hxxp://gardeningbeyond[.]com

Analysis

user interaction
yes
max time kernel
298s
max time network
301s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/08/2026, 12:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://gardeningbeyond.com
Sample260816-prcjasbj3v

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1404	msedge.exe

Checks SCSI registry key(s) 3 TTPs 4 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\DISK&VEN_WDC&PROD_WDS100T2B0A\4&215468A5&0&000000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\ConfigFlags	msedge.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CDROM&VEN_DADY&PROD_HL-DT-ST_DVD+-RW\4&215468A5&0&010000	msedge.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\ConfigFlags	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134313572159030887"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{D08C44D8-195E-4835-97B5-3644122B98CE}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2500	msedge.exe
2500	msedge.exe

Suspicious behavior: LoadsDriver 4 IoCs

pid	Process
672	Process not Found
672	Process not Found
672	Process not Found
672	Process not Found

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe
2808	msedge.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 2808 wrote to memory of 8	2808	msedge.exe	85
PID 2808 wrote to memory of 1404	2808	msedge.exe	86
PID 2808 wrote to memory of 4948	2808	msedge.exe	87
PID 2808 wrote to memory of 4948	2808	msedge.exe	87
PID 2808 wrote to memory of 4948	2808	msedge.exe	87
PID 2808 wrote to memory of 1288	2808	msedge.exe	88
PID 2808 wrote to memory of 1288	2808	msedge.exe	88
PID 2808 wrote to memory of 636	2808	msedge.exe	90
PID 2808 wrote to memory of 636	2808	msedge.exe	90
PID 2808 wrote to memory of 636	2808	msedge.exe	90
PID 2808 wrote to memory of 2060	2808	msedge.exe	89
PID 2808 wrote to memory of 2060	2808	msedge.exe	89
PID 2808 wrote to memory of 2060	2808	msedge.exe	89
PID 2808 wrote to memory of 5040	2808	msedge.exe	92
PID 2808 wrote to memory of 5040	2808	msedge.exe	92
PID 2808 wrote to memory of 5040	2808	msedge.exe	92
PID 2808 wrote to memory of 1748	2808	msedge.exe	93
PID 2808 wrote to memory of 1748	2808	msedge.exe	93
PID 2808 wrote to memory of 1748	2808	msedge.exe	93
PID 2808 wrote to memory of 1796	2808	msedge.exe	96
PID 2808 wrote to memory of 1796	2808	msedge.exe	96
PID 2808 wrote to memory of 1796	2808	msedge.exe	96
PID 2808 wrote to memory of 3940	2808	msedge.exe	98
PID 2808 wrote to memory of 3940	2808	msedge.exe	98
PID 2808 wrote to memory of 3940	2808	msedge.exe	98
PID 2808 wrote to memory of 3848	2808	msedge.exe	99
PID 2808 wrote to memory of 3848	2808	msedge.exe	99
PID 2808 wrote to memory of 3848	2808	msedge.exe	99
PID 2808 wrote to memory of 4696	2808	msedge.exe	101
PID 2808 wrote to memory of 4696	2808	msedge.exe	101
PID 2808 wrote to memory of 1856	2808	msedge.exe	100
PID 2808 wrote to memory of 1856	2808	msedge.exe	100
PID 2808 wrote to memory of 3396	2808	msedge.exe	107
PID 2808 wrote to memory of 5196	2808	msedge.exe	115
PID 2808 wrote to memory of 5196	2808	msedge.exe	115
PID 2808 wrote to memory of 5196	2808	msedge.exe	115
PID 2808 wrote to memory of 5616	2808	msedge.exe	118
PID 2808 wrote to memory of 5624	2808	msedge.exe	119
PID 2808 wrote to memory of 5632	2808	msedge.exe	120
PID 2808 wrote to memory of 5288	2808	msedge.exe	125
PID 2808 wrote to memory of 5288	2808	msedge.exe	125
PID 2808 wrote to memory of 2500	2808	msedge.exe	129
PID 2808 wrote to memory of 1932	2808	msedge.exe	130
PID 2808 wrote to memory of 1932	2808	msedge.exe	130
PID 2808 wrote to memory of 2700	2808	msedge.exe	131
PID 2808 wrote to memory of 2700	2808	msedge.exe	131
PID 2808 wrote to memory of 3396	2808	msedge.exe	132
PID 2808 wrote to memory of 3396	2808	msedge.exe	132

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://gardeningbeyond.com
1⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x248,0x7ffbf4cec188,0x7ffbf4cec194,0x7ffbf4cec1a0
  2⤵
  PID:8
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1756,i,14391771536483745104,17758726852460992812,524288 --field-trial-handle=2316,i,13828525072534051125,4311614157552127973,262144 --variations-seed-version --mojo-platform-channel-handle=2420 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,14993142136144229787,860578625270984274,262144 --field-trial-handle=2316,i,13828525072534051125,4311614157552127973,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:2
  2⤵
  PID:4948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2436,i,10332996685261502218,14331588932812754823,524288 --field-trial-handle=2316,i,13828525072534051125,4311614157552127973,262144 --variations-seed-version --mojo-platform-channel-handle=2656 /prefetch:8
  2⤵
  PID:1288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3200,i,1752933866925532068,10240080477063031930,2097152 --field-trial-handle=2316,i,13828525072534051125,4311614157552127973,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3192,i,12449832795618342088,11579078187474187728,2097152 --field-trial-handle=2316,i,13828525072534051125,4311614157552127973,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4176,i,11703411598663649246,2084563334870184983,2097152 --field-trial-handle=2316,i,13828525072534051125,4311614157552127973,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:1
  2⤵
  PID:5040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4196,i,10134689676074287876,9302845540458326873,2097152 --field-trial-handle=2316,i,13828525072534051125,4311614157552127973,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:2
  2⤵
  PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5060,i,9367599717609413846,16258516798271310013,2097152 --field-trial-handle=2316,i,13828525072534051125,4311614157552127973,262144 --variations-seed-version --mojo-platform-channel-handle=5068 /prefetch:1
  2⤵
  PID:1796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=10 --always-read-main-dll --metrics-shmem-handle=3960,i,6809375146976036293,942927407261109255,2097152 --field-trial-handle=2316,i,13828525072534051125,4311614157552127973,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:3940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=11 --always-read-main-dll --metrics-shmem-handle=5052,i,13579695138846100719,12797743902905066374,2097152 --field-trial-handle=2316,i,13828525072534051125,4311614157552127973,262144 --variations-seed-version --mojo-platform-channel-handle=5412 /prefetch:1
  2⤵
  PID:3848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5408,i,16386143548863463414,8844531760343662872,524288 --field-trial-handle=2316,i,13828525072534051125,4311614157552127973,262144 --variations-seed-version --mojo-platform-channel-handle=5536 /prefetch:8
  2⤵
  PID:1856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5520,i,6188367966503844173,9773749768895542376,524288 --field-trial-handle=2316,i,13828525072534051125,4311614157552127973,262144 --variations-seed-version --mojo-platform-channel-handle=5564 /prefetch:8
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,8004042755986738516,14192385804692661531,524288 --field-trial-handle=2316,i,13828525072534051125,4311614157552127973,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:8
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6312,i,8004042755986738516,14192385804692661531,524288 --field-trial-handle=2316,i,13828525072534051125,4311614157552127973,262144 --variations-seed-version --mojo-platform-channel-handle=6300 /prefetch:8
  2⤵
  PID:3396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=4860,i,10954538247864343205,8524510277790958653,2097152 --field-trial-handle=2316,i,13828525072534051125,4311614157552127973,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:1
  2⤵
  PID:5196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7008,i,16354831867569239234,1886144673520870532,524288 --field-trial-handle=2316,i,13828525072534051125,4311614157552127973,262144 --variations-seed-version --mojo-platform-channel-handle=4816 /prefetch:8
  2⤵
  PID:5616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3180,i,9059230336958817073,17047657167651706718,524288 --field-trial-handle=2316,i,13828525072534051125,4311614157552127973,262144 --variations-seed-version --mojo-platform-channel-handle=4808 /prefetch:8
  2⤵
  PID:5624
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5216,i,5500989373893462138,9702782851704549543,524288 --field-trial-handle=2316,i,13828525072534051125,4311614157552127973,262144 --variations-seed-version --mojo-platform-channel-handle=5324 /prefetch:8
  2⤵
  PID:5632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4816,i,4108520275620655575,5506299306294215337,524288 --field-trial-handle=2316,i,13828525072534051125,4311614157552127973,262144 --variations-seed-version --mojo-platform-channel-handle=2120 /prefetch:8
  2⤵
  PID:5288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5216,i,5304311087829534946,12645493999087002146,262144 --field-trial-handle=2316,i,13828525072534051125,4311614157552127973,262144 --variations-seed-version --mojo-platform-channel-handle=1876 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2500
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3356,i,644015735626373341,16820693724280052208,524288 --field-trial-handle=2316,i,13828525072534051125,4311614157552127973,262144 --variations-seed-version --mojo-platform-channel-handle=3400 /prefetch:8
  2⤵
  PID:1932
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3656,i,2509387400309493781,14257356386513507873,524288 --field-trial-handle=2316,i,13828525072534051125,4311614157552127973,262144 --variations-seed-version --mojo-platform-channel-handle=4652 /prefetch:8
  2⤵
  PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5764,i,16231308054747889238,13256648009583978015,524288 --field-trial-handle=2316,i,13828525072534051125,4311614157552127973,262144 --variations-seed-version --mojo-platform-channel-handle=4820 /prefetch:8
  2⤵
  PID:3396

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5084

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

84f4a84f-51eb-430f-ac3b-29076b68c55a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\84f4a84f-51eb-430f-ac3b-29076b68c55a.tmp
Size 20KB
SHA256 ffcb913b46d6f427c1b2f95cd79bd4d27bb297eb07a973c0522bfa7246234227
MD5 3cada45ce45f67e780cd19691ca2b885
SHA1 186dea26e6f759c928e06477978b9fd8f4b953dd
SHA512 c80aea05cf0592fbe49664cd835a2881edfe87d81d5c30a17015044e71da80751c99b2c297bb301ac127a288fac509e08e4ff7ba009d20d56fac1f46bfe12b8f
SSDEEP 384:XZcIhsNz5xf68CDkGuf+68R+XGxJrE3FUIQ4EXGPUp:fh6keZEhyUId3I
TLSH
T125927D319C386C7759E2B541F88A36539FF81067E7C96F88E1FCAB1D009B6AD1306C22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 b272682ea7906ec234a6adc97e866d560199bebccc90035515a0506daa0cbc06
MD5 2087307a98b68b7455e5b6644cd1f9a3
SHA1 5d88b0b7fb83ec055322678c804aba5282ce7133
SHA512 e552a0107a66abdfc9962bce37c7382a3e669bf5b4fc9be6fecd515362f46a954409460e0d29930c8e1cf7c0244a03613787b1a6084a6a6c12161668dbb2f5b8
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7b:fwUQC5VwBIiElEd2K57P7b
TLSH
T18EB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 3d4a599c612694b614ba7c8e8efa5c94b221ade6a1a44d0b68472c17fbfe4598
MD5 b7a429b099eba1a8e9cd144e4d00599a
SHA1 e087a559e4468b4c6b5596bf6fe6af3fc3affe59
SHA512 49ab5ffa12f6d0bdc5a8d4aacc121fa8c6c253560915cebe1d462fd6f5f859f005f30761c684b7bc0bd2642d039f068c353c37babcb54cc98e5a33b9c8ac49da
TLSH
T103C0809CBD4DD4DED381187E5716F00007606512941796130650BCD07580DF41E39120
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 3KB
SHA256 f5222724252c536bc65994930443aecc515a254e6e07083ed57550e63ed3211a
MD5 233f9ac40a4c0308ea101e7a389aaca7
SHA1 9d240042bb4da8093b66870900da67830455814f
SHA512 8b63770b0113261d633d31ccff5ff470f937f86c42ffc6cedb6b851b82b866f8d9153bd2ef7f14f9444056420ece43f2f89e5bcc5fcd1fcfd5f7a6568491c5b7
TLSH
T15181E66FAC4201C7EF561531D6D90903373E8D990613BDD2125898BEB41EB63F1D9D78
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 96397c6e7b8da3cdbae9df711d907e5d7a092763df03bfe6e6135adcbb8ee16a
MD5 72428b891e3c96ebd414a762bb4a7fdb
SHA1 a0a30c51e43bdac7f51388ab20951112c3183110
SHA512 de8c8dcb3a825c852c458354ad090c4810b29a9fa7958732dd4c97b8d13b907517c6d3a4b7d8906623a3f3a72068e4a71b146726ea4083a6b68acfeb7aeeaafe
TLSH
T1F871A36F8D4201D3EF211131D1D90A03373E9DA94A13BDD5125498BDB81EB67F4D9C78
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c946.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58c946.TMP
Size 3KB
SHA256 d2d44a8205f6dc51396df4a525f6153aeeb53117dc730b565ba600ee3a29ee48
MD5 6b60c4e90cd77d8f1e35cd198f9e18c0
SHA1 944d55d281aac9c76912291bf6be2a4a72161ff8
SHA512 21bcb33f4721a2018e115723f464a56c8cf23a2960f860aa29d736f8936f14404fb046492227be4ddb8317d4b1da955adf84d675093ad18492dd83f6a27e2523
TLSH
T12171816F8D4201D3EF211131D5DA1A03373E9DA94903BED2125498BDB81EB67F0D9D78
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 4a965dc92a3dee06df612f5f87b34ebd3be9ae7a86909fa130146ac6f64ce14b
MD5 9ca1d9d6f15464f6baba6ded537c5bea
SHA1 13c89b83d0bcda80041cdb13898cc0281af15cbd
SHA512 a9247a7775cc9ed65259a253ca7714913c383787073af24d4e4d49ee0351c66fb4102702c0f05edd36c2d5ab80d847f45371adf259b0a4ae5fa25cdd0fbbed57
SSDEEP 96:DuO0uCl4Jzw4DA4wa1qhTpzG5i0yt0EkLA:Dd0uClks4DA411+Tpz4iPt0Ek0
TLSH
T1AE9168E3C6E5966EC96116F06A146E1BCF6D0E18436C390AC9D8AF0F97F14B1D210A4E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 b55b2504cb3bbb89e859c172218d76d551d5b0cf8835780903281960bfa7dbcc
MD5 2cc25c95595730afb2b759cd5a0b6258
SHA1 08146e171a0cf5fc8e2c49679750a4b92b0efb30
SHA512 7f0ba369a0a86e4e824b151683a3c1b81975b9857145a727366ce27f3d3dd300572c5a15e0be09111ae15dd1071184bdc270844c312661d17180c194c299ed50
SSDEEP 192:sxZaR/yM/jK1Ml8UQSkD/fqsDD1nIdpijKHW6+WNntbXYwuGS6Ig54J:sxZadqRD/fqsDD1oJHbtXh6
TLSH
T18452E612AA349977CCDBE209FA45BF53D6F5107292941E44AAFCDA0C01E6BED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 e2a12edb83f4d0aaed959beb2feaf41fa89b42afbf15d514ee4341508097c1c3
MD5 ac2cadecd7c0f9fc9628d8f986a4eeec
SHA1 a2545d596d848c7d56ae31cd0d74c6b3b6be4533
SHA512 e82aeedf7f6479eef7e325bf0f5bdcbfd664d59e9c5cf17495eae1a7970271a45d268da8d5ce13266802318ea0576ee7f2cd65439378856a9736e5ac60368bb8
SSDEEP 192:sxZaR/yM/jK1Ml8MkD/fqsZDxRIdpwjEHW6+WNn2D/YwS9z6IgrJ:sxZadMD/fqsZDxaNHb0/P9
TLSH
T19D52F8126A34A97BCCDBD208FA45BB53D6F51572E2940E44ADFCDA0C04E6AEC2207C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 4ddc35df4b7181f6de8fe6cc9d6e7cb2437d3862fa91c25d554bcc59a89b2141
MD5 34151c071b105a17f245771020ce346c
SHA1 6698523967feec4d5af7916d2408791e9e8acf92
SHA512 e6999b6567a42582d3840b7ac52d06211171a8442e44dd8d462d3cc6386c9342d0f5e5b69402f47aabfb73e294e2bb7ec4ea927c56608442ca9211a971403a0d
SSDEEP 768:DM4jeXmWvmKxE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+dMrohP1a4:DM4jeXmWvmKxEu1jacPLZQdXD
TLSH
T10CE20A3B240CCF7E4F844E5DEC26AE976ED802CB6A584D5447FA494C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 3041f96dcc6b7878dd225a893f5ebe4e3015314d27df429443a6fd2fa1f1924a
MD5 6b0789bffff41ab5b454f8ddfa770e4e
SHA1 f723a7a963809283e1d8835cd69818ba38f2d93d
SHA512 646b1fef321ea5ed2d381fbbc0803433c49629d4ad47fd62addd683ea46ee34221f198d0f4bf1beae5dff6bc1ab9ad4ba35f431d32892aa8954ac90c971431be
SSDEEP 24:KdZRfZcZHZuaZLdZzZfZn4Z3Zb+Z+IjZ7ZnKiZwhaZFZn1EZRZ3SmZJMZ88ZPZsZ:KMUIjKJSUjyxEIHK1+cRpINKaAAPyBz
TLSH
T1B091756379BA02016D7E661C82ED9B169D537A63360CF82B7BAD44664D67E104CFCCCC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe594973.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe594973.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 706ed65c014696d414e4c94eac9cedcd990389baa880e5866d3ed94e04d332d8
MD5 72e30d27884549ca1116b03cffec384c
SHA1 3a4ea419553785c9f9c6b36bb5b7f4d3c15f306c
SHA512 35655dc3e12b441d57bac9cc993bf100d32ac5888d039612f1d9c3344b9f46a8db96341dd78e89063dd17659c7d1b7a7bd0ec4ae359019d55f5817106c84681b
SSDEEP 384:diFiZcIhsNN8TUNTUlIl5xf68CDkZuf+68R+XGxJrEjFUIQ4EXGPUp:UFQhkwg5/eZEhcUId3I
TLSH
T16FD229F248D7887BD9AEA743A77D2D138EBCC067B5856A44B3985A1CCC961BFC306C11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 c27f64c9ae14acebb01028de4d878c8309f64127a16859cbda10feb2adc63f2d
MD5 ca37c41489bcfd1991299e4d5eee8443
SHA1 5a1e0e16dcffe6da068f61573b2582da4605296f
SHA512 40935176513eccad81a90bdcd5600fa64f881a9f2d8440ac6244c4c6efbdca8c62cb7e618255724dbe97483aa284e39dcfeeaf13436d4ef3075b7ec67837bca4
SSDEEP 384:sZcIhsNzYxf68CDkGuf+68R+XGxJrE3FUIQ4EXGPUp:6hFkeZEhyUId3I
TLSH
T191927D319C386C7759E2B541F88A36539FF81067E7C96F88E5FCAB1D009B6AD1306C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c8bb7d7aa09cf87cfe384a450967af492d43a64a6eadb862b6a1e50ea0843019
MD5 b6bafcfe73e81eef33433c626f6b3243
SHA1 bdd59a1d124583766c232f5d4a01e9d52317f3b6
SHA512 3335d07b71b2f1254822b2302bc0ed45e9f49066c066dc0ede851a2c2fbfc9b50f57ca30135ab15bb91dddbfe6b50b1aac065f07d1fb7b6b144ae978f01e7fcf
SSDEEP 192:EON86hZ0QmiUypppc/+jVIjzorRV5wOZUT3U6:EON86o8pu+68R02UzU6
TLSH
T18402E935A86C6C778EE2AE45F48727235FE4212BE9956F84D6E81B1C00C775C2307832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6a3b30b15bc64c4c7a4c0c2ab5d76cd753d7f9d7bb3fb31047e854e9eadeac6b
MD5 f0de83129dca69a9229a12e05fb75dda
SHA1 276b7624ade85e13730873e845e8c65203eca07a
SHA512 fc741460ffc7f3bb919a6325fa7c3ac9542d9ab8771ae3b5ce6388830b4c18464550f32e89f4bf06c465b367b7de11b6ada670fee106869457268d37e2d51cf0
SSDEEP 192:SONW6hZvQmiUyHpKc/+jVIjzorR+XKFuSJrES5cOqUXqT7U6:SONW61YKu+68R+XGxJrEd9UIU6
TLSH
T13F12DA35686CAC775DD2B551F48736235FE51127EA897F94D6EC2F1C00DB66C130AC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5488f51f-48f6-417e-9d35-c57c5c12249c.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\5488f51f-48f6-417e-9d35-c57c5c12249c.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 3a48c41cc68284269cb72bac6112382a980ef1aaf6d1e0ba0dd8eafbcf6e783c
MD5 00c20a1e3130be139071c8fdb9aeced1
SHA1 96a3df5b7fc54eb15eb67f44def24908394aded8
SHA512 b934def90dec5abbfdebeb622654dc8e38beccddec0cb63e026d38ec24e1606ad5645da3e089b6ab332e62400b3d0b4d8e90b21e0ae0487b1d009cdd2033835f
TLSH
T1E041DC5877FA1148B7B76E5A9BF6A86E487F7D762E06D05E00010E4F0A63B40CC61B33
MD5 SHA1 SHA512 TLSH

Submit Download