ffa50cabb2543a82aa55206925816b217419f426e0ca0d6d72783d21def0cd5e

Analysis

max time kernel
898s
max time network
731s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/08/2026, 04:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
email-html-2.html
Size 17KB
Sample260821-e1wnessgkd
SHA256 ffa50cabb2543a82aa55206925816b217419f426e0ca0d6d72783d21def0cd5e
MD5 2026139c545ef74469a2d7fe19a2e8aa
SHA1 fc23034496e614afa1f03623f2195f9966deb501
SHA512 09ed71602352dff2c51f593ac10f7a96d85669df8c9dd18f55c2a902c3619c27b59cfd26c527619a79f00aa53b944df1cc90693a42c12164a983db68de2e1cfa
SSDEEP 384:bvIGb9699y9YpzAUUAwuFAYd599999UK9hBABuraaPioT6A8uGw5YpX6EKplF09W:bvKFqaNLz
TLSH
T107821263F9191E0784F642F8E06A3F40D0C5C25ED3163D94A768A9E778CEE692B153CA
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4284	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134317599469212664"	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-189034102-168398478-1159367937-1000\{D4CE613C-7258-48AE-96A9-655221095C39}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4720	msedge.exe
4720	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe
4888	msedge.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 4888 wrote to memory of 2636	4888	msedge.exe	89
PID 4888 wrote to memory of 2724	4888	msedge.exe	90
PID 4888 wrote to memory of 4284	4888	msedge.exe	91
PID 4888 wrote to memory of 2724	4888	msedge.exe	90
PID 4888 wrote to memory of 2724	4888	msedge.exe	90
PID 4888 wrote to memory of 1288	4888	msedge.exe	92
PID 4888 wrote to memory of 1288	4888	msedge.exe	92
PID 4888 wrote to memory of 5144	4888	msedge.exe	95
PID 4888 wrote to memory of 4144	4888	msedge.exe	94
PID 4888 wrote to memory of 5144	4888	msedge.exe	95
PID 4888 wrote to memory of 5144	4888	msedge.exe	95
PID 4888 wrote to memory of 4144	4888	msedge.exe	94
PID 4888 wrote to memory of 4144	4888	msedge.exe	94
PID 4888 wrote to memory of 3868	4888	msedge.exe	96
PID 4888 wrote to memory of 3868	4888	msedge.exe	96
PID 4888 wrote to memory of 3868	4888	msedge.exe	96
PID 4888 wrote to memory of 1064	4888	msedge.exe	97
PID 4888 wrote to memory of 1064	4888	msedge.exe	97
PID 4888 wrote to memory of 1064	4888	msedge.exe	97
PID 4888 wrote to memory of 5948	4888	msedge.exe	99
PID 4888 wrote to memory of 4788	4888	msedge.exe	100
PID 4888 wrote to memory of 5948	4888	msedge.exe	99
PID 4888 wrote to memory of 4788	4888	msedge.exe	100
PID 4888 wrote to memory of 4684	4888	msedge.exe	102
PID 4888 wrote to memory of 6092	4888	msedge.exe	106
PID 4888 wrote to memory of 3000	4888	msedge.exe	107
PID 4888 wrote to memory of 1512	4888	msedge.exe	108
PID 4888 wrote to memory of 3412	4888	msedge.exe	109
PID 4888 wrote to memory of 3412	4888	msedge.exe	109
PID 4888 wrote to memory of 4720	4888	msedge.exe	111
PID 4888 wrote to memory of 6092	4888	msedge.exe	112
PID 4888 wrote to memory of 3000	4888	msedge.exe	113
PID 4888 wrote to memory of 6092	4888	msedge.exe	112
PID 4888 wrote to memory of 3000	4888	msedge.exe	113
PID 4888 wrote to memory of 2700	4888	msedge.exe	114
PID 4888 wrote to memory of 2700	4888	msedge.exe	114
PID 4888 wrote to memory of 1000	4888	msedge.exe	115
PID 4888 wrote to memory of 1000	4888	msedge.exe	115
PID 4888 wrote to memory of 4576	4888	msedge.exe	117
PID 4888 wrote to memory of 4576	4888	msedge.exe	117

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\email-html-2.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffc97c0c188,0x7ffc97c0c194,0x7ffc97c0c1a0
  2⤵
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1524,i,7126396277519310515,8867980895262158167,262144 --field-trial-handle=2188,i,7481536283833457450,8276943878181507043,262144 --variations-seed-version --mojo-platform-channel-handle=2184 /prefetch:2
  2⤵
  PID:2724
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1704,i,16252289465678882077,14436584804466978713,524288 --field-trial-handle=2188,i,7481536283833457450,8276943878181507043,262144 --variations-seed-version --mojo-platform-channel-handle=2228 /prefetch:11
  2⤵
  - System Time Discovery
  PID:4284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2316,i,14664084325786408197,7839299856027914313,524288 --field-trial-handle=2188,i,7481536283833457450,8276943878181507043,262144 --variations-seed-version --mojo-platform-channel-handle=2816 /prefetch:13
  2⤵
  PID:1288
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3640,i,16354602894231208900,5562197390364679243,2097152 --field-trial-handle=2188,i,7481536283833457450,8276943878181507043,262144 --variations-seed-version --mojo-platform-channel-handle=3668 /prefetch:1
  2⤵
  PID:4144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3664,i,13697043382941098451,6892314781058203355,2097152 --field-trial-handle=2188,i,7481536283833457450,8276943878181507043,262144 --variations-seed-version --mojo-platform-channel-handle=3688 /prefetch:1
  2⤵
  PID:5144
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4272,i,946380416912098135,2977018682084387444,2097152 --field-trial-handle=2188,i,7481536283833457450,8276943878181507043,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:9
  2⤵
  PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4364,i,15362266644996366628,12968573576894978879,2097152 --field-trial-handle=2188,i,7481536283833457450,8276943878181507043,262144 --variations-seed-version --mojo-platform-channel-handle=4368 /prefetch:1
  2⤵
  PID:1064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3872,i,16011652246915521920,5068847499879776470,524288 --field-trial-handle=2188,i,7481536283833457450,8276943878181507043,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:14
  2⤵
  PID:5948
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3860,i,2082481394983376765,17519927846651400471,524288 --field-trial-handle=2188,i,7481536283833457450,8276943878181507043,262144 --variations-seed-version --mojo-platform-channel-handle=5532 /prefetch:14
  2⤵
  PID:4788
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,1637637904330360706,4513905505152875441,524288 --field-trial-handle=2188,i,7481536283833457450,8276943878181507043,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:14
  2⤵
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,1637637904330360706,4513905505152875441,524288 --field-trial-handle=2188,i,7481536283833457450,8276943878181507043,262144 --variations-seed-version --mojo-platform-channel-handle=6112 /prefetch:14
  2⤵
  PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4272,i,7841978988200724594,14344651867253886926,524288 --field-trial-handle=2188,i,7481536283833457450,8276943878181507043,262144 --variations-seed-version --mojo-platform-channel-handle=4652 /prefetch:14
  2⤵
  PID:6092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6112,i,6572177979523749395,12376279105384396516,524288 --field-trial-handle=2188,i,7481536283833457450,8276943878181507043,262144 --variations-seed-version --mojo-platform-channel-handle=6612 /prefetch:14
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6608,i,11510993931763146452,7688823278382595946,524288 --field-trial-handle=2188,i,7481536283833457450,8276943878181507043,262144 --variations-seed-version --mojo-platform-channel-handle=6536 /prefetch:14
  2⤵
  PID:1512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3000,i,1436543751301920637,14162483367710811286,524288 --field-trial-handle=2188,i,7481536283833457450,8276943878181507043,262144 --variations-seed-version --mojo-platform-channel-handle=5608 /prefetch:14
  2⤵
  PID:3412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=816,i,6100904961482151118,17068457834499686116,262144 --field-trial-handle=2188,i,7481536283833457450,8276943878181507043,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5312,i,9620728541108269458,10511219052499395454,524288 --field-trial-handle=2188,i,7481536283833457450,8276943878181507043,262144 --variations-seed-version --mojo-platform-channel-handle=6012 /prefetch:14
  2⤵
  PID:6092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5604,i,4106385326779631602,7693278367700262294,524288 --field-trial-handle=2188,i,7481536283833457450,8276943878181507043,262144 --variations-seed-version --mojo-platform-channel-handle=5508 /prefetch:14
  2⤵
  PID:3000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6020,i,4828042790062476467,2984717897582180655,524288 --field-trial-handle=2188,i,7481536283833457450,8276943878181507043,262144 --variations-seed-version --mojo-platform-channel-handle=3284 /prefetch:14
  2⤵
  PID:2700
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5728,i,9362966289692579431,9238629894738123887,524288 --field-trial-handle=2188,i,7481536283833457450,8276943878181507043,262144 --variations-seed-version --mojo-platform-channel-handle=3720 /prefetch:14
  2⤵
  PID:1000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5516,i,9016617885402013705,12037946879604738912,524288 --field-trial-handle=2188,i,7481536283833457450,8276943878181507043,262144 --variations-seed-version --mojo-platform-channel-handle=5356 /prefetch:14
  2⤵
  PID:4576

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2700

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:6112

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:928

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:3484

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7add6572365d752d8c3a090b9a256c43e3c5ff716f29ed7aa3c53dc57a08ba60
MD5 0da70f521ac5aee3489abf6e3eb4e375
SHA1 0f3cd9919820116ecc86bab93f4712c08485dc56
SHA512 a9cddd04863b2ac842fe4f91265c19a41d8b7442be8f07a91747705beca52c1e1d563e3c46cf68e1b73606695624f13ca69a8246653c2535d0684ced42c37d33
TLSH
T182D09BD479045D78C4C1353231A673155A616435DA5C46481051F3AACD65141667F5AD
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ffe13798c5910685872d371e84c30baa9eefaaa5db1419603eb30d473d7b2e37
MD5 03c111f9396889c77f6d9883c5df333f
SHA1 be65300843096dba92c5695fd35e2dffcbb7eb0a
SHA512 a77dfe3b48fcb72648f1adfafbf0d0fcd4d88690dcf41609a03e1d6b645d1336b6e322931b2205673283b920d20ed0225c6aa320a83a2d3a410771f18d120c19
TLSH
T1B1D09BD079145D78C4C1353231A773155A516435865C46481151F3BACD65141667E59D
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 04d7d675217a61d3d53f7f5797e5efc57d597982c9ca173c5df397b6d0635f2e
MD5 beff5b216efb6ce129f908599558f0a4
SHA1 981fbbd5816204f2699f4f6dd735c89df7c67ca3
SHA512 2b8a4b6dcb4ed7f6713f86791ed11072b1671eb70af9ebd762a1bf4a4c3a6d73318f9e1e80c75636020e57b7754695678fa814308ce86c7db704ae9612ea1690
TLSH
T15AE026A40ECBC22FAE007487A26CC30C9281360ED6C8F9CE1B00C49A7011D90A3D7690
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 ad3d4f62bd336fc4c4d543a29658408e22f587cc20e41d95aa9215abeba3ba18
MD5 7e16cd8f4d571a9ee380517922653ea0
SHA1 c2482509c0313324900c9772e23c16077ca60ed6
SHA512 a608533eb38892660850287152faebefe592fc49ab65ada0a0a5c5f6aa0280a26d11b907b0e5e1cb223602ee8151a10625fbbca771bc1c8752e5378ae19845ec
TLSH
T135E020F418C5C25F594574C79168470CC184360E92C4A9CD3715C8C97102056F3D7951
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 a1fe98b071a7c4c113443787dafece8a0295a28b4aee854e09e107f306e1068e
MD5 3f8209706b0a3624558552faf92663bd
SHA1 b793fdab084dbeedea4bad2d2266de8ba9f1ee9a
SHA512 15f5ae8879698eae725b1f6d373d4313c35b3adfffdcf2e7dcfb449e484dee5e01a35aa481e07ec596f98d2ee7b832ba6d7c378e35fd6ab9ba2c29de50b64e01
TLSH
T1C9E026A458C8C26FEB15748B92AC474C92A0370E93CCFDCE2F2884987001866E3C6694
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 2a9362e5b54d808954f7efc36e4ca9b93c7c12a9d1b1f5d0ad8f82b6469c48e4
MD5 2e3456978c61ea373035bbde59f30b3a
SHA1 70d6b2a772ed3be70d9d8513d8b12668c445ffd5
SHA512 930deab3debf5d97faccf5d0e6529c69f4710ebb7853e00d75eb6dc177fbf738c4fbe3308af7ef119b0f005c599ad4649b0bc88755d456a617a58d7232a5eec9
TLSH
T173611BA55325D9C1CB24797353E9A89832F884FA03271E36F981AD7614C6F68FCC7227
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 b653f6ae7e3923ffee9b6e5e389efc3d954c7135e205ed7d558b24603ebc00c0
MD5 9dd242beb39873bedd417cc9fa54913d
SHA1 ad634a48551ab39fa25575efd5d364bfd913238f
SHA512 feead137f559e4ffbce9ee1c62674c69eac2c18ffc97cff81a08661ac6706c25b60dc703b8f4de4d22fba37169a483e591812d52dd2e27aa3053430c6fdfc170
TLSH
T19231C2F747B5816EDA0196F0AA04AE2FCE1C0515431C7CA985D0AE27D3F3472E041B9F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 c5204d0c8200403f3c3d0007e6ebad74db117b19b3fe56a0ef67e50e87b016da
MD5 7dc2d2f31d7b83b30f7865cd5fac0f35
SHA1 c5ebdcd3ef9a1669a05445c0066fef22b9ece251
SHA512 030bb5984a4778e848cd23a02ddbeb5ad03ac5b7beffb16c6adb4836698c4f3bede357e74702f8b78cc563dcdcf31d2cc9a4c7c12d8717c035c60b1f2cb8dfb0
TLSH
T1E631A0F783B5957E8A0196F0AA14AE1FDE1D0511436C7C6685E0AE2793F3471E041A9F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

d18449f0-885b-4258-9f84-bf5152ad0bc6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\d18449f0-885b-4258-9f84-bf5152ad0bc6.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 265e3d40d291e59e10492cdc0218ba6c9c3f45ba649d549c054a8b99177c0c64
MD5 8642be8f79ec70dc003a81dd5f9635c4
SHA1 f02078c119de623e04ad58102d8c952c8fa8a950
SHA512 5673e3a4501d2994afc83a0a16d2b8a9930834c59001ef2b5963a55f06a7a0280441d6970e342520724aa4c40a7cf2a57fbd282fc6f679001aa44925ec03e119
SSDEEP 192:sxRrRZbQ/fw+srd+8bNZozoA8p43k/g6+WNIYlzZSVtGWIgIJ:sxRrHQ/fLsrY8ZxJ/5IJVs
TLSH
T1F532B715A968A93B8CCBE21DFB157F53E7F96032A1945E44A6FCD60C04E7ADD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 18dc5c4592e0677a57e353078a2dbb3ba4f10b2f5447803367d1fbc30f1ee1b0
MD5 367ab3e5d5f226653b52350da7953224
SHA1 baf0d6c6bc70b0dab05fb3b94f93b32242b39ce0
SHA512 ed6b7288b8391601adf4c8788dd8e626b3f8d9e0c1db86582fb884e516e844b991f30d419681f157fe064a5851e0543638e952c9b3d15dde80168e72df290d09
SSDEEP 192:sxRgRZbQ/fw+s5o+8bNZozoA8p43k/g6+WNIYlSZSVtGWIgD8J:sxRgHQ/fLs5l8ZxJ/5IOVM
TLSH
T11C42C855A968A93B9CCBE21DBB567F53E3F9603260945E44ABFCD60C04E77CD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 742b9eab44fed3545aec8405ac6e9520d2d25dc08751e5e9267b7efcfb65fb7b
MD5 078d452f2aee0fd03da96ef4772eefb3
SHA1 532fdc9d252b8d2daa123efd7feb16db886514c4
SHA512 64608385014aa6d10d5ccfda205078e32ac209c79e6246361aa284a2041b9177c9e993a5e1b21101459999a174f951040ae57bc144165b26b7759e26adf97f2b
SSDEEP 192:sxRgRZbQ/fw+s5d+8bNZozoA8p43k/g6+WNIYlzZSVtGWIgDmJ:sxRgHQ/fLs5Y8ZxJ/5IJVO
TLSH
T16542C815A968A93B8CCBE21DFB557F53E7F9603260945E44B6FC960C04E77CD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 28219d3307649605f3db71b31b773c349af4b20b5c1b5ae7bcded1f25fe953c3
MD5 582f4cb93dd2210f69d6d8fd9bd6bd6e
SHA1 d821af4acd9762c4dcd80d12d510bd7023956425
SHA512 850a643d8b5aebb82f41eeecf4b7983c45246eae08b9fab140b47603cfbc3eb700933f5059c1cb033a18510f296f8b61d898a22b0562bc7a33c34add5c8e6548
SSDEEP 384:dpCfAo9fCtggCFfJJKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OV//93VRRvroKM2:dofAoxWgg+fJJ8F1+UoAYDCx9Tuqh0VO
TLSH
T1C6B2D93B600DCB7E8FC04A9DEC19AF977D9802C796948D4047FE994C02C77EA911A4CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dbc21efe-494b-4aef-aecf-6b4521d42992\index-dir\the-real-index
Size 264B
SHA256 8e7667471bf3929959107ef9ee64ed2a4f46e935015d3f76393214a51180c62e
MD5 57d0c6f89e14def79846f7023983ea40
SHA1 da1402281de521a6bdae0f28d74d8500b436591e
SHA512 d71bd32d5dc2f7eacb2cbcf2e95159d64d49fdee62d9bc9f29979d97278784b6c168d031095aeb6385ad895aa0ad21f5085f5cee240deea7e9d95e5292a34c0b
TLSH
T186D022898C66961ADE177C7A067724283B3B02FD3102BF2A40BD106E9A18AAC5987506
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ddbdc.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dbc21efe-494b-4aef-aecf-6b4521d42992\index-dir\the-real-index~RFe5ddbdc.TMP
Size 264B
SHA256 7206a4c30047e8d70f546b8ccc5a6a63b8a5c7a52560be4a1c689027f89c60dc
MD5 adfe30cd306a7d128e50eed2d86d1290
SHA1 88840775100dd5d56297880f3d497892590d956b
SHA512 36f17ee080ab85064b12a53f9f91ccd13da75320f01de58284da471c6a688991c7287b07bc365893b8a3aa5a4d8f30703fc1d7eb51c382962622606f0ef80a2a
TLSH
T1A1D022CA4460EAA1EA1B283824076519333B08242012AA3150EE149F08A16EC488320A
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 79cbe270c5537a7eed527be26e8416eb362cb716227070734a1b06baea3be0d1
MD5 8086df97297962986e8de74063b56b7b
SHA1 cc2065d8d5418e0dfbcc3b5f96f09aba5f58d5a1
SHA512 661ca6a0018df8331adf274206d104d38602c20b7f9e6b81a4a5d994a66cbb8a1173df65c515fef45d259096b3f526814e2dc0b8f5ef80d9550c1f2dc53748f9
TLSH
T1A3E0D8F67EE72410BC7FD7E5207144B44542F854D859FC0E606AA3D7E4E53542C09C21
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 4386557a1cdc2bb18b90ef82999616225e687714da2671246f46d7652a35727c
MD5 9d3555e18e1533d899822a63aff1cefa
SHA1 a8bfe78655ef80b24d54f43529592fb32ae6e0c0
SHA512 8a16d11a009ced767ad16754eedf49fd74bf6ae05b76d93d75eb12ed769ec74ef3d0464b48d75d59e6f26bd9e76e87f0530d95defda3ba1af77290a0763625d1
SSDEEP 96:KRpm3zBj3TWH0ig7TK4Kg1Tc5xMv3wHc9oMmqesWa33gUsK45gesc8M32L3uKkML:Cpm3zBj3CH0j7JKg1A5xMv3wHc9oMmqj
TLSH
T1D591110076BA1750787E6D0C91A9D85ED3C178723059E46F3BAA41B50FA6E438DFECC9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a3450.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a3450.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 68c94b65b7e7df670b72c965a5bd4bbd6459b3a95292019755cbeeac128883e7
MD5 31f71263c5490689598d2952eac296a9
SHA1 25aaf6bdbf822bcbae5838e9d17904eb2eecb67c
SHA512 e953fc3b51370c9513cf9846a2f9057a01d9a927ac2912aac1ad29cf2ab6414f4a18ec5ab1a1a3011aad734b33ebb1f87c7e9ce90d96d9dafc7af0f3ee2f203f
SSDEEP 384:3ZcIG38NCr286O43zJzRfY9bYacQDDrQPlLJQXmIkdP9IimIMWEfMbc+HIfv5uYY:/G3GtZliJVDwNHXmTWTbc+HIfBuPJ
TLSH
T1DDF2B0B0DCA59E375CEAD288A6067A46AFF9117384CC5A44CDDDBB0D018765D031BC2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 23c0fbff9bfa476b8cacf16739e72fbc7fdea3f0a8d9e5108b18fc1dfc6cfa7c
MD5 7b9cd243f0591cc80be56a33aaad9a13
SHA1 0c37bde6d99ae58843a1454dfa41197ee9b1502e
SHA512 dc2e158512fb7e5c01254647439fe49e8369fce559dae3efe2cff125a764b3b7a7dceb63570229be2d944e9c43ad8c99f712ccd39e341739e593943d81d55f4e
SSDEEP 768:Nrv+4UNbdx3dtxliJVDwNHXmTWTbc+HIeVH1SvBy:NbsbT3dBuweWn1oEH1+y
TLSH
T1E613CF71DCA99E37ADE69688B14B7A477FB9117384C80A84CCD96F4D028B59D030FD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 7169046a66cf4ac95dada4a6b3f52b232f74289fe67fae52faac67284663ebd5
MD5 c1248313b8acf6fe86caa51156011b5c
SHA1 391b19ebf9146526d1305e2ec162e948a8a92818
SHA512 017595fb6cb129789ed41ceb23f6c781fe33d3a2af15597c8b3997db511ac51450ec787e85622fd03a4bafa4153794423a8808bc5071c37e6af537e2ae09b0b3
SSDEEP 768:cFQ63NwgwtZliJVD4NHXmTWTbc+HIfBuPJ:P63sFuYeWn1ofBaJ
TLSH
T1F2F2B0718CD5DA3BACFAD784E60A7642AFF51173C8C8AA44DADCAB0D118759D030BC27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 5a226c0c06a0750f2690d7663c15a8c1b1333df3b108cce7591b36baa6d23d97
MD5 000c75507a6c7779feed39cd62c5c6cb
SHA1 2f3602f3fde4f38aef130c779b478c622b31363c
SHA512 65ec88dd685e4b4260359ca68cc1393cb25f460e09528620c6c24a24ae76fc26d7bc6649decaffda68ddc76b453c9fa47b23513360dd222f65599477189a6fc1
SSDEEP 768:2rv+4UNbdM3J83iJVDFNHXmTWTbc+eIeVH1SvyZ:2bsb+3+uTeWn17EH1dZ
TLSH
T1FA03CF71D8A99E37ADE69688B14B76477FF9116384C81B84CCD96F4E028B58D030FD2B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 af3af585aa730655622619f0e6355e91c06ee26f1c4df3512b529a466aeefbf1
MD5 95a864706449280160fa03e9a19b1419
SHA1 10b7327aee058fa941ae49ac35c46db811d455d6
SHA512 c5a1c552594dad2066fb2ef8172282e366002843db610bc45f1740471a22e1efd52b9d310874b0b466429038008fcf878c63255670a40af4da72cd848fb95297
SSDEEP 768:arv+4UNbdM3273iJNNHXmTWTbc+/LeVH1SvyZ:absb+30UeWn1jEH1dZ
TLSH
T18903CF31DCB99F37ADF69688714BBA573EB8116385C40B84C9D96B4E028758D030BD3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

76c33ca4-4441-45e9-a721-f74f45f28061.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\76c33ca4-4441-45e9-a721-f74f45f28061.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download