hxxps://cdn[.]discordapp[.]com/attachments/1537441286846414900/1538609436317454386/System[.]rar?ex=6a834d33&is=6a81fbb3&hm=5ebf5db77eea85265563db74cc778147206c66d8a8594b61396dbd979b2d7c40&

Analysis

max time kernel
898s
max time network
729s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
16/08/2026, 18:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://cdn.discordapp.com/attachments/1537441286846414900/1538609436317454386/System.rar?ex=6a834d33&is=6a81fbb3&hm=5ebf5db77eea85265563db74cc778147206c66d8a8594b61396dbd979b2d7c40&
Sample260816-wscc9afr21

Score

3^/10

discovery persistence ransomware

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
3620	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134313774516669535"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3054922120-1500138384-519748408-1000\{670B74C8-C704-48C4-B1EC-B180D180BD4A}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3054922120-1500138384-519748408-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2192	msedge.exe
2192	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe

Suspicious use of FindShellTrayWindow 42 IoCs

pid	Process
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 4592 wrote to memory of 4276	4592	msedge.exe	83
PID 4592 wrote to memory of 3620	4592	msedge.exe	84
PID 4592 wrote to memory of 2200	4592	msedge.exe	85
PID 4592 wrote to memory of 2200	4592	msedge.exe	85
PID 4592 wrote to memory of 2200	4592	msedge.exe	85
PID 4592 wrote to memory of 872	4592	msedge.exe	86
PID 4592 wrote to memory of 872	4592	msedge.exe	86
PID 4592 wrote to memory of 1896	4592	msedge.exe	88
PID 4592 wrote to memory of 1896	4592	msedge.exe	88
PID 4592 wrote to memory of 1896	4592	msedge.exe	88
PID 4592 wrote to memory of 1472	4592	msedge.exe	89
PID 4592 wrote to memory of 1472	4592	msedge.exe	89
PID 4592 wrote to memory of 1472	4592	msedge.exe	89
PID 4592 wrote to memory of 2924	4592	msedge.exe	90
PID 4592 wrote to memory of 2924	4592	msedge.exe	90
PID 4592 wrote to memory of 2924	4592	msedge.exe	90
PID 4592 wrote to memory of 3556	4592	msedge.exe	91
PID 4592 wrote to memory of 3556	4592	msedge.exe	91
PID 4592 wrote to memory of 3556	4592	msedge.exe	91
PID 4592 wrote to memory of 4628	4592	msedge.exe	93
PID 4592 wrote to memory of 212	4592	msedge.exe	94
PID 4592 wrote to memory of 4628	4592	msedge.exe	93
PID 4592 wrote to memory of 212	4592	msedge.exe	94
PID 4592 wrote to memory of 2304	4592	msedge.exe	96
PID 4592 wrote to memory of 2304	4592	msedge.exe	96
PID 4592 wrote to memory of 2304	4592	msedge.exe	96
PID 4592 wrote to memory of 2828	4592	msedge.exe	95
PID 4592 wrote to memory of 2828	4592	msedge.exe	95
PID 4592 wrote to memory of 384	4592	msedge.exe	97
PID 4592 wrote to memory of 2000	4592	msedge.exe	103
PID 4592 wrote to memory of 2172	4592	msedge.exe	112
PID 4592 wrote to memory of 4588	4592	msedge.exe	113
PID 4592 wrote to memory of 4228	4592	msedge.exe	114
PID 4592 wrote to memory of 2704	4592	msedge.exe	115
PID 4592 wrote to memory of 2704	4592	msedge.exe	115
PID 4592 wrote to memory of 2008	4592	msedge.exe	116
PID 4592 wrote to memory of 2008	4592	msedge.exe	116
PID 4592 wrote to memory of 3908	4592	msedge.exe	117
PID 4592 wrote to memory of 3908	4592	msedge.exe	117
PID 4592 wrote to memory of 2192	4592	msedge.exe	118
PID 4592 wrote to memory of 1204	4592	msedge.exe	119
PID 4592 wrote to memory of 1204	4592	msedge.exe	119
PID 4592 wrote to memory of 3044	4592	msedge.exe	120
PID 4592 wrote to memory of 3044	4592	msedge.exe	120
PID 4592 wrote to memory of 2312	4592	msedge.exe	121
PID 4592 wrote to memory of 2312	4592	msedge.exe	121
PID 4592 wrote to memory of 4212	4592	msedge.exe	122
PID 4592 wrote to memory of 4212	4592	msedge.exe	122
PID 4592 wrote to memory of 2408	4592	msedge.exe	123
PID 4592 wrote to memory of 2408	4592	msedge.exe	123

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://cdn.discordapp.com/attachments/1537441286846414900/1538609436317454386/System.rar?ex=6a834d33&is=6a81fbb3&hm=5ebf5db77eea85265563db74cc778147206c66d8a8594b61396dbd979b2d7c40&
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffd4e49c188,0x7ffd4e49c194,0x7ffd4e49c1a0
  2⤵
  PID:4276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1964,i,692588606745056907,14222947233097584649,524288 --field-trial-handle=2228,i,9569018874326702525,6362866021168428324,262144 --variations-seed-version --mojo-platform-channel-handle=2264 /prefetch:3
  2⤵
  - System Time Discovery
  PID:3620
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1680,i,2024901541586737519,10803932408331338916,262144 --field-trial-handle=2228,i,9569018874326702525,6362866021168428324,262144 --variations-seed-version --mojo-platform-channel-handle=2200 /prefetch:2
  2⤵
  PID:2200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2604,i,14920191368483938223,2073583427242313407,524288 --field-trial-handle=2228,i,9569018874326702525,6362866021168428324,262144 --variations-seed-version --mojo-platform-channel-handle=2832 /prefetch:8
  2⤵
  PID:872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,14817066379334012678,10591893096358061787,2097152 --field-trial-handle=2228,i,9569018874326702525,6362866021168428324,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:1896
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,2646318445818007289,4635471773826778576,2097152 --field-trial-handle=2228,i,9569018874326702525,6362866021168428324,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:1472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,5709733892073917095,9538540681773528258,2097152 --field-trial-handle=2228,i,9569018874326702525,6362866021168428324,262144 --variations-seed-version --mojo-platform-channel-handle=4160 /prefetch:1
  2⤵
  PID:2924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4236,i,11170874293649290472,8686409523536875854,2097152 --field-trial-handle=2228,i,9569018874326702525,6362866021168428324,262144 --variations-seed-version --mojo-platform-channel-handle=4164 /prefetch:2
  2⤵
  PID:3556
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5140,i,14203553284715304134,10252707721698470919,524288 --field-trial-handle=2228,i,9569018874326702525,6362866021168428324,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:4628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5148,i,15836747484474108708,17121992047923428198,524288 --field-trial-handle=2228,i,9569018874326702525,6362866021168428324,262144 --variations-seed-version --mojo-platform-channel-handle=5228 /prefetch:8
  2⤵
  PID:212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5800,i,9161505139060689824,3044673876201258298,524288 --field-trial-handle=2228,i,9569018874326702525,6362866021168428324,262144 --variations-seed-version --mojo-platform-channel-handle=5780 /prefetch:8
  2⤵
  PID:2828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5824,i,6437296134046205744,17678396430088186565,2097152 --field-trial-handle=2228,i,9569018874326702525,6362866021168428324,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:1
  2⤵
  PID:2304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=quarantine.mojom.Quarantine --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,16250287925195857064,3859943138986326932,524288 --field-trial-handle=2228,i,9569018874326702525,6362866021168428324,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:8
  2⤵
  PID:384
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6164,i,4363302863232511877,13053958598841784056,524288 --field-trial-handle=2228,i,9569018874326702525,6362866021168428324,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:8
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6164,i,4363302863232511877,13053958598841784056,524288 --field-trial-handle=2228,i,9569018874326702525,6362866021168428324,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:8
  2⤵
  PID:2000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4164,i,14051423667475026264,7587779043527725091,524288 --field-trial-handle=2228,i,9569018874326702525,6362866021168428324,262144 --variations-seed-version --mojo-platform-channel-handle=4636 /prefetch:8
  2⤵
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3224,i,16104378232324940262,9050625821836454731,524288 --field-trial-handle=2228,i,9569018874326702525,6362866021168428324,262144 --variations-seed-version --mojo-platform-channel-handle=6152 /prefetch:8
  2⤵
  PID:4588
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4540,i,5043341976107823466,5177627007795214686,524288 --field-trial-handle=2228,i,9569018874326702525,6362866021168428324,262144 --variations-seed-version --mojo-platform-channel-handle=4696 /prefetch:8
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5376,i,1354432896024942167,12194796662910297225,524288 --field-trial-handle=2228,i,9569018874326702525,6362866021168428324,262144 --variations-seed-version --mojo-platform-channel-handle=4228 /prefetch:8
  2⤵
  PID:2704
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5836,i,1432459597478314264,11913219056633272528,524288 --field-trial-handle=2228,i,9569018874326702525,6362866021168428324,262144 --variations-seed-version --mojo-platform-channel-handle=6584 /prefetch:8
  2⤵
  PID:2008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5220,i,15337003639828787280,17507726800947750161,524288 --field-trial-handle=2228,i,9569018874326702525,6362866021168428324,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:8
  2⤵
  PID:3908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6780,i,11392013092169725430,14863497663233169189,262144 --field-trial-handle=2228,i,9569018874326702525,6362866021168428324,262144 --variations-seed-version --mojo-platform-channel-handle=7116 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5584,i,10779166525877000445,10658615599439469425,524288 --field-trial-handle=2228,i,9569018874326702525,6362866021168428324,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:8
  2⤵
  PID:1204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3548,i,8954492773031772565,5952768200298507117,524288 --field-trial-handle=2228,i,9569018874326702525,6362866021168428324,262144 --variations-seed-version --mojo-platform-channel-handle=5208 /prefetch:8
  2⤵
  PID:3044
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5272,i,14645256967892728950,10924713624511524553,524288 --field-trial-handle=2228,i,9569018874326702525,6362866021168428324,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:8
  2⤵
  PID:2312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7020,i,5866508914189490287,2819944712061912790,524288 --field-trial-handle=2228,i,9569018874326702525,6362866021168428324,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:8
  2⤵
  PID:4212
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3736,i,1225722079236231637,14230917376388136067,524288 --field-trial-handle=2228,i,9569018874326702525,6362866021168428324,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:8
  2⤵
  PID:2408

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3852

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fb2adc73b0e2921e667c28899e7c4f830fbb29c7f563ca0b3319ac4cd7007983
MD5 5a6df42dd698122d665520fb12140c37
SHA1 9d09f6fa2f10e669a83386ff53aae5fba73effeb
SHA512 52513e0bbf5b162ddc3643441c215f197264c32736ed560286ad3dcfba5831b89dd961ff3c2ddda1a50ae1bbaf4589e17ef43817fe8c3294ca18c88dec2e21b4
TLSH
T15DD012317B5BF001C6C120B2D8348B79923F889A74D7C652B024C88EFDF625DA3D6067
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c2c9a9ffe645bb4483011279363f1d6b7efe3d1311c969002595db89e2e28e26
MD5 fd1a71c5f52353ab70a63caeadd8a35f
SHA1 1c2efede69f9484a6b25dfb9879b2e134c0c04fe
SHA512 53bb310c44087d0ad54291ea32ae8e6708d9e6675875d074264aa49b27317393b3c1f0758bd53b04795df767f42392d93ad325da28f085258329151e4a47a03d
TLSH
T12ED09B213756A001C5811071D4244765512E44557497C6527014844DEDB61595395057
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 e983198af5c643e5ec06cc503ab331f2c1a6af18879b9587a68bcb2af2429012
MD5 2f6ff8cd694678d165fe02038f06d2ce
SHA1 b700e34931a092aa74c4cf1d416b8847744e6bde
SHA512 96f04917762c73d4bf40de440cda7bef9c7e1af9a2b2dd221d9cf946a87cccaa6afa80a7c1c5f1a37a039191248db40622d515e86323f0f9d12033c4b1db88e8
TLSH
T1E4E026C896CCC66FBA88648B5278674C83C1374BB3C8B95F270088897281084A787798
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 b661c1ec298ffd0b1b40854117a70b0c117e7de5f97b7f32fdd21a60428a71ef
MD5 7b8ae4938cf4411ebc24d7f907a44bc0
SHA1 8cfbbdde7438038f32685f579e08cf02c41a93c5
SHA512 e1c70660214a81241188487846f24a1df7ddadbb97273ab1299d35ccc332db2eb3c5397bb003c89d71d0ff6fdcdb0d3eb7f16b42666b73f7627e9e86cd695c9c
TLSH
T1EBE026C516C8C23FBE906CCB51B8670C8380374AA2C8B92B1B0084887282040E7F7790
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 29b3fca389d71f0a68f41d21318ff6f020954c89579e346e91bf651adb45aeab
MD5 dc5ff6b9aa28191e133275bc1aef6e28
SHA1 bf17c47d61fd7e1b0a7f9cd3b803fba589eb149a
SHA512 e335334e55a85d31219273fd575b06ccc707d3dc418e43c859664adab38b901ab558676f7a6189ba5b1890d70ba45bb859c749f4fe0703f019042e59060371a2
TLSH
T18FE0208525C5D25D7B8064875179674C8190379EA3CCFE4F270684497045040F397750
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 6d0367e6cfd5dca86800df85342dce1e1ecc7678b6a2b27143b8902da30513fb
MD5 9169478f4a5fa65cc5df2316f5a303a0
SHA1 eb8d5db6392609a7cb7b116d09a243d26d238643
SHA512 9e7afd19435bc30dbea375309317622f14b1410b7e199b43061ee21fae55d3bb820669d3478b067a50d18d3429f9a2c5fc61dadd0090b9f5a142bc430d6257ae
TLSH
T1D5E0DF8426C8CA2EBAC1648B6168630CC289378FA2C9BD1A5704C88DB10D044BB9ABA0
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 01afecb17fc3323a3d4a82ffae50338dd7763378ca8ad8b34872ef4c9795a45a
MD5 b78e86fed016c8e9682864e50bdbe458
SHA1 829b3212b43f2f17c6ff37a5f78616c0474684d5
SHA512 33c07d16953824e4a0430e1670b9a93e3210d8fe97aa7e0382da22a1831a8f289b3f0a63e91af97648c1bb488ac4a503b8298a897747a4d78edf4dea33d73d26
TLSH
T10E6170B9C22281F1E7A3D07263C3423039F99A77B957EE82A1A8D4797D32F327014218
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a217.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58a217.TMP
Size 3KB
SHA256 5cd3e34c075b9c4dfee5fbf08a5be989692d32110247118e90d4870ffb7890e9
MD5 7b23fc5a74a9c4f36ecbfb80534b3d24
SHA1 3aad1d796669922bedb676834a6cea8b2fd41d95
SHA512 a405808100b6a0946058371649dd2354d5a04de79296015a14071bb44a7d3a9136e3396dddd9197068470fec1dc93050348151cdd78885200b0ae575dc9aa256
TLSH
T19B6172B5C22281F1E7A3D07263C3423439F99A77F817DE82A098D4797D32F327454218
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 399971a9da6fe38a3b16abb49bcb6c51a425dd2231df9d1d326c91b0084067b5
MD5 9e5fe4f5b2e9a9f1f877c4384da9c054
SHA1 c8ea6c133bdf184f2379e33aad973c648ba6d1a2
SHA512 a6fbe730a9f8bcc432c15cced466bc5d33afa8bedaf9d6eb35bc999046ba037b6473899a47491a36886daf21a1c2999d725076a29adc2533c1f5e1f3d9e6c5ea
TLSH
T1B2217BF387E1865EC90516F06A14AE1BCE2D0515432C7C2A89D0EF6BD7E3072F042A5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 1bab8899f03474e154bb2ca7c651bcc336d694e344c6edfc9ec955d7000dd675
MD5 45a56bba8a76e6b89fcd6b0b554bdc37
SHA1 ec371c05a74b27c30f38599b6c2208d9162c0137
SHA512 c3b2e740d9d58d1977d6bce99534185d2335a34d4c7b2a0a05d1afc9ad28aa787188c2f6e1a74a13f805519e7dd4ad3bb62ecb6e83d56f56fb5b5866ee7b5603
TLSH
T1A42178F7C3D5866EC90566F06B14AE1BCE2D0A1942283C1AC9D4EF6BD7E3072E10194B
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 bda6799ac8ab4977fc2455797764be640fe811d658fffc6d61017376a89e0eec
MD5 bafa70bd7f32b80d2d10168e6896007c
SHA1 bbb5c456162b63d5f0ebbf07a59c9e14d644a40d
SHA512 b247caceb3b69fc1b77328a3584b5432f320ed2471aa7fa0550a5da720664f07293cd640c109cecc0d349e66a8f03f30ce075e1eb6233c935645a6a149c9b712
SSDEEP 192:sxZjRyyM/jK1Ml8UQ899/ffsTrKbpIdpLHW6+WNGYnsaqC+AIg5/J:sxZjoqa9/ffsTrKbiLHbGrCXL
TLSH
T11852F8116A345A77CCCBE20DFA55BF53D6F9547292900E44AEFCCA1C00E6AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 35d7b14bb928ede298b81e2cafbd41e4352ed4cf5776363392242dea63b5f30d
MD5 7c954dc5fa7c1f0bab9148b7b38aed91
SHA1 03c64df55b190ecf0f1a3c7441905314c4698d08
SHA512 c2270826c3cb7a25e95778ae830b368465c479166e7395d994a4826fdbf62b52ad7f2188ed1d5f735e2732a1191b35eeecb3d07378f2fd4fdd43a7fddadb1c06
SSDEEP 192:sxZjRyyM/jK1Ml8M99/ffsXrxbpIdpJHW6+WNGYnsjqC+AIgrJ:sxZjo19/ffsXrxbiJHbGgCX9
TLSH
T19342E7116A34697BCCCBD20DFA55BF53D6F91572A2900E48ADFCCA1C04E6AEC221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 4cc1213c4489e0dc04626641ce67032f918ca8163b90e97a5f3c2b2955502352
MD5 aa3b871cc601b96160b6b9b3479b85f4
SHA1 4b40683215e02f92a61fe196f42838241e7bf5a1
SHA512 f9a0d8229ab4b4f509f4a5dcecf441a7048b67e691f72f3dcc8a5b97e730845f722af47d57f2b904a42691c4b08f149099bb8e539aded4bf543b57cf80f80874
SSDEEP 768:xQQRMvUWv0sTg8F1+UoAYDCx9Tuqh0VfUC9xbog/OVFTLlTBshuro/IxDC:xQQRMvUWv0sTgu1jakTLROhl/Ix2
TLSH
T15FD21C3B284CCB7E4F841E6CEC2AAF976DD801CB67984D5447FA884C03C77EA511A59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

9dffb54b-f61c-4256-8873-0ffdc9624156.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\9dffb54b-f61c-4256-8873-0ffdc9624156.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 22KB
SHA256 80083679ddc5094a7b29f7e044dc31b4f68eae17d360bfc3bb3b62ff0dfa0829
MD5 5e30a23b5a102799eaf18442ffe7619c
SHA1 be81b0e8d1304e6b2f91065c6f5dedf5b5a8b28c
SHA512 b752f63a29f583629ad2d309c55b89490d66b012a1ded3215a82b7e7d05c163203d094eb076a5178f6888516071e3f29256400301bbd925278121f911c861d36
SSDEEP 384:XeiFiZcIKsNV8TUNTUlIlkVMy4e9C1X54attKE+wulk2mOOPrXLpe8C/X:FFQKYwgG4XRxzKE7gmOi9PI
TLSH
T1B4A27D3398A8987BAEF7AA41F54A27139EF95163D1C0B794E7DC9B0C01DB19C030B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 12f87cd0ff6140c8d30e7ba921caaed4f79b9cc99848069a36a45141eca4c451
MD5 5b4a100831965026888eb744bd0b9578
SHA1 b81a2b10f03d221c408c68291020cca9d4fd3111
SHA512 523592918f3416dc5d71c87c3910b0e03da7f4e8a0f4293b99a9fe4177db0750c5938f1f09501f239fbcac76dc5659794258fc370f4402b5fa956dd24bca37fb
SSDEEP 192:CONw6G+bgQmiUyHuDE54aP1tK9y+i8OyRRU6:CONw6HgpDE54attKE+p7U6
TLSH
T14502E835A8782C7B9EF3AD46B5872B176F99112BE6806B94DAEC1B0C41DB24C130B537
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 350413ded157d0343cb1554f4957e5cb475cbaa7de46aa38d7ead8327c263be6
MD5 cd7ac234bf0be160a9104d61b89b128b
SHA1 408ecc7b29e502dd0ac707292228e5d6e4fe9a70
SHA512 b99e3b0331eafd2b68796e54f24461282bf6bb179d727e824d1ac835caf749811262d11048df08d2d87c299dcf86712bf09c0f84e92a8ae31e6d8fcf7aed64bd
SSDEEP 192:KLsNUUkQQLyCy+be91QmiU1sJq4X54aP1tK9y+wulDnIB8Z4nqx3znmMW:osNUUkQMy4e9C1X54attKE+wulkzmKD
TLSH
T157421832A8786C365EE3A542B44B3B136FA49167D6C46B94DADC5B0C05DF29C130F52B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 8f3cecdfef3c3d3efc2bd204c5bed9424e4dc84b53705fb5f6e1e5f2f3d28a74
MD5 7bf573fd0208d96a0a08093a3f2d0b63
SHA1 ea276ca2821d23d5f503a14dc4a8c7b679cc96fc
SHA512 05ff023dc9c0b85c28cee868b2969678c32702eb965e0d0eb895da2e8d44938c1f53de2b486dd36d456ecfabf487e570810b4669d68516796df0ac5b0d1f0a8c
SSDEEP 384:FZcIhsNUUkwMy4e9C1X54attKE+wulkzmOOPrXLpe8C/X:9h84XRxzKE7NmOi9PI
TLSH
T180928D32A8786C666EF7E541F5472B135FF99227E2C46B889AEC9B0C05CF15C030B527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 dd5d59e08cce723366a2e039d4005f3ac04b45b60e0fb0619a885d1704ca0af5
MD5 ce4abe5a14aa3a96696f226dd87c76f3
SHA1 569d7a7b3b602d2225e5c4fd7d86eceae10751b5
SHA512 ef4e910a39f464d368a6e7987480cdc863f97678c968473b85f4c03fa3f82de1dcacc5a35a211d182a32b655aa93b10765d479b99f0294f4a46b109a9bfeca32
SSDEEP 384:fEZcIhsNUUkVMy4e9C1X54attKE+wulkzmOOPrXLpe8C/X:qh/4XRxzKE7NmOi9PI
TLSH
T140927D32A8786C666EF7F541F5472B135EF99127E2C46B989AEC9B0C05CF25C030B527
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 dec475b49fe5c5de9d31a98c2aa022375a4450f1c44fe2598f25b9985f13cfa2
MD5 d1b521381a55af7ca7903c19f4a87bb3
SHA1 dec3fa8c20b8474344edb85d0183912ae7d650cb
SHA512 a7b98408a05fde5d930959effdf994bec1cba12a50a019da907b722dfea623164ccc07938901edd7884ae76ed1238ea3f234f45a7229031605c22dc9588ca2ea
SSDEEP 192:nON26G+bIQmiUyduHE54aP1tK9y+wulDnIJ8Shnqx3U6:nON26Ho5HE54attKE+wulk3mU6
TLSH
T138120932E8787C7B5EE3A491B0873A136E955227E784BB94D9EC1B1C01EF25C130F526
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

45d7ddc5-57e9-4500-9f52-cb04011292e4.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\45d7ddc5-57e9-4500-9f52-cb04011292e4.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download