932e568d092455521b42c89a992ec252
SHA512 fed649b7d5dcbd6223e3ea102e2bf2bc8165e411fc5a36af7e7ba860ceb0b1008db532c68fab4580689a46e4dd81f21a92e2fce15a948f49eba758f5f28728a7
SSDEEP 384:3ZcIhsN5xIS38fkkTinwrOOPrXLpe8C/l:/hdIwrOi9Pm
TLSH
T1C5928D71A8B86C76ACF2E582F44636135FB48577F7C82B98A6ECE71C05DA158030BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 ebfa6f182e5f7233701365dc7ab6f8b1cc2db82ccd654eba9c8d29c02f56f97c
MD5 acf451ffa8f02cabe44fec0933e06027
SHA1 e911c68c638bca81bd3fa33985d14f78e64fc133
SHA512 28409a0c54d93f5f6de4c8e6a2c1d019db9d527f729816c8efbaac3c3d723baca31da187b5e5c8eea0b84e7c8df992445508ba0bd2f03c9971fe291651ac3f9b
SSDEEP 96:ZqONk1QsjpfmUTmDK5ih/cIPURHl8h4otop5X5DrBhPwivh50xy0SFYKCAxTeYNj:gONl6kDfQmiUyZVZ903plQiZctU6
TLSH
T1BA02E93568786CBB8EA3AE46F4473B275FA4112BEAC52F85DAE81B1C04D724C1707837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 a7350f0ac91d419d979e85b75916672201356edc2d5d20fb669a27d7bf5bccf0
MD5 ed73d01a6178a9fd7be38af603149145
SHA1 c4303d39c354b0bde310eabf04c37a223b9b991f
SHA512 67a78f05f1f09f3695c2ffa86f8f5ab28fe0c997d22f61cfe6ad78bf1c28bb01e7f4c867aadeb547ff0977b37f66647b77843aa2d7a586f21fc78d3a3856225e
SSDEEP 384:8ZcIhsN5kIS38fkkTinwrOOPrXLpe8C/l:qhiIwrOi9Pm
TLSH
T10A928D71A8B86C76ACF2F582F44636135FB48577F7C82B98A6ECE71C05DA158030BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 90e5d7d78c1e020d3e08d77f2e4e78e72c1827c5af4200aa93210f9aff6bcf02
MD5 f4ab3040862b5f4982d222bb18c63d7d
SHA1 2f05e5d9dc323cfa157d30aa6ce3965e5348027c
SHA512 adad2d665a808f6ad851600a573e76f0839c1e2800489cdb54aee15f5a25be8d7817bece37140b3bdb3e33da2e8df72602967ed85f79e02869e336a7e428e7f3
SSDEEP 384:dFiZcIHsNb8TUNTUlIlkIS3zfkkTinPrOOPrXLpe8C/l:dFQHuwgkIPrOi9Pm
TLSH
T13AC227F258E7847ADCAE9B43A77D2E134EBCC067B5846A94B7D8960CCC8617FC306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 0827d8b69a0d811a8145ff410875763429e487fc5324949cceb82379c9419e5e
MD5 d0e891ebda11966cbc1fa4438c325c11
SHA1 06ef414e9bc3e8720e5cf4a40454edf046e6b5b3
SHA512 5c0c5fabee4077b73bd46307ef91139d3752a61d744885fd3c7fc1ff8d3cdf6204a535fda6307d60aef7f58e3ebc869e92955d8b26c7a106c684558ba2999422
SSDEEP 96:cqONkUQsjpfmUTGK5ih/cIPURHl8h4otop5X2DrBdPwivh50xy0SFYKCAxTeYNsb:HONc6kTQmiUygV9903pTeF3XRcRmqfU6
TLSH
T16D121B316878687B5DE3A491F44736135EA54127EBC92F91D9DC2A1C04DF25C130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b8e71d52-4deb-46ea-87a3-4b7e7403632d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\b8e71d52-4deb-46ea-87a3-4b7e7403632d.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 f52412dca9bcc8f36c2a90ba70640c349a8953a992c4285eaaed345d824089c4
MD5 b10e096d141d9f721fe639ab255e29d4
SHA1 0939c687f8201af8714eb42e62609f115b18b13a
SHA512 0d15ea8b3fc3fffbadf219fb47b3aee9b140cd57fd93a4f4971608b2c2664380c3c6d0935b1ad2d9c7ffe22bb6061ddb6c2a4e1aabb36ddde7804cef1bdd79fd
TLSH
T1B841F85CA6E91158B3B77E56ABF7A86D487F7D272E06C4AE00010D4E0A72B44D8B1737
MD5 SHA1 SHA512 TLSH

Submit Download