hxxp://asaudiopadpre03[.]azurewebsites[.]net

Analysis

user interaction
yes
max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/08/2026, 08:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://asaudiopadpre03.azurewebsites.net
Sample260820-kljcfawsg1

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4552	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134316888840107846"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2937465464-4167303362-2236413517-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2937465464-4167303362-2236413517-1000\{2748BFCE-2E5C-4292-9020-2BA30441EC0B}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2744	msedge.exe
2744	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe
2716	msedge.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 2716 wrote to memory of 3596	2716	msedge.exe	89
PID 2716 wrote to memory of 4552	2716	msedge.exe	90
PID 2716 wrote to memory of 1216	2716	msedge.exe	91
PID 2716 wrote to memory of 1216	2716	msedge.exe	91
PID 2716 wrote to memory of 1216	2716	msedge.exe	91
PID 2716 wrote to memory of 4428	2716	msedge.exe	92
PID 2716 wrote to memory of 4428	2716	msedge.exe	92
PID 2716 wrote to memory of 4128	2716	msedge.exe	93
PID 2716 wrote to memory of 4128	2716	msedge.exe	93
PID 2716 wrote to memory of 4128	2716	msedge.exe	93
PID 2716 wrote to memory of 4640	2716	msedge.exe	94
PID 2716 wrote to memory of 4640	2716	msedge.exe	94
PID 2716 wrote to memory of 4640	2716	msedge.exe	94
PID 2716 wrote to memory of 2860	2716	msedge.exe	95
PID 2716 wrote to memory of 3856	2716	msedge.exe	96
PID 2716 wrote to memory of 2860	2716	msedge.exe	95
PID 2716 wrote to memory of 2860	2716	msedge.exe	95
PID 2716 wrote to memory of 3856	2716	msedge.exe	96
PID 2716 wrote to memory of 3856	2716	msedge.exe	96
PID 2716 wrote to memory of 1364	2716	msedge.exe	100
PID 2716 wrote to memory of 1364	2716	msedge.exe	100
PID 2716 wrote to memory of 1364	2716	msedge.exe	100
PID 2716 wrote to memory of 2744	2716	msedge.exe	101
PID 2716 wrote to memory of 4572	2716	msedge.exe	102
PID 2716 wrote to memory of 2744	2716	msedge.exe	101
PID 2716 wrote to memory of 4572	2716	msedge.exe	102
PID 2716 wrote to memory of 4876	2716	msedge.exe	104
PID 2716 wrote to memory of 1628	2716	msedge.exe	105
PID 2716 wrote to memory of 1628	2716	msedge.exe	105
PID 2716 wrote to memory of 1628	2716	msedge.exe	105
PID 2716 wrote to memory of 4172	2716	msedge.exe	106
PID 2716 wrote to memory of 4172	2716	msedge.exe	106
PID 2716 wrote to memory of 4172	2716	msedge.exe	106
PID 2716 wrote to memory of 3160	2716	msedge.exe	107
PID 2716 wrote to memory of 3160	2716	msedge.exe	107
PID 2716 wrote to memory of 3160	2716	msedge.exe	107
PID 2716 wrote to memory of 1728	2716	msedge.exe	108
PID 2716 wrote to memory of 1728	2716	msedge.exe	108
PID 2716 wrote to memory of 1728	2716	msedge.exe	108
PID 2716 wrote to memory of 3752	2716	msedge.exe	114
PID 2716 wrote to memory of 5052	2716	msedge.exe	115
PID 2716 wrote to memory of 628	2716	msedge.exe	116
PID 2716 wrote to memory of 3972	2716	msedge.exe	118
PID 2716 wrote to memory of 3972	2716	msedge.exe	118
PID 2716 wrote to memory of 3972	2716	msedge.exe	118
PID 2716 wrote to memory of 3008	2716	msedge.exe	124
PID 2716 wrote to memory of 3008	2716	msedge.exe	124
PID 2716 wrote to memory of 2508	2716	msedge.exe	126
PID 2716 wrote to memory of 2508	2716	msedge.exe	126
PID 2716 wrote to memory of 2744	2716	msedge.exe	129

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://asaudiopadpre03.azurewebsites.net
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2a8,0x7ffaf7f5c188,0x7ffaf7f5c194,0x7ffaf7f5c1a0
  2⤵
  PID:3596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,12337902115187626262,7387587921509012637,524288 --field-trial-handle=2316,i,2444549671898934018,4498185095911381001,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1656,i,2114473544589192294,12100462479138837941,262144 --field-trial-handle=2316,i,2444549671898934018,4498185095911381001,262144 --variations-seed-version --mojo-platform-channel-handle=2312 /prefetch:2
  2⤵
  PID:1216
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2532,i,5664173455967193678,9241746011907229774,524288 --field-trial-handle=2316,i,2444549671898934018,4498185095911381001,262144 --variations-seed-version --mojo-platform-channel-handle=2560 /prefetch:8
  2⤵
  PID:4428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,11627257695105020978,44964333861609763,2097152 --field-trial-handle=2316,i,2444549671898934018,4498185095911381001,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:4128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,4193828033973892590,1788631921388877903,2097152 --field-trial-handle=2316,i,2444549671898934018,4498185095911381001,262144 --variations-seed-version --mojo-platform-channel-handle=3516 /prefetch:1
  2⤵
  PID:4640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4224,i,2024778137095419934,805824816178297243,2097152 --field-trial-handle=2316,i,2444549671898934018,4498185095911381001,262144 --variations-seed-version --mojo-platform-channel-handle=4284 /prefetch:1
  2⤵
  PID:2860
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,3882120274770225172,17490342438348270676,2097152 --field-trial-handle=2316,i,2444549671898934018,4498185095911381001,262144 --variations-seed-version --mojo-platform-channel-handle=4288 /prefetch:2
  2⤵
  PID:3856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5100,i,12502405476808303355,399858085839945510,2097152 --field-trial-handle=2316,i,2444549671898934018,4498185095911381001,262144 --variations-seed-version --mojo-platform-channel-handle=5116 /prefetch:1
  2⤵
  PID:1364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3556,i,4652701025429502375,2428572422964368321,524288 --field-trial-handle=2316,i,2444549671898934018,4498185095911381001,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:8
  2⤵
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3548,i,2063767513495282330,16493098086360313219,524288 --field-trial-handle=2316,i,2444549671898934018,4498185095911381001,262144 --variations-seed-version --mojo-platform-channel-handle=3696 /prefetch:8
  2⤵
  PID:4572
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,13702058341957530748,16968686945580480402,524288 --field-trial-handle=2316,i,2444549671898934018,4498185095911381001,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5908,i,13702058341957530748,16968686945580480402,524288 --field-trial-handle=2316,i,2444549671898934018,4498185095911381001,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:4876
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6336,i,1846081619896134515,14427951884637938348,2097152 --field-trial-handle=2316,i,2444549671898934018,4498185095911381001,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:1
  2⤵
  PID:1628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=4360,i,14141344791678304152,307754784334300019,2097152 --field-trial-handle=2316,i,2444549671898934018,4498185095911381001,262144 --variations-seed-version --mojo-platform-channel-handle=4548 /prefetch:1
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=5048,i,15124404416975768637,3234387541576584921,2097152 --field-trial-handle=2316,i,2444549671898934018,4498185095911381001,262144 --variations-seed-version --mojo-platform-channel-handle=6416 /prefetch:1
  2⤵
  PID:3160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=5152,i,12015181287520985475,2662152692165270637,2097152 --field-trial-handle=2316,i,2444549671898934018,4498185095911381001,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:1
  2⤵
  PID:1728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6560,i,1902404122939385165,2586582545553022412,524288 --field-trial-handle=2316,i,2444549671898934018,4498185095911381001,262144 --variations-seed-version --mojo-platform-channel-handle=6620 /prefetch:8
  2⤵
  PID:3752
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6492,i,11643490998608197624,15962289644325851378,524288 --field-trial-handle=2316,i,2444549671898934018,4498185095911381001,262144 --variations-seed-version --mojo-platform-channel-handle=6672 /prefetch:8
  2⤵
  PID:5052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=560,i,9867631710565700546,16560997122718462581,524288 --field-trial-handle=2316,i,2444549671898934018,4498185095911381001,262144 --variations-seed-version --mojo-platform-channel-handle=6296 /prefetch:8
  2⤵
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=20 --always-read-main-dll --metrics-shmem-handle=6492,i,11072445943647633384,1763955271841299152,2097152 --field-trial-handle=2316,i,2444549671898934018,4498185095911381001,262144 --variations-seed-version --mojo-platform-channel-handle=6696 /prefetch:1
  2⤵
  PID:3972
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6468,i,7848795248793444064,12156555962999117777,524288 --field-trial-handle=2316,i,2444549671898934018,4498185095911381001,262144 --variations-seed-version --mojo-platform-channel-handle=5948 /prefetch:8
  2⤵
  PID:3008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5788,i,9758765513466928163,14650143982580503019,524288 --field-trial-handle=2316,i,2444549671898934018,4498185095911381001,262144 --variations-seed-version --mojo-platform-channel-handle=6668 /prefetch:8
  2⤵
  PID:2508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3344,i,773399667578139961,9957886015279922288,262144 --field-trial-handle=2316,i,2444549671898934018,4498185095911381001,262144 --variations-seed-version --mojo-platform-channel-handle=6168 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2744

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3880

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6d6ea5a9-e511-47bd-bbdc-6632b6958c9a.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\6d6ea5a9-e511-47bd-bbdc-6632b6958c9a.tmp
Size 12KB
SHA256 6088676a5b1c559f5f63861e572bb13df7a99f409497c7ccc36721095c3ef700
MD5 21172666cf65f9a22b2165c4e32c8caa
SHA1 ffa636f3a216d87eb2356d4776f008ddbdc9a4bb
SHA512 f6ac31e48498d18aedfa68dc4d5e4e9794ec1180f6ed45b4808c8a02753103305069cc6cb772566c7722e26cc32b4d9591ff939cf8badc4df4607f8d2b62be37
SSDEEP 192:upLsNhLQ/0i7+3vruQmiU1vHY4atb0j+Fd/cQzDRVLMkqf552BI:gsNhL5Jmtna99d/VfgVDz
TLSH
T142420836AC786C7749B3E186F5473603AFB480679ACA2F94D5EC9F0C01DB6AD2306916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 8247aeca7b33f283e40bb306bc0f5d3f9484f29ba499d4fef16adb4f524d067c
MD5 b27475a4adc7a441cfbd4e10636bebca
SHA1 128cd1ea190d0ec80228a1924b99cc6fe4d9e60c
SHA512 0f3a31480c4406c56e8db918a4bf77c6ff4f86841313f82c28703b2711e4ea7b4057b1278f6ec66772d1887ce88d74f882ece97b27c07f9de109017c91044366
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7F:fwUQC5VwBIiElEd2K57P7F
TLSH
T16DB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 3eacdfce7dc5d437b4447cf27ab297d2d39d13a22d53487691f060212cddb6b2
MD5 77a76342e47369b91c295856d0d136ad
SHA1 bac334fe99bd25a56aeb5cf09b273fd394730180
SHA512 5594ac61907f341c5e00a7e62a64d33fde684c855aa9b27d0c2756986334fbea5ebaf894d13dfedefe84d1f7ad65aaa17fb6b204714ed08460f06e4ed17ce733
TLSH
T1AAD012223A48F441DB4942709103CF453B26146024579A06E259D86D58B41D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7aa2bb81937fdcdafd5d33143cfe61093f5233469b36757de171e12cc0c6215f
MD5 6503f091cfa7258a2190ed65490b1bdd
SHA1 d722a7fd3cd82ec30e4846b9511ec1c22b9dacfd
SHA512 5f2a6a53348e4e1b7810b77abe2dd4c597357ba365cf029977f0efbbb203eab9dfb7771c9edb3561b6d22c8b7354c34611905cfbaab36c763b9d3334beb40b4c
TLSH
T1BAD012223A48F441DB4942709102CF453B26146024579A06E259D86D58B51D453D66C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 ef2e07ea66dda6c687b9579db7c8ba2ce64da8406757a4a8d1ff85efde4a4f9a
MD5 35fad428b15aaad58fd9482b4b0d2b01
SHA1 23977eeebe3e3db008557553d98c02494eb12c9a
SHA512 d54fc1c3c0d915367e687ff49d2cc0f5567e14c5f674b0cf87713a850be3dc85a9f2801f8b77b2bf7dc4b7abae8dbd915cd5ec4865916fa976c3c5199d47cb85
TLSH
T1CA718149C2490C81E7601CF9EEF1B17130B284C40993CEC5951444FF670ABE94C6F447
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 8123bb2685f4fa3e12fb184ec7894ed81b7e8d9c639de0ddfb294d976ccd349f
MD5 d3367fee85655b1b7e77336fcedd5c2c
SHA1 902a0fde5fcc336df9362f402ed54da8e75a6816
SHA512 9bd9ae43caa9f698e60b90f2927f1ec1ece6b0a837e427bee7862c7da554fe8d6b16d37f2021ba4568657805661e1a7a1afbb2bc53e110457d839a97cd331ac1
TLSH
T17371911AC6591C81E7601CF9EEF1B23130B284C40A93CED1A21448FF670ABE98C6F807
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe585ef4.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe585ef4.TMP
Size 3KB
SHA256 b2e10bb2af9c9d4a842181f4c556b9bb550bba6cce63aa8f85da52fa19bc9d49
MD5 26047cb13016401235901697d386903c
SHA1 9e8cc1fb990e02602e086dc2707bec842e890799
SHA512 fe48a1816eb62ad3143cc7216dfcc9537a0c7a751a17aff698940e7760c4f054707312f406babe357f307172fa69df6555e5a2f901ea467366b76f627f14c448
TLSH
T1C3717F59C64D0C91E7601CF9EEF2B27130B284C809A3CED5A51449FF670ABE98C6F407
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 061e21e4e3a2b8d6e7adfc396997718e6ddb7a3ba34e816d53ed7badfa0b5526
MD5 7476a45c9c050b2d19431cae9c420453
SHA1 bc5c93fa9f4e4a9ed21158a245621c086896ae3e
SHA512 6d2bfabcaa6c5f6d530938c9394f9964279ee3ea1ef30060c16d0413dafa6fae1ffc507a300ea048663d11be96c287b045641937f45317e232ded61b20733cc6
TLSH
T1EF71EDFAC7E0C16DA90699F59B14FE7BCE0D154853383C6A89D89F17A3A3472D102A4F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 411446b9ba6e852dd1da3b1c83d9bab33a6b87d94f2789283605918783ce560e
MD5 56797101386109d014938a681a6a996b
SHA1 2d6fbe1aa747cf1265111a7c7bea6cb291c0e633
SHA512 a2089be6a111a5a84b4c30bfb556ad6a7597a524e6beb5fc99814d8e39dc64faa1187f2c20476303e266c7be193f215dc26e69bc78da2b437bc002573b1e97e7
SSDEEP 192:sxZPRkyM/jK1Ml8MkS/f9sbYOIdp81HW6+WNboH/YL52H0IgrJ:sxZPuMS/f9sbYf4Hb8/Y9
TLSH
T1B952E9516F346977CCDBD209BA05BF53D6F95473A2901E44AAFCCA1C00E6AED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 c414a7f50aa31b458204917b73a68bb4e532db93733e510af559ea52844277b0
MD5 713d89723e2b305a931b7c3e47f4a094
SHA1 0651e7957fc5175ab9441508a3cbc1f8a0e0354e
SHA512 248871655ca26dd32210147bf09aae3b7db2fe282571ecd57555e572e20cadacfa1797d31f0672ed350b87f2b1597b3bb08293e0754c8409fb6d988e1742fc42
SSDEEP 192:sxZfRkyM/jK1Ml8MkS/f9szezdp81HW6+WNbJ+tyXYLohyH0Ig5gaJ:sxZfWMS/f9sze/4Hb98yXtRCW
TLSH
T11552E8116E346977CCDBE209BA45BF53D6F9547392901E44AAFCCA1C00E6BDD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 28b12c96221291b6f6c0da09b5713cc5fc0a4a1cfa8635c59f6f5aee17a02f51
MD5 f9c8fa4f36b918e9520c6d8092b8b2e8
SHA1 1492889a6a912939b08a539c670c58cbcf96f8f7
SHA512 2022f26fa0e3cf25383716579d86a71dc892f6eae6bfdfd8683d39395b2b496607c3a0837bfeab82b8e7dc6a87b37076c89088e44441ef78e7ed19020a087e56
SSDEEP 192:sxZARkyM/jK1Ml8MkS/f9szYtdp81HW6+WNboH/YL52H0Ig5dJ:sxZAuMS/f9szYB4Hb8/Yt
TLSH
T1CF52E8516F346977CCDBD209BA45BB53D6F95473A2901E44AAFC8A1C00E6BED221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 7f254611535367573202b99ee7b71a12bd903d1a3b2e9df6c198f5cec557ee0b
MD5 712f4b2b36dbd2397aef3ad1e2777bef
SHA1 4e3ab7543ccf6960c2e794ab02c198129ac66854
SHA512 909aa6f36d1758913e70eccd16c3ee0536960403e1e92cc56fea9b5526932c568a76958febe0b3851fc8aab4d854e59cb7509c6622577a132c359ddcc2ff5ffa
SSDEEP 192:sxZfRkyM/jK1Ml8UQvtkS/f9szezdp+1HW6+WNbJ+tyXYLow9v0Ig5gaJ:sxZfWq+S/f9sze/uHb98yXt3CW
TLSH
T19952D6516A385977CCDBE20DB941BF53D6F95473A2901E44AAFCCA1C00E6BED221782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 c2900435001e8a9f716b025300770e242fa6b7c348ce890a3e6ac33d19d76668
MD5 c8de1e56ea36882ae9ef70f960f74fa0
SHA1 f53f688ff6b3145462ed3925f3d17383fd5cdbe1
SHA512 2fcaa44f505564c3b9c0d30b0abc8fff63b61b052c59b50a81854523ac6fd1f77933f125db2dd775083c78c2ab3a43c32393b0f8c1118120262b251757ae3678
SSDEEP 192:sxZfRkyM/jK1Ml8MkS/f9szezdp81HW6+WNbJ+tyXYLohyH0Ig5gaJ:sxZfuMS/f9sze/4Hb98yXtRCW
TLSH
T10652E8116E346977CCDBE209BA45BF53D6F9547392901E44AAFCCA1C00E6BDD221382F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 b9a1a0499f414d04d6546e82311de263c152152a10c8a7cc57951f61fa1a23cf
MD5 bce5846fffb80f55419bbda4b8b577fe
SHA1 cb8e3b5a541ddd1f66eed26b2c6898537e8d9d19
SHA512 666d9b6ee0bccd7d834e6e27bab799d728323cd38ba8c50ef84f56b72b53589646b0da67fcd70ce148acd34adac35de11a59ffbed5b1db3b52ee95d143d9dc6b
SSDEEP 768:Ows6pD1WvxzWj8F1+UoAYDCx9Tuqh0VfUC9xbog/OVEILlWwJNzroxLV:Ows6pD1WvxzWju1jahILIsNAxx
TLSH
T1BAD2FA3B680CCB7E4F841E5CEC2A6F967ED801CBAB98895447FA444C03C77EA512759B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 7fa4ed9ae1daa78b6f4e8d3ac7997e750e78abe1921a222341b85b9edb144960
MD5 49019f56c3c5d695641c285cc2b42902
SHA1 85b13eafe784578418130c9d28a7a4f665b5f8e9
SHA512 6f474d0ab436891b45c75e655487bec422f88ff50a9ac856d467e66ce4caa29d53024d6bcd37c0b10456aaca1e36dcb5db2e28ffea5f163a2f630597d471ac3e
SSDEEP 48:K0PY7/VpdktpmPImHkKzBb9k3f0oGVIyRwIvKFWcCyx6IvKfKQrylrIdKA8wQ:KUAAKtePiwQKFWvC6EKfKuurmKA8X
TLSH
T1C5C11F0271BB0A033D7E1B0CA265872B5B427263305CA92B3BED44754D9AE394DFC6ED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

0fc3a60a-0268-48a9-908f-2dc5f9c1a334.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\0fc3a60a-0268-48a9-908f-2dc5f9c1a334.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 1024c8726d0c7e8dbad3ad20e785aee12216ec8a0c0fda950c427dfbec61111a
MD5 8ca2174f9589940490f26f45a7138c90
SHA1 78d9bb492684a90d0ddbe0a37af863353c5208dc
SHA512 a29ebfbdd4c6d685563ba361a8c87dbec8f50d540aa8cedf22e31cd13f254c34692c79b325402f8c19e42db363803f8740388338ce4408928ef6f680857f69ef
SSDEEP 384:QiFrsNU8TUNTUlIlC5JMWna99d/VfkVDE:rFr7wg+afzkVDE
TLSH
T1A392E6F25CEB5837C9AE9747A73E2D039EBCC067B5856A50B788890CCC961BFD306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 59f37de08e6919d9cb33dc96aee71168bedaf1d821fa3365d4bb3ca07b699c63
MD5 4f65242d91a6d890a1649970192bc37c
SHA1 a44031a94481bf1be1ade6ade0c9b9863d5b3256
SHA512 22fbd4d71e0260164306df8692cc08c3eff798ac4e245e753f9e7808889c8c5893a51996d0e083c76aa45dec33b984a80e1f3d3cdcf1dcd9ae3a3b28d1469fa0
SSDEEP 192:up6sNhLQ/0i7+3vrlBmiU1vHY4atb0j+Fd/cQzDRVLMkqf552BI:VsNhL5J6tna99d/VfgVDz
TLSH
T1F7521836AC786C6749E3E186F5473613AFB48067DACA2F94D5EC9F0C01DB2AD2306916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 304167a791390243d2657160ae5e88740dae12937880cd8e0f01c5a660851d33
MD5 7b6c7c65df11e1388b026533014907a8
SHA1 9258469f84a4eadb62284ea14ed05ea6363859be
SHA512 e59c862ed5b31f781dc4d521c4f0d420161fe2ef324a23cc8d1a51423c5e19fdc443fa396c9b14a7c2ee59c7ef3055c04406a149e60e024c855b929271d5bafd
SSDEEP 192:uchsNhCQ/0i7+3vrYqBmiU1EHY4atb0j+Fd/cQzDRVLMkqf552BX:JsNhC5JM8na99d/VfgVDE
TLSH
T181521936AC786C6349F3E186F5473613AFB48067DACA2F94D5EC9F0C01DB6AD2306916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 20KB
SHA256 3bec920763ca96cba20825433ca8a41e5905f841232ab49c7432beca30e5f7ee
MD5 fbb49e502418324a1803decf566f6d4b
SHA1 28ae885ea6a12aa6fb50387ab5ab554d6c082250
SHA512 8aa5149d7cb25587e2e0a1b2a93cdf460b69e1ec539ed217539880928fe012ba14e5045c03ae3a66ae4fef6e8a44f668d8bc0e5ec38eb0b622c34c014dc4862f
SSDEEP 384:QiFrsNz8TUNTUlIlC5JMWna99d/Vf3VDE:rFrawg+afz3VDE
TLSH
T17B92D6F25CE75837D9AE9747A73E2D039EBCC067B5856A50B788890CCC9A1BFD306811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f91d33b12b80b382f9b7cff16a64b7cea7d2bc63dcdf207761540fb12cfda9e4
MD5 078170ecbf6863d440f927ae707af955
SHA1 626cd61ff3bda24b5b12ce4eebde3f34882dcc71
SHA512 675e3b1380686b70c512d3bb3a2b24d0e25ebff3f136684a7e98c0bf2ed33c4802a2a446dfb2aa1d5acca7078946a4f03c2163835771eb53bae8bd7b4c4cb6e4
SSDEEP 192:qONt6O7+3hQmiUy57Gttb0j+Fd/9UgGg6W8rU6:qONt61GGt99d/9agt8rU6
TLSH
T11102E7356C786CB78EB2AD49F58727235FA5117BE9962F81DAE81E0C00D766C2343C27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 33b55dd876fc160f88054110bf1a525ffc710033e86f0c56a483bb9f33c8a676
MD5 1453cd3f4097a85fc2b366e4d1478595
SHA1 7a47db4451a7f073871361ec26ff580667d1401d
SHA512 2e3979f3c3d114a9213835d42b3fc1a5915b51ef2598d15a7721da64dd7e4843613f7f6c9d67a2ad3e4911135233173950a2e8516277c3bd3343db6518ff869d
SSDEEP 192:eON86O7+3pQmiUyG7Vttb0j+Fd/cQzDRIcNkqf55U6:eON86hLVt99d/Vf7VDU6
TLSH
T1111219357C6C6C674EA2B585F48736135FA5412BEA8A7F80E5EC5E0C01EFAAC2346C16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

46c89449-e177-4d62-96a8-d387432d8850.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\46c89449-e177-4d62-96a8-d387432d8850.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 35bcc4aa782c7c68f0a1e78675c6db96c4a8a50bf20204503d5110a6c0a3b34b
MD5 39fa7ed2874dde9908893c61c5382efb
SHA1 6a4ad8907edc27e0122a0f545ed0d2260230c321
SHA512 8e53c97d69c5ba78263ce01a119f29db991afb7affc5f13fa77d7e3b8a75f774737e77fadd20f83c0556b1c06cf2b5660c889c8a1495ebf06c2fca5d117b945b
TLSH
T1EB41D658B6FA1148B3777F5AABF6B56E447AB9772E06D49D00110D4E0A23B00C9B1B73
MD5 SHA1 SHA512 TLSH

Submit Download