25239fd5d977aa10d3332413930c6010327573d62419c2cd8cbd2f0290d6b8a4

Analysis

max time kernel
899s
max time network
737s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 07:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
UCOk_qgWaR7b9JmB1sSI3TnA.html
Size 1.3MB
Sample260815-jf7bmsgp2z
SHA256 25239fd5d977aa10d3332413930c6010327573d62419c2cd8cbd2f0290d6b8a4
MD5 8d635b052b25764cb92dd8943f6748ea
SHA1 b7741cca551458db86e72b2a7549781f7adf4147
SHA512 1714683095457d2c1afa4cdabe07bb9760568385bac6e15504f683d6de277207ae221939be830b49b6479fff317b7b7d0ea40f4e41ee6f61f3b26bd36f1f701c
SSDEEP 12288:u8jZHjZajZXjZCjZcjZVjZHjZCjZejZ0jZVjZYRHhn28KJch:uhxhn28KJg
TLSH
T1A555E6141868BCB68D83E503CDB5FE7F59E453294BC89A6DBCB3EB5C01ED6480CAE851
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4668	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134312530895269348"	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3797332335-34111092-3597280141-1000\{655D873D-4AF3-4B03-ACA2-228A23E7A593}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2884	msedge.exe
2884	msedge.exe

Suspicious behavior: LoadsDriver 9 IoCs

pid
4
4
4
4
4
4
4
4
4

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe
4828	msedge.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 4828 wrote to memory of 2712	4828	msedge.exe	89
PID 4828 wrote to memory of 4668	4828	msedge.exe	90
PID 4828 wrote to memory of 4884	4828	msedge.exe	91
PID 4828 wrote to memory of 4884	4828	msedge.exe	91
PID 4828 wrote to memory of 4884	4828	msedge.exe	91
PID 4828 wrote to memory of 3752	4828	msedge.exe	92
PID 4828 wrote to memory of 3752	4828	msedge.exe	92
PID 4828 wrote to memory of 4852	4828	msedge.exe	94
PID 4828 wrote to memory of 4176	4828	msedge.exe	95
PID 4828 wrote to memory of 4852	4828	msedge.exe	94
PID 4828 wrote to memory of 4852	4828	msedge.exe	94
PID 4828 wrote to memory of 4176	4828	msedge.exe	95
PID 4828 wrote to memory of 4176	4828	msedge.exe	95
PID 4828 wrote to memory of 3340	4828	msedge.exe	97
PID 4828 wrote to memory of 3340	4828	msedge.exe	97
PID 4828 wrote to memory of 3340	4828	msedge.exe	97
PID 4828 wrote to memory of 4436	4828	msedge.exe	98
PID 4828 wrote to memory of 4436	4828	msedge.exe	98
PID 4828 wrote to memory of 4436	4828	msedge.exe	98
PID 4828 wrote to memory of 4412	4828	msedge.exe	101
PID 4828 wrote to memory of 5696	4828	msedge.exe	100
PID 4828 wrote to memory of 4412	4828	msedge.exe	101
PID 4828 wrote to memory of 5696	4828	msedge.exe	100
PID 4828 wrote to memory of 6096	4828	msedge.exe	103
PID 4828 wrote to memory of 4892	4828	msedge.exe	106
PID 4828 wrote to memory of 4892	4828	msedge.exe	106
PID 4828 wrote to memory of 4892	4828	msedge.exe	106
PID 4828 wrote to memory of 5244	4828	msedge.exe	108
PID 4828 wrote to memory of 4664	4828	msedge.exe	109
PID 4828 wrote to memory of 5032	4828	msedge.exe	110
PID 4828 wrote to memory of 5216	4828	msedge.exe	111
PID 4828 wrote to memory of 5216	4828	msedge.exe	111
PID 4828 wrote to memory of 5560	4828	msedge.exe	113
PID 4828 wrote to memory of 5560	4828	msedge.exe	113
PID 4828 wrote to memory of 2884	4828	msedge.exe	114
PID 4828 wrote to memory of 3064	4828	msedge.exe	115
PID 4828 wrote to memory of 3064	4828	msedge.exe	115
PID 4828 wrote to memory of 4144	4828	msedge.exe	116
PID 4828 wrote to memory of 4144	4828	msedge.exe	116
PID 4828 wrote to memory of 3404	4828	msedge.exe	117
PID 4828 wrote to memory of 3404	4828	msedge.exe	117
PID 4828 wrote to memory of 4840	4828	msedge.exe	118
PID 4828 wrote to memory of 4840	4828	msedge.exe	118
PID 4828 wrote to memory of 4056	4828	msedge.exe	120
PID 4828 wrote to memory of 4056	4828	msedge.exe	120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\UCOk_qgWaR7b9JmB1sSI3TnA.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffe4df3c188,0x7ffe4df3c194,0x7ffe4df3c1a0
  2⤵
  PID:2712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1880,i,2614186264166246423,11219037761565647218,524288 --field-trial-handle=2404,i,5389631416017759861,16564960222005892996,262144 --variations-seed-version --mojo-platform-channel-handle=2436 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4668
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1612,i,6523998538933708486,10628837245157148040,262144 --field-trial-handle=2404,i,5389631416017759861,16564960222005892996,262144 --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:2
  2⤵
  PID:4884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2236,i,4066652257915756052,11814608648076362296,524288 --field-trial-handle=2404,i,5389631416017759861,16564960222005892996,262144 --variations-seed-version --mojo-platform-channel-handle=2620 /prefetch:13
  2⤵
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3584,i,6921753733725873460,8578702496473011445,2097152 --field-trial-handle=2404,i,5389631416017759861,16564960222005892996,262144 --variations-seed-version --mojo-platform-channel-handle=3588 /prefetch:1
  2⤵
  PID:4852
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3596,i,5279446796864018932,15246707213058507020,2097152 --field-trial-handle=2404,i,5389631416017759861,16564960222005892996,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4312,i,9334838815030504347,12726646452362662006,2097152 --field-trial-handle=2404,i,5389631416017759861,16564960222005892996,262144 --variations-seed-version --mojo-platform-channel-handle=4836 /prefetch:1
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4324,i,4014857416464458761,2248604756579313251,2097152 --field-trial-handle=2404,i,5389631416017759861,16564960222005892996,262144 --variations-seed-version --mojo-platform-channel-handle=4840 /prefetch:9
  2⤵
  PID:4436
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3764,i,5083230899893746190,4918397681538226052,524288 --field-trial-handle=2404,i,5389631416017759861,16564960222005892996,262144 --variations-seed-version --mojo-platform-channel-handle=5360 /prefetch:14
  2⤵
  PID:5696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5368,i,3972226730635270732,13310294154408699458,524288 --field-trial-handle=2404,i,5389631416017759861,16564960222005892996,262144 --variations-seed-version --mojo-platform-channel-handle=4864 /prefetch:14
  2⤵
  PID:4412
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,18199999463017982559,11726043845243529890,524288 --field-trial-handle=2404,i,5389631416017759861,16564960222005892996,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:14
  2⤵
  PID:4180
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5964,i,18199999463017982559,11726043845243529890,524288 --field-trial-handle=2404,i,5389631416017759861,16564960222005892996,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:14
  2⤵
  PID:6096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5980,i,5510195343013122857,10333704762722334013,2097152 --field-trial-handle=2404,i,5389631416017759861,16564960222005892996,262144 --variations-seed-version --mojo-platform-channel-handle=3804 /prefetch:1
  2⤵
  PID:4892
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6388,i,7939129256467545063,17153170845961601252,524288 --field-trial-handle=2404,i,5389631416017759861,16564960222005892996,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:14
  2⤵
  PID:5244
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6356,i,4895339540911670619,11200221653353423549,524288 --field-trial-handle=2404,i,5389631416017759861,16564960222005892996,262144 --variations-seed-version --mojo-platform-channel-handle=6432 /prefetch:14
  2⤵
  PID:4664
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5732,i,14910383144818698947,17830449345794055984,524288 --field-trial-handle=2404,i,5389631416017759861,16564960222005892996,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:14
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5512,i,9207916263588840162,14928688536584437830,524288 --field-trial-handle=2404,i,5389631416017759861,16564960222005892996,262144 --variations-seed-version --mojo-platform-channel-handle=600 /prefetch:14
  2⤵
  PID:5216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,6780067238618222915,12339827964166271560,524288 --field-trial-handle=2404,i,5389631416017759861,16564960222005892996,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:14
  2⤵
  PID:5560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=812,i,1539726934156238188,17290975307217775948,262144 --field-trial-handle=2404,i,5389631416017759861,16564960222005892996,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2884
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3780,i,4422532582571765416,15159337161246734726,524288 --field-trial-handle=2404,i,5389631416017759861,16564960222005892996,262144 --variations-seed-version --mojo-platform-channel-handle=5848 /prefetch:14
  2⤵
  PID:3064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5872,i,5863289553184753195,1075577485238102769,524288 --field-trial-handle=2404,i,5389631416017759861,16564960222005892996,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:14
  2⤵
  PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6176,i,11741172309568450491,8121619753707571261,524288 --field-trial-handle=2404,i,5389631416017759861,16564960222005892996,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:14
  2⤵
  PID:3404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6260,i,16116539429215027071,3925300249618856076,524288 --field-trial-handle=2404,i,5389631416017759861,16564960222005892996,262144 --variations-seed-version --mojo-platform-channel-handle=3592 /prefetch:14
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,15505274066696817641,2579356600178130364,524288 --field-trial-handle=2404,i,5389631416017759861,16564960222005892996,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:14
  2⤵
  PID:4056

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5152

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5760

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:5864

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:5588

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e413e02b9e80ee8d76d52c1043fc32251e2d7634d4b2fbd970df9ace9d91831a
MD5 22959b3a06a842ac30237dd57e8a3801
SHA1 0b7c28071a592034aa2607038000f085c7bb6362
SHA512 644add9ab912ad7fdfc55bc7a1b84482c75cc9bc69a59d169bae63a0400619d999846ebbadb0ef2bd6d35c2bd08a5f07053b600874dd5dfcbda7e8f3076131fe
TLSH
T1A5D02BE476408A0CC980203335F6524092018910D801D1480040B325CC845C1257F0DF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 8aaa68aad07ba45abe53bd513aa5f7e7b21bd1b29db6e1d5c1e0a79a5f4eb890
MD5 74012bbce5fada7634c1da1b567562b3
SHA1 09db27f38f27e35986cfd407b57f6f83c8fc59f8
SHA512 c1a6a98f972793c84274c29552107bfe07b775c7c8121e5fdf137ebf9a7cc3f4eb43fe9eadfc842e7b92ca7281bbcea3d660bdd8fc9adc56add068510c41e48d
TLSH
T1FBD02BE07640890CC980203335F75240920189108401D1480040F335CC845C1257E0CF
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 87d465c25613b6981fe7f5e383c811d7b3ac193b8e690eeaf1d960eb534d2db9
MD5 a792afc500b2310912e612183c8a8591
SHA1 94bf524427d0cb4f67727271c18d0f90b83cdcc4
SHA512 d64ee9aeb28a229a3e88f7399813436a443ede15650bc0014cb75503785e45a33d45d069e7d088fc5ba3d83bf98495f85135fd2928acf394ae7e073761c659d5
TLSH
T118E020D444C8C37DD94466C75678534D82803B8BA7C8FD1717A488497442440F6C7590
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 db0813b81e8009e97718fc2b66a7aca5418f025710f2e6168935e6cc3836418e
MD5 dfa808fef38bf99d50269eb4b01277c1
SHA1 146eb2aa6f87d8e678df0d19085486266d033cca
SHA512 f975b30442ee012b0b41f933ad0c802000a9a7b0f4d8d78a1b92f93bcbea26e85525811c3a89cdbd422b478e35afecf94e90eaec95cbb343f09a4af3d8ea3a45
TLSH
T13EE026A947C8C2AEFE40A747526D538DC2903B9F92C8FD8A174898887501C40A283690
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 2dd11c4b301125b34ba368d3e2e41c972ef8baa024a295bd987d5501012be0f5
MD5 86545d446b6c651b850b27b49f3981b3
SHA1 aa06bfc229a35b64b578d95351983bf96353f937
SHA512 e049d5d43ca46c1e252f7c14d1623c5deef894805b36d9b2e9d62628f883736405f97700e8b5afc65ad4a87bdac01465537b59b745a938d8515b1a7c2e211f6a
TLSH
T160E020994AC5C66ED99068475194930CC3D03A8BD3CCBA891F85848B74C104062DF5A0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 6f0d79149bf084881107db81265b7e79860c90a27caaac1b69f2e90d15817246
MD5 c9641d41bcb93b99bd81db41dfc3bfe2
SHA1 d395ef5870c26b5595dbca8ac9a180748d2a7b68
SHA512 fda43d5c372619809d9db193be7395412874b77e7ac9bef94b819606738bc70cf1c7d9b60c9be3ce4ffa3249a60d3e672eacd2e6a4684d4f96ac6fb31573b570
TLSH
T1CCE0789407CCC66DD94069C79174430EC3913A8FD7C4BFC51744CC4978434447AD77A0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 2KB
SHA256 358a54606c75a92083e83e88ed0bf6cf755ec55605e0d2c27fe9af60e00fcf9d
MD5 9cbd08118847a6acbbd3e924ce1d115e
SHA1 eb72be90a68733069ed6f0f366108be7b987a28a
SHA512 ff9f7bc4e041c4366c2380106219545120bc170a35e8957f5158672370694204a52d5f76ad31af03e7b7e033d809ffd55d73601c847f84267fd870d5debea62f
TLSH
T171512D1DA33514D2E3240772BDD394883FF5CC9A08075E1BA0409EB868C2F17ADD2AD3
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59d8d2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59d8d2.TMP
Size 2KB
SHA256 4274060134cc02b88eec860d1fe6b31bcee4fb0c98871600a12a7556ed30c584
MD5 e25bfd0f96c1188d1907bbd6c6c0375f
SHA1 364158743dd2b2bc6400d7c68341e3fda0fcc83a
SHA512 6fd5e7b84d8c5b6b2480b502684fe5217e10cfa723c1a3a245ef3a3539d4c3c57eb47c87e19f7203f1d174e44a68992ffa9a3f6323308e4bd58919151e05ae41
TLSH
T10E512E1DA37615D6E3240772BDD394883FF5CC9A08075E1BA4509EB868C2F17ADD2AD3
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\file__0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 94f9dd2bbffca01f54ea397b20555009c7a51715b8762c20258802645d5a96ec
MD5 242ef039ec5761f17849b7433da28537
SHA1 f34273fbd61366c37ae1d614af197a81d1613619
SHA512 4937b63e3be9ec84d65b46848ce4ea3e819542c47f32bd022e99e30efa6ca71fb2de2cd4a253124b169df68f2754965328226d6616d7da058474d000f23d6cc9
TLSH
T14A51ADF783F4837E891156F09A14AE2FCE1D052A432C7C6689E4AE1B63F2471E14179F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 a422552eddf0f7768963f1f9c95992f29b7e649c8acb654b53021755db2d630c
MD5 e6639535702a32852571f6abcb16affb
SHA1 e50e0e2b5c510fcecc255eeac7c0faa4e61fa50a
SHA512 57991229ffb7faa47346c19dbeaab9061f5b6c3c1031744a995b65def5e4b63ccfbb5a2bad16ed97bf0bbc60b3ea31e9136017952e4b8213276cbc87561291d1
TLSH
T14E719CF7C3F4867E891156F09A246E1ACE1D152A422C3C66C9E4AE5F63F2471E20169F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 2579291044564b273e3fed2b16093c397a00e7c02e1e65f7d9a666f924e0b0f8
MD5 c0aae267510e6c84661d27cc1d2f2a0a
SHA1 20bba048bd45faea5a2014a3cd4d662ee48b155a
SHA512 1d871c4f907e2ffddc7bb4e4097069975e5dc348acd4f3d8f34dafc7d1bc823261141be7114bcf9d8b6eacb6362b008eff94eb0246f2c4cf0a369b01d243e136
SSDEEP 192:sxRkRJbx/f+sKpprQ5ZzoA8p4b/g6+WNIYn8USwBQGyIgDjJ:sxRkTx/f+sKpR2/5IT0BGJ
TLSH
T1ED32A6166A68A83B4CC7E21DBB55BF53E6F95033B1D41E48AAFC9B1C04E66CD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 3583abf6aab17036847e6a0f26b17bc8330b15405c0f522f0d9cc1e2e17296d3
MD5 8067670b623d1bafeff337351ad4dc91
SHA1 96b4f4bddfe1eddb0fabc4f1f55e40b543c2fb6a
SHA512 7836a5e57d9b8fa0c7e5138f76fc8cbe96c09c5a6be750dec3122fd6d0676bb8c70dd19f986ddd37414fc6b9a1443128051baacedc0b5a3a92dc733d392f83c2
SSDEEP 192:sxRrRJbx/f+sOpprQ5ZzoA8p4b/g6+WNIYn8USwBQGyIgIJ:sxRrTx/f+sOpR2/5IT0BGs
TLSH
T1B032A6166A68A83B4CC7E21DBB55BF53E2F9503371D05E48AAFC9A1C04E76CD120780F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 2cd950d476b6d064438c724cb3cf24215d90b367dc217109b6835d6a161fd934
MD5 e945eeef3639f2525edc3533e33717b6
SHA1 740f2804247a62b10eff2da15e21cbece606fd02
SHA512 651f9b065a599317e89bc6482b774b9b9721f0d4c4ca1980c9d0d8999f788632261a44036066cc8dc1e2d5205f5947d5685a008147d72eb3ce174cd0239fc384
SSDEEP 192:sxR5RJbx/f+sKEprQ54zoA8p4b/g6+WNIYn8IwwBQGyIgDlJ:sxR5Tx/f+sKEU2/5IT8BGj
TLSH
T11842A6166968A87B5CCBE219BB55BF53E3F95033A1D41F48AAFC9B1C04E76CD120780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 0b042b2bd01edcee21c25d3abe0afed1b96201877ddca5a14859c0f01702c13c
MD5 8e90e0db4f3f8e406f77228fc137f7c6
SHA1 ea9c68500f80fad298a1525f9a829e52ca3adf16
SHA512 5046c1b1edda05dd176f32157f2c4bee7976f16cc7f757f9cf9311147ce108d556ea1de49e350967922b61bde8784e76e8d76c8603dae79400e4f38220e35904
SSDEEP 384:wum8dzAfCtgoSFf6MKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVU494oRPCrohMc:wb8dz6Wgouf6M8F1+UoAYDCx9Tuqh0V4
TLSH
T19AB2EC3B604DCB7E5F800AADEC19AFDB7D9802C79A988D4447FE950C02C77EA51194DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 370B
SHA256 d2fd4f7f67a981799eadcf6a75600a872d082e19099c60b136f6dd6807611f1a
MD5 d319dc96ff6149542cc7a6ef0f69b549
SHA1 16818b595220d765618c73dd8279b69ca8cfdc42
SHA512 9d107dcd8e88b782569b59129085e76655eb429c6e6ed789e79da83e9e221b292dd857c1af932a28794ac683ec7714472aa86b6caf3b271ec86dbf9e70cb486c
TLSH
T17CE020773FF72804FCEFD7DA283564510510B464844EBD4F7815E2D714B235434AAC25
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\5525deaa-5499-4aff-955e-76359f568ea9\index-dir\the-real-index
Size 1KB
SHA256 bb0a600f7848ac4331fbb86c4760af94ffa981a3b223cd5f159a4e56b2765840
MD5 ef513115b794309be1e69d34edcc8ca9
SHA1 378911581dbf2cc2571d9e4bbd77b30d5261ce50
SHA512 41dae7920b57739143ba11aba52d0b26113608993e84636526d1362a6f4036752755d1567b4b09639caaef0bf3e4e8f2542cb05fcbfd27c201596888689ff258
TLSH
T14131934CCD8077CED4B062F6259804B267F51D24FC1CC28182A4B16634023B45B0B5FD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5a375d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\5525deaa-5499-4aff-955e-76359f568ea9\index-dir\the-real-index~RFe5a375d.TMP
Size 48B
SHA256 356b4cb5fc3abeef7517cc9435fd7e010fef9d511afbe84d7bfddccc000c720e
MD5 eacb257e5af0a362c56faee6c7820820
SHA1 4d561d2ea15bfbf8e7c7e809794e9e61826753b0
SHA512 6ba449d78a35438d288fec6859736162b305fd5b8eb01dc9f287f2842e098a7409dca39a1ce7139a195c92b9b1873c26370fee173a551e49bfb6961b5c06b309
MD5 SHA1 SHA512

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\index.txt
Size 182B
SHA256 946233a312cbe3b8b02babf2c8523f567363c6b14730a1008b72d7b8d35314d2
MD5 27e173fd4307119bc37e8279590a2db3
SHA1 68c2b2e24a62b5f10ce027fdbef560051032d511
SHA512 3c49eb427e9ec600552d0fbb4261c6d91c9f46b103ade4a06819b05d27516d0fc709903bc85568a04cde99e817662e4b417d959a75207aa696cdb28e70d68e97
TLSH
T12EC0C0C043F3DD10F3AA4F014210080514139C05E48C854CF00C30C32838020C89DCF7
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\index.txt
Size 98B
SHA256 6c9ee1dde94bcee408190131c902463e47910a9cb57dd5e04bc39fbaabd069eb
MD5 65ae28f1caacfee0ccdcfa856e077d1c
SHA1 9ba902fa674859b4c149e7ab2673d464f6a03c00
SHA512 bff5768bb29af20b15660f31e2d48b4fc85b4f73477a4387ae23121b0da84a5bb61b3a09cd7f9ebbdb441b5a3d1bc855239a0188d3e5092ee3dea262484077a5
TLSH
T16FB012C05212ED25A3FE4B1642040D0A3C1BD200A458595CF05D14436E244254CD9DF6
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\index.txt
Size 100B
SHA256 244c252d6cf2754e54cd2d8b33ca255a2aec758d0b831d36ec808e217b8b25b5
MD5 0d03381950081d8f65e8845f78e16cdf
SHA1 f58a8bb6973c0af6deb25b5b2bf9094e0edc86a0
SHA512 80bada1ad7f57dfc898a2a1227ee5c9feb590ef549862f099071d7f6fb52e3afcda543a2fc55d7e03064e0e391989550f07a1bee24ba9aacca0e5b23724ef8c0
TLSH
T15EB012C05212ED21A3BE071A42040D0A3C1FD1049498A96CF86C14876B184264CD8DF6
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt~RFe59e4a9.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3e8ad32ef6e0ff2c8dfb0722a7a862f0a1038fb3\index.txt~RFe59e4a9.TMP
Size 105B
SHA256 ce7572bd032bd9ff924af82c4c96f99625c90059d1e9727dced35cd8fe55ab3d
MD5 6bfd81afbf0d25b52f8fb6cc3c3ad181
SHA1 b9f1524c049c6057e02b334cdc3ebba6774bbd55
SHA512 11e343ccc1e6331e3f84238aa40c453f238f9f8360b8d0873175570fcc611c0d5f7044f6e0f425f372520c94ca05f61c1dd80b8fe6f07def9ca591b1227e2955
TLSH
T1C1B012C06121AF21A3AF071382540D4A3E2BDD019848595CF05E30437A344268DECEF6
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 58d18997843b9f0cad77c46690ac8879073a055ccdd38aa3f0b3909e037ed1eb
MD5 6af8e4b502d9d7a58bd2c413fb77216a
SHA1 8067d76da0d81892d83e4a256f6aa35dca0c8db2
SHA512 2faa401a2d6a3647452d6f0dc7f215ee3e38e0ba35ec8b90ef61157ab574869ee4f8d28343a4bb6d5194e259912af18f8ebb163bd62f37eea6e5d90b2bcc7dfb
SSDEEP 96:KRoZs4q26gWeDzgggK41gCgcwgziItHU1gkeCGEWCPvgsEK4hgmEcEkvebi7oUqN:CoZs4q26neDsgU1gC/wgziItHU1gkeC/
TLSH
T1AF9196D1357B02843C3E692C88A8995AD2817C63355CB8BB3BE841654F67E025DFFCC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 d116e910b996330e0af5efade0dc2cfeb7e5baa96ce4b43a1321bc00d3c8b052
MD5 5dddaff2a2f352f59d3785e1a1112ec0
SHA1 527128c7c8288117f1c5d93b32608c0693fc19d8
SHA512 ce08db3fd4120481ead9e91785a135a943012ee9b53a577d6cfa67a2b0228dd8468a8cc24195cb112011ae22fe9ce8025737fa565fc3c549433c989a9fe9dbc1
SSDEEP 768:lu3bwJXDZIO0Z/abNzc4ReyIsPdPi9Pmtl:lu3ubtc44bsVPZtl
TLSH
T16CF2B071F8749D63ACFAB781B60632127EF59127D1C86BD4DADDAB0C09471AE031B827
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 6c0fe695f9ca7b381a3d0121c9de702a12647e02af7844f6623512b6332dd9a7
MD5 5c6cda0adec666226a6d7c57c9e40ced
SHA1 ccfa2a162f0ecd9077e1339fe7c9c00c877bc1a1
SHA512 d044d5a9b340928bf1b04802591d34b00b8feb8a2ea6babae380d16ebf08e95cba6aa5ff8b14c4705ff624fa270351998997b2fb382f54942cb95cafe1b7a822
SSDEEP 768:zrv+4UNbdV3IwnXDZIO0Z/abNzc4ReyIsPdo2S:zbsbf3Rbtc44bsVod
TLSH
T13103BD32F8789D77ACE66681B20B75537EF4921782C91B94C9DE6B0C064B1EE131F923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 b27fc90abeece703d2f8c2ac76d76dd5f896be26e32d1c65be24793e3ae5bb53
MD5 0b59d044c0fb2ad51ffdd9fdcc1e6935
SHA1 426b3916816c4d55a276308fd3cd73daa5639b61
SHA512 6626d6d988e8a873fc386b4240eac09ebd494d6692a7dd884048aeb6978b0cae3daabfeb0dc95e2f59532878c2496fefe31d47e719a28a24486e949619a0d470
SSDEEP 768:pu3IwJXDZIO0Z/abNzc4ReyIsPdPi9Pmtl:pu3fbtc44bsVPZtl
TLSH
T1A9F2B071F8749D63ACFAB781B60632127EF59127D2C86BD4DADDAB0C09471AE031B817
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 9286e8ef1e3072af2de24e86c8f7d305fa75b7539a8370c607ea39eb2f43e1c3
MD5 449343ee6e4b21e0c6f906f8ae705394
SHA1 834346d316ba6b38fea2da24316c6a757b7fc4e7
SHA512 870e141347a73e69aaefd895c5ff7d0de548cb70edfa1ec0cd47cdd87b2ff07d166f0b11478c97aab029c6b557872bfbe44fa106964f9f86a62e96d5bdee0291
SSDEEP 768:EFQI39wgZwJXDZIO0Z/aQNzc4ReyIsPdPi9Pmtl:nI38Qtc44bsVPZtl
TLSH
T1EF03BF72E864C967ECFAAB81F6063212BEF18167D1D8ABD4DADD9E0C05471AD031BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 ba4a87b26c3f48494c378cd2dd577c3d719b9533eab03dabecbfe4bdeab7fbb1
MD5 6931e4f763521efe1174818661689c08
SHA1 7017f37551180e9f5bf7f2345651635816c7f9b4
SHA512 62df247c67f4a67ad065824370880a012acfa0d28e1eeb203ca809682ad69e8e398c72c3f20cccc287e086fc88bd456247ef3c5adad9449c11284b7b3cd9d678
SSDEEP 768:6rv+4UNbds31kDZIO0ZaNzc4ReyIsXseVH1S5D:6bsbS3Ctc44bs8EH1Y
TLSH
T10F03CF32E8789937ACE66785B14B76533EF8912782C81BD0C9DE6F0C4A4B1DD131B923
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 e98ef136a9da792015be964d06c847231d5f6fde8bf5f8def86c71a924224958
MD5 2619e2d51c9b89884d92772b2af38360
SHA1 cbdbf6c76e0132d31f6b8e058ed982cb7f6500ff
SHA512 96b70b45d50c1e75eaece7226cb162d0f92de53a382c26f218320d272de8af3437799312b23631ee358fb23b4f60e7e8dce8ba1786ff194bdcf212bf2ee5befd
SSDEEP 768:Arv+4UNbds30tDZIO0Z/aKNzc4ReyIs2deVH1S5D:AbsbS3MKtc44bsmEH1Y
TLSH
T1AC03BE32E8789937ACE66785B14B71133EF4921B82891BD0C9DD6F0C4A4B1ED131F927
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a56ab0ed-9a35-4c5e-b590-30407e835145.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a56ab0ed-9a35-4c5e-b590-30407e835145.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download