hxxp://grafoman[.]be

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/08/2026, 09:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://grafoman.be
Sample260817-ldff9aae56

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4196	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134314322947198139"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{599122C4-4F60-4988-829C-EFB5BFA61F74}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3668	msedge.exe
3668	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe
4340	msedge.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 4340 wrote to memory of 2716	4340	msedge.exe	85
PID 4340 wrote to memory of 4196	4340	msedge.exe	86
PID 4340 wrote to memory of 2792	4340	msedge.exe	88
PID 4340 wrote to memory of 2792	4340	msedge.exe	88
PID 4340 wrote to memory of 3344	4340	msedge.exe	87
PID 4340 wrote to memory of 3344	4340	msedge.exe	87
PID 4340 wrote to memory of 3344	4340	msedge.exe	87
PID 4340 wrote to memory of 4200	4340	msedge.exe	91
PID 4340 wrote to memory of 4200	4340	msedge.exe	91
PID 4340 wrote to memory of 4200	4340	msedge.exe	91
PID 4340 wrote to memory of 1900	4340	msedge.exe	90
PID 4340 wrote to memory of 1900	4340	msedge.exe	90
PID 4340 wrote to memory of 1900	4340	msedge.exe	90
PID 4340 wrote to memory of 1812	4340	msedge.exe	92
PID 4340 wrote to memory of 1812	4340	msedge.exe	92
PID 4340 wrote to memory of 1812	4340	msedge.exe	92
PID 4340 wrote to memory of 2564	4340	msedge.exe	93
PID 4340 wrote to memory of 2564	4340	msedge.exe	93
PID 4340 wrote to memory of 2564	4340	msedge.exe	93
PID 4340 wrote to memory of 1592	4340	msedge.exe	97
PID 4340 wrote to memory of 1592	4340	msedge.exe	97
PID 4340 wrote to memory of 1592	4340	msedge.exe	97
PID 4340 wrote to memory of 2488	4340	msedge.exe	99
PID 4340 wrote to memory of 3092	4340	msedge.exe	98
PID 4340 wrote to memory of 2488	4340	msedge.exe	99
PID 4340 wrote to memory of 3092	4340	msedge.exe	98
PID 4340 wrote to memory of 1616	4340	msedge.exe	101
PID 4340 wrote to memory of 3340	4340	msedge.exe	102
PID 4340 wrote to memory of 3340	4340	msedge.exe	102
PID 4340 wrote to memory of 3340	4340	msedge.exe	102
PID 4340 wrote to memory of 2332	4340	msedge.exe	104
PID 4340 wrote to memory of 2332	4340	msedge.exe	104
PID 4340 wrote to memory of 2332	4340	msedge.exe	104
PID 4340 wrote to memory of 1156	4340	msedge.exe	105
PID 4340 wrote to memory of 1156	4340	msedge.exe	105
PID 4340 wrote to memory of 1156	4340	msedge.exe	105
PID 4340 wrote to memory of 2276	4340	msedge.exe	111
PID 4340 wrote to memory of 3460	4340	msedge.exe	112
PID 4340 wrote to memory of 2872	4340	msedge.exe	113
PID 4340 wrote to memory of 4724	4340	msedge.exe	118
PID 4340 wrote to memory of 4724	4340	msedge.exe	118
PID 4340 wrote to memory of 2196	4340	msedge.exe	119
PID 4340 wrote to memory of 2196	4340	msedge.exe	119
PID 4340 wrote to memory of 3668	4340	msedge.exe	120

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://grafoman.be
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ffbecdfc188,0x7ffbecdfc194,0x7ffbecdfc1a0
  2⤵
  PID:2716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1912,i,13665682692693965571,9599259177046551961,524288 --field-trial-handle=2228,i,13790693968173008235,10926618715698051723,262144 --variations-seed-version --mojo-platform-channel-handle=2260 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1632,i,999445503260988986,15614483285755747287,262144 --field-trial-handle=2228,i,13790693968173008235,10926618715698051723,262144 --variations-seed-version --mojo-platform-channel-handle=2216 /prefetch:2
  2⤵
  PID:3344
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=276,i,7827216142628979822,15342110201457393803,524288 --field-trial-handle=2228,i,13790693968173008235,10926618715698051723,262144 --variations-seed-version --mojo-platform-channel-handle=2444 /prefetch:8
  2⤵
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,2346235435538515894,11229263575242204455,2097152 --field-trial-handle=2228,i,13790693968173008235,10926618715698051723,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:1900
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,6866587757989234570,14649780091417709772,2097152 --field-trial-handle=2228,i,13790693968173008235,10926618715698051723,262144 --variations-seed-version --mojo-platform-channel-handle=3492 /prefetch:1
  2⤵
  PID:4200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4172,i,10660288639269609233,8578288592122858728,2097152 --field-trial-handle=2228,i,13790693968173008235,10926618715698051723,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:1
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4200,i,1436077861907097143,9296615510806038042,2097152 --field-trial-handle=2228,i,13790693968173008235,10926618715698051723,262144 --variations-seed-version --mojo-platform-channel-handle=4232 /prefetch:2
  2⤵
  PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5076,i,16271964665784407258,14640784357909858393,2097152 --field-trial-handle=2228,i,13790693968173008235,10926618715698051723,262144 --variations-seed-version --mojo-platform-channel-handle=5084 /prefetch:1
  2⤵
  PID:1592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4840,i,10790035791099320271,1126567640610698885,524288 --field-trial-handle=2228,i,13790693968173008235,10926618715698051723,262144 --variations-seed-version --mojo-platform-channel-handle=3616 /prefetch:8
  2⤵
  PID:3092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3492,i,7066233681942546786,13910009623559673748,524288 --field-trial-handle=2228,i,13790693968173008235,10926618715698051723,262144 --variations-seed-version --mojo-platform-channel-handle=3580 /prefetch:8
  2⤵
  PID:2488
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,11556147157468221611,2073395046419091404,524288 --field-trial-handle=2228,i,13790693968173008235,10926618715698051723,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:876
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5852,i,11556147157468221611,2073395046419091404,524288 --field-trial-handle=2228,i,13790693968173008235,10926618715698051723,262144 --variations-seed-version --mojo-platform-channel-handle=5868 /prefetch:8
  2⤵
  PID:1616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6168,i,4275344529613854991,6264610918883592369,2097152 --field-trial-handle=2228,i,13790693968173008235,10926618715698051723,262144 --variations-seed-version --mojo-platform-channel-handle=6172 /prefetch:1
  2⤵
  PID:3340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6372,i,2876294844308674977,3351818684241869640,2097152 --field-trial-handle=2228,i,13790693968173008235,10926618715698051723,262144 --variations-seed-version --mojo-platform-channel-handle=6444 /prefetch:1
  2⤵
  PID:2332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6632,i,16916556389370215200,11064352608593458546,2097152 --field-trial-handle=2228,i,13790693968173008235,10926618715698051723,262144 --variations-seed-version --mojo-platform-channel-handle=6656 /prefetch:1
  2⤵
  PID:1156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6676,i,6522889952736410149,10369444020690732124,524288 --field-trial-handle=2228,i,13790693968173008235,10926618715698051723,262144 --variations-seed-version --mojo-platform-channel-handle=3512 /prefetch:8
  2⤵
  PID:2276
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6652,i,6786912043420264612,15894244473084697651,524288 --field-trial-handle=2228,i,13790693968173008235,10926618715698051723,262144 --variations-seed-version --mojo-platform-channel-handle=6708 /prefetch:8
  2⤵
  PID:3460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6668,i,16684573113204136272,6144510778769007130,524288 --field-trial-handle=2228,i,13790693968173008235,10926618715698051723,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:8
  2⤵
  PID:2872
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3548,i,4018453535506622540,16814753562156882542,524288 --field-trial-handle=2228,i,13790693968173008235,10926618715698051723,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  PID:4724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=564,i,2392235644464277315,15001200309868870993,524288 --field-trial-handle=2228,i,13790693968173008235,10926618715698051723,262144 --variations-seed-version --mojo-platform-channel-handle=5776 /prefetch:8
  2⤵
  PID:2196
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5376,i,5591395091357545701,9582681372370756720,262144 --field-trial-handle=2228,i,13790693968173008235,10926618715698051723,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3668

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4556

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 c8860ced0a93b430a1d9328be0fa84ea5efb30c8dfdeef91d90859678f8697f6
MD5 933c0b4b891177e62d2465d93a468a57
SHA1 b829df4ea1cb0319aa392e36932c9ed61c7e27b3
SHA512 e31e43c6994e593a47cbd50f13959eb021f90b3d407dabf939acdfbba86c6d9b638eeac3d85d08e7106e06c8b941123c3158b6813bc53b0dbf636bf4d48e6ca3
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7h:fwUQC5VwBIiElEd2K57P7h
TLSH
T152B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 0e2b315c59b1bfe8e547b0017a92548af7c81e08409e987a2628ad74667b4fec
MD5 7ab616f55807e9de5195a40c50f65e5b
SHA1 917a7797f800e5f30a1b9b8125127968246d7ce9
SHA512 da10f29803a072f42a2c102da0bee745cf1b1d47836e3d30e38b1e66beeb1abeaf2eb47b6c07b23682098f70fe2a4b29a0777eefa1380d0fff2509ff32d9b356
TLSH
T171D08023771D7182F35B41759053D7025A1680756463B701B325D41C9A740C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 b976ac8901ffd41ec02a04aa583bc9d11350f0f9f714fb92d3341bb0bde4629f
MD5 504ce80b644a85a7e68d85bd24169289
SHA1 1f740a722dfa97fc8fb30626b0e3d6217e4a9864
SHA512 9406464a4f6becd85591c12af8a97fdecfa2208649138f347fb50d3e28f1583adec061050924fa0405e46eb75af7e299e6564c2ed039db9d82c50326da32a3c5
TLSH
T19ED08023371D7582F75B41759053D7025A1680756463F701B325D41C9A750C9F28B1C2
MD5 SHA1 SHA512 TLSH

Submit Download

54e87a7a-b3a9-4f8c-af47-180ba08bd811.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\54e87a7a-b3a9-4f8c-af47-180ba08bd811.tmp
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

f_0000ae

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000ae
Size 335KB
SHA256 510937c81cb1a502119ab143419709b78c971a487406b87287e5d0e818995e9a
MD5 9f9c9ac1a584487d0961c6af2cac057c
SHA1 dbe3f8ded8c2390dbf7263da9aae9c7dda1cd828
SHA512 5fd4adbc586cd8110325eac005eb71792205e8e0f0132971d0758747baa058290e23daa9d1fa4574982f227c4ef0f3eae2055873bdb293fd404cc753bec05421
SSDEEP 6144:1EYK/wn749QJWZHyBE3FQ8Buo3Faz9J0ze/79bZJQ6PXmMo9uLUz:1EYK/wn70h5sE3F4oVaRmzWJT3obz
TLSH
T1F6742325C2DDFB139B531A01147E5975C638E876E4C01FB28B3CE026AF26E2D1468DEB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 952a97e02bc62a9ee54ff969dc2a009c83ede1604956edbadec2e46ee16073de
MD5 7f8dbedca4943a15607b202d3694b952
SHA1 682d16ecca8be0aa116f0c565140418b890e8c88
SHA512 48162225613e41bff4d6c511c2ee3169433e3b4394a9e77b8fc71cda46a46b058762016d7c51173c1d024601ee60582678daf7768b950fc57c77dda65b862e6d
SSDEEP 96:bktTeO0XW6AMeNbakMI7JwHdqcAl5BXiAWa15itns4mU5sBQa:bMKO0m6A2kTJyqcAl5Yvaytns7U+t
TLSH
T163D10AF642424B9ADF2AB0F931DE396839706FEAF5739F561D124EF1348B78001CA148
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5894aa.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5894aa.TMP
Size 3KB
SHA256 389658dadde3b81f473eec236108634791fd9fd3ddc0312800b985635b1a3bb7
MD5 2a0c9a0a507abaef934bea60b94ccdc5
SHA1 a290ca8c247e051855e7d78ea563a839a2d4b6d7
SHA512 fbd75d5effb12755b2cf6ede54dac56b32b419581decdd982a6fef14053bc949ed4d43d8dc249a6d118fa99666f56f79650f5226d2df6b451ac27b993ed2a556
TLSH
T1527191BB410287AFDB2DA2FD64DE71503C70A4D9F9335D569E5047353917B0242CE688
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 19KB
SHA256 91cf7d05980d8d4df40fc2474e1f44fa26d2b0de27e42cd64b699329917f27e0
MD5 c8c5cde6e39dcae3a70b5f1f09c73658
SHA1 c73b3796e2f8ebb10e58ac9cd84c3dcbd5c344c3
SHA512 846130a47a80ea5c3cab17fc9f90ff85bf622fd38763d6f058c3c686240161e6108ab1a55d0a9b602f5b8e44ff742e8e5b20af03b369dbaf6a7829425e47b4cd
SSDEEP 384:DnZV8xGqeo6e4vWd2sny7CwXpke/eUoyHvMY1jP1oN22UpqCt0Lht5U5ux12nYlJ:b5yOoNnY9E
TLSH
T1FB92BDE683F8862DDC1216F6AB682E2FCE1D091507283C7AD9D5BF1B97D2870D34164E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 3e2629e11802cd7510a97b64d36bbfd4cf8974e597ca85efa7f6729274b1e038
MD5 73be9d60e645555f97f6f4d65ea6e9f5
SHA1 54a40f4be6c43aa1702e30d72aef79d9a7ccf5c0
SHA512 afd67aa335b361b16aae60176f0a7be3519671d4807f59f4374668501a883b142d15a02e56b18d1b9f50785fc6fd21ad286a980485cebe60721b3e7f9033f425
SSDEEP 192:sxZKRiyM/jK1Ml8Mk9/f9sCQAIdpXNHW6+WNVhW/YIlc8kQIgUzJ:sxZKAM9/f9sCQBdHbe/rUl
TLSH
T1FF52D9116A34697BCCDBD309FA45BF93D6F5156292900E849EFCCA1C04E6AED231781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 87261ecb49a53ee7a5fb05625226253c74bc87b4946cfdd8bdd9e66037ab1c9e
MD5 3d643a1f73f88b52b076ab8d6a5fed62
SHA1 c8c690e397c43d4ccb493da0e8c21b0f522f1e2b
SHA512 e7989ba504f8dc0bd3a89485414c86fce94f15f126cbc8d4370b6bb2eda98dc6a1cfb2db1d9198e033c20bef74c9c815274785f9d3f65b5a632f47d1a59fcdc5
SSDEEP 192:sxZeRiyM/jK1Ml8UQFk9/f9shNUb1dpx3XHHW6+WNVhW/YIHxbH8kQIg5ISJ:sxZewqO9/f9sjU95Hbe/90Su
TLSH
T1FE52D911A634A977CCDBD209FA45BF93D6F555B291900E84AAFCCE1C04E6ADD230782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 b5dfa64f56e1410e8e37205a9c2ae986279c720436b43ae5b42406391c16adb5
MD5 b2a651de61eea92615aac487eb22ad54
SHA1 5715b50724886dc68795ce2cd186fa35960dd432
SHA512 3cfc78cb879a36f2287ac6f471012ffe01d111941d5109024021dde6eb705e3eadd692835322f383416a3e642bba9648fae4d9ac45c92dcf428634f971382f20
SSDEEP 192:sxZeRiyM/jK1Ml8Mk9/f9shNQYIdpXVHHW6+WNVhW/YIlc8kQIg5eSJ:sxZewM9/f9sjQpBHbe/rUu
TLSH
T11252D8116A34697BCCDBD309FA45BF93D6F5156292900E849AFCCE1C04E6AED231782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 55751c15dcf110a3f7735321a5d2d753abf2602376414f6f7e8b63e6d86b12f2
MD5 a9203773343b814756dd3f9b73d939bd
SHA1 e92fca7a50a3d1a496c10201860e5dc20368f73c
SHA512 90fc3efc4fa3ea27de1a8f767d1236e894726fff1731076fa4648dcc90036b8bc9c3240a97414a9dd24e24faab5587ee4c65d9cde4c9c09b9d0515ea21aa13ce
SSDEEP 768:ESsqxXlWvJD6T8F1+UoAYDCx9Tuqh0VfUC9xbog/OVk4Ll6AR9ProSct:ESsqxXlWvJD6Tu1ja54LAs9cS8
TLSH
T176D20C3B694CC77D4F840E6DEC266ED76ED801CB56988D5447FA880C02CB2EA51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 3b3be14e4e619845cc925a5e6f31cc5527718ee99e722336bba7f5df59f8ff9c
MD5 3dc474f147325430055bc4ba34bbc42c
SHA1 e3cdf4a601e3574b9a7d03a90ad50be267108830
SHA512 28ff10365e6e9cc775566e8f647226a0f20fc956cfbdd338b77fee4074712c1a68a27ec24895c9ee40cdc3bd6ed4883c3b31b87c416417d2f446d4135bdb9466
SSDEEP 48:KPYNs4iCiac6vpI9IaKGveOaS4K7H2oTyZ+I/Kjiojy5EIfKdmswkxYEmOeWz:KYbaKYIK6+EKji2qEAKdm5kxYEmOeWz
TLSH
T1AF910349363E0212383D2958B2AB96371F423A63701CE46F7FB941E55E6AE121CFC9DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe58e059.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe58e059.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 16KB
SHA256 0cc5f1e96490779a8eac7bc9e337ab4ea51a62c51534d9e1f504665168e2adb1
MD5 d1af4a4e7ef38bbba18091cc4078692a
SHA1 2d791d31025d4165a95aad2d29522cdb611762b0
SHA512 0e23094152ff001d1aeb5cb9c18d2b13137de115e83a5b091dc99954ca53b15f5587b8b4f00b3caf2c7e1af577cec100486e508762b550b506499c79b310dc46
SSDEEP 384:ysNMfkbl7Ix2VRN0OKq9xPOOPrXLpe8C/X:yPxUH0OB9xPOi9Pq
TLSH
T1E2726C31A9386C675EB7AA85F54732039FF851B7E6C42FD4D2DC5F0C06CA69C130A926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 90c0171fe1cdcdfcc2c325fe4c25a180d191aa132392ed37ff23083f428719b4
MD5 adbd5964a7862cce90b6fba449d674a1
SHA1 5e0bea62d8eb251f1e3296c558a3fa21aeeea700
SHA512 5f42f4855e3483217d754a59aa8a7cd861e5959dd7452b257219b032af26d4f992a1e47c4c549e7548b024b7523ea89300d5cbd237a241995ebb3d99c1683183
SSDEEP 384:DiFiZcICsNE8TUNTUlIlhkb57ax2VRN0OKq9uPOOPrXLpe8C/Z:uFQC5wg7xUH0OB9uPOi9Pu
TLSH
T19BD23AF258E75876E9AE5B43A77E2D034EBCC163F5845A90B3984A0CCDC60BFD30A911
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 52b25ca9141866488a588740072b4589b2de8474f5e2027dcc49668ba86c44d0
MD5 42e472123b8a291e7eb6b839080ae4b3
SHA1 7603f3109fe705b7d08843d68b681516299b5324
SHA512 74882d0b7683d2ff08aea925918772043fa9c56f40cae1516c0f37363022428e37820bb4e7727a7884a3dd586b8301baa39fdc33e09516da3b9ebde1e299716b
SSDEEP 192:tONr6JkRtQmiUyZ/W+RN0OmheR2h3KR5U6:tONr6UrGW+RN0OKFgU6
TLSH
T13E02F935AD382C7B9EF26E09B98727175FA8207BE9956F80DAE41F0C01D764C2307836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 f36dc6559a9b182bc0ed673009cb841845942f2bbd337af3e1cf1f5db63fee36
MD5 c5064d85d5c013bf8867839b65bba6ab
SHA1 1ec9fcef1d0e6da71e960faaee94b36cb91fbe9c
SHA512 cb836327f98c721558915e9aa52ded7146c25de5ba3e64192eb5d2de6e1e48e30b4a62009dc60679f417feac3129008203e757cadf7e3a5efdc853ee0e530e8a
SSDEEP 384:7ZcIhsNMhkb57Ix2VRN0OKq9xPOOPrXLpe8C/Z:jhzxUH0OB9xPOi9Pu
TLSH
T155928D31A9386C676EB6BA85F98732035FF85177E6C46F8491EC9F0C01DA998130A926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 ffd6fa2f44cea7955d73966e8fd018efb2a7d86546eb2447b325db5a3f8dbbbe
MD5 2c46dd7564831e9aad9d648ad6e9396a
SHA1 5448a50400ba00a403a1eec8d68166ceb086286b
SHA512 207c532279b6d366a623deec6cc7e35e85fc73d2eb5d191e4f2b88e9b4c507c65aa0ac7cc193edd8d524f0c1c3d869af0c564594625ffe61c609a0a07fe48b4a
SSDEEP 384:HZcIhsNMSkb57Ix2VRN0OKq9xPOOPrXLpe8C/Z:vhYxUH0OB9xPOi9Pu
TLSH
T14C928D31AD386C67AEB6BA85F98732035FF85177F6C46F8491EC9F0C01DA598130AD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8b7326ebf872ed015debfb196b14d607db57d9b729b63aa6fbb4683ab81c83d6
MD5 d23b445b52e254ef8ee8afaf48dc5530
SHA1 01c6e7b91b0113701e12e1fd216d4f7a6e06d749
SHA512 e41dbfcb035406cd934fd22f499b0a66d1394afe7adcad0031767ec114933bb538d78ec0c4db181c8ddb759d2c0986b0592fb426a5e3cf53fdf58022cf2eee61
SSDEEP 192:tJONt6JkREQmiUyP4/g+RN0OmheRnX96Vc0qawU6:nONt6UU6kg+RN0OKq9tPU6
TLSH
T13F123A36A9386C775EE36944F48732135FA8513BEA896F80D5DC2F0C01DFA9C230E826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 674335350ca7ac77166cbab06cf813978dd70e8d7f98add3ada30d3c84ceffc6
MD5 89c27d64fbd0d687b0503cb1a6bbf62e
SHA1 50f5dc06d591218a59b7a3c301a4d73b2d749c00
SHA512 b66f0af5a1bc40058f99bc8e7c046bc4906c10413ed78174de19d90e96a5a06ab53f8be00342985b2f05007ed8a3be2bede300c82e45c4ae5b64e4f5adbc4091
TLSH
T162E00403530100F5C05CC33500D717051FD3C13001F347475D1545551C573105C70F40
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5879af.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5879af.TMP
Size 392B
SHA256 31d028d2672b30939919f0022587824a8d4b0a56f7f99197f3685f925579e37a
MD5 ecdfa027417df1a708b22e70178d2dcf
SHA1 28d0ac34ee5674618bee6ec4b896fd3b917cf51e
SHA512 e86081b19e3817146b0d457dc7c0c1dd1484ec431b97f7d9d9a4c2c81356f30735f37f3eb392018010d1d3bcfd0cb864b94c290b79cebbda98e643867e85739d
MD5 SHA1 SHA512

Submit Download

e4928dd4-a7c0-45b6-8241-6de02cb7d39a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e4928dd4-a7c0-45b6-8241-6de02cb7d39a.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 14fdd736481d28d09e87feb7b2c9e9235d977eaa600b98dfc7585d666d0ddf01
MD5 966896c8c56ff415a357ba435499ec46
SHA1 2d261620c5de8e31ac926a5183b7d12dbe3fc409
SHA512 415781415aa6767cc5a4939ea515649eed1b8e4b3df493523b13c7c33ad699ace3b6803e8ebaecdfefe68580fe776dd5a5d677bb329a1d6e45413b982a162573
TLSH
T1FF412A58AAEA1144B3B76F569BF6B86D487ABD772E06D09D00110D4F0A27B04C871B37
MD5 SHA1 SHA512 TLSH

Submit Download