0c1502334ed91e81f2dfb46ed267a567ff856576140ec323a635c3dab3377868

Analysis

max time kernel
899s
max time network
731s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/08/2026, 03:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
verify-ua.html
Size 9KB
Sample260822-d2td1seb22
SHA256 0c1502334ed91e81f2dfb46ed267a567ff856576140ec323a635c3dab3377868
MD5 99c20cd4ab9e86532ad4716e06a29821
SHA1 610125c37bbe56d41899d031b70e1ac1c4eb816e
SHA512 5e2390357edd3fe90760cb6b25778cf8440a6d4802375b3cd12eeabfd6596efd1d08288bcfcd30be113b4c863b65ac694e3606184113767af80ac05bbafb4223
SSDEEP 192:xOtsAAGB28E3PQLJirpoqc6487A0CGKsW:l6/HIrXc6d00rKl
TLSH
T19722A320D8F1127B465AD5CD6A78B318FDC3904BDB46A128B1BD43982FE7F928843E5C
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
252	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134318430524835162"	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-3986082593-3624157295-3514260330-1000\{7D508E96-8D25-4045-8434-47CE68B6FFB7}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-3986082593-3624157295-3514260330-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3472	msedge.exe
3472	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe
5092	msedge.exe

Suspicious use of WriteProcessMemory 43 IoCs

description	pid	Process	procid_target
PID 5092 wrote to memory of 2300	5092	msedge.exe	89
PID 5092 wrote to memory of 1756	5092	msedge.exe	90
PID 5092 wrote to memory of 252	5092	msedge.exe	91
PID 5092 wrote to memory of 1756	5092	msedge.exe	90
PID 5092 wrote to memory of 1756	5092	msedge.exe	90
PID 5092 wrote to memory of 2732	5092	msedge.exe	92
PID 5092 wrote to memory of 2732	5092	msedge.exe	92
PID 5092 wrote to memory of 4256	5092	msedge.exe	93
PID 5092 wrote to memory of 4256	5092	msedge.exe	93
PID 5092 wrote to memory of 524	5092	msedge.exe	94
PID 5092 wrote to memory of 4256	5092	msedge.exe	93
PID 5092 wrote to memory of 524	5092	msedge.exe	94
PID 5092 wrote to memory of 524	5092	msedge.exe	94
PID 5092 wrote to memory of 3440	5092	msedge.exe	96
PID 5092 wrote to memory of 3440	5092	msedge.exe	96
PID 5092 wrote to memory of 3440	5092	msedge.exe	96
PID 5092 wrote to memory of 1720	5092	msedge.exe	97
PID 5092 wrote to memory of 1720	5092	msedge.exe	97
PID 5092 wrote to memory of 1720	5092	msedge.exe	97
PID 5092 wrote to memory of 4312	5092	msedge.exe	98
PID 5092 wrote to memory of 4312	5092	msedge.exe	98
PID 5092 wrote to memory of 4312	5092	msedge.exe	98
PID 5092 wrote to memory of 480	5092	msedge.exe	100
PID 5092 wrote to memory of 3180	5092	msedge.exe	101
PID 5092 wrote to memory of 480	5092	msedge.exe	100
PID 5092 wrote to memory of 3180	5092	msedge.exe	101
PID 5092 wrote to memory of 5112	5092	msedge.exe	103
PID 5092 wrote to memory of 3640	5092	msedge.exe	107
PID 5092 wrote to memory of 4484	5092	msedge.exe	108
PID 5092 wrote to memory of 6100	5092	msedge.exe	109
PID 5092 wrote to memory of 4340	5092	msedge.exe	110
PID 5092 wrote to memory of 4340	5092	msedge.exe	110
PID 5092 wrote to memory of 3472	5092	msedge.exe	112
PID 5092 wrote to memory of 2084	5092	msedge.exe	113
PID 5092 wrote to memory of 1052	5092	msedge.exe	114
PID 5092 wrote to memory of 2084	5092	msedge.exe	113
PID 5092 wrote to memory of 1052	5092	msedge.exe	114
PID 5092 wrote to memory of 3648	5092	msedge.exe	115
PID 5092 wrote to memory of 3648	5092	msedge.exe	115
PID 5092 wrote to memory of 3408	5092	msedge.exe	116
PID 5092 wrote to memory of 3408	5092	msedge.exe	116
PID 5092 wrote to memory of 3340	5092	msedge.exe	118
PID 5092 wrote to memory of 3340	5092	msedge.exe	118

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\verify-ua.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x328,0x7ffda6b1c188,0x7ffda6b1c194,0x7ffda6b1c1a0
  2⤵
  PID:2300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1532,i,18026686397642074497,11499404304168221934,262144 --field-trial-handle=2108,i,10390780933817399136,6440732011626776210,262144 --variations-seed-version --mojo-platform-channel-handle=2104 /prefetch:2
  2⤵
  PID:1756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1792,i,17192941620823469608,718293896579712029,524288 --field-trial-handle=2108,i,10390780933817399136,6440732011626776210,262144 --variations-seed-version --mojo-platform-channel-handle=2136 /prefetch:11
  2⤵
  - System Time Discovery
  PID:252
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2396,i,17571583768984498793,8786577764431734230,524288 --field-trial-handle=2108,i,10390780933817399136,6440732011626776210,262144 --variations-seed-version --mojo-platform-channel-handle=3192 /prefetch:13
  2⤵
  PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3588,i,1232521503248640269,15780738612186913665,2097152 --field-trial-handle=2108,i,10390780933817399136,6440732011626776210,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
  2⤵
  PID:4256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3680,i,14662776517169919140,17282047055033762567,2097152 --field-trial-handle=2108,i,10390780933817399136,6440732011626776210,262144 --variations-seed-version --mojo-platform-channel-handle=3692 /prefetch:1
  2⤵
  PID:524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4284,i,7257461977315459558,2493478133611573560,2097152 --field-trial-handle=2108,i,10390780933817399136,6440732011626776210,262144 --variations-seed-version --mojo-platform-channel-handle=4364 /prefetch:1
  2⤵
  PID:3440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4344,i,5904963908450054926,8541721138153396916,2097152 --field-trial-handle=2108,i,10390780933817399136,6440732011626776210,262144 --variations-seed-version --mojo-platform-channel-handle=4508 /prefetch:9
  2⤵
  PID:1720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=4280,i,2938459554786208610,12000198379603729967,2097152 --field-trial-handle=2108,i,10390780933817399136,6440732011626776210,262144 --variations-seed-version --mojo-platform-channel-handle=5328 /prefetch:1
  2⤵
  PID:4312
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5536,i,18293220032908958789,3172131049005289969,524288 --field-trial-handle=2108,i,10390780933817399136,6440732011626776210,262144 --variations-seed-version --mojo-platform-channel-handle=5624 /prefetch:14
  2⤵
  PID:480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5544,i,15082855179409197036,5562959507496784276,524288 --field-trial-handle=2108,i,10390780933817399136,6440732011626776210,262144 --variations-seed-version --mojo-platform-channel-handle=5568 /prefetch:14
  2⤵
  PID:3180
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,5322039729288549785,1545202780480409439,524288 --field-trial-handle=2108,i,10390780933817399136,6440732011626776210,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:14
  2⤵
  PID:5664
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6228,i,5322039729288549785,1545202780480409439,524288 --field-trial-handle=2108,i,10390780933817399136,6440732011626776210,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:14
  2⤵
  PID:5112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6036,i,14950474730777737105,118896351227773530,524288 --field-trial-handle=2108,i,10390780933817399136,6440732011626776210,262144 --variations-seed-version --mojo-platform-channel-handle=5212 /prefetch:14
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5260,i,17148982425514907097,9206621516928513297,524288 --field-trial-handle=2108,i,10390780933817399136,6440732011626776210,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:14
  2⤵
  PID:4484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5268,i,15403138318780885654,12401038313503219556,524288 --field-trial-handle=2108,i,10390780933817399136,6440732011626776210,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:14
  2⤵
  PID:6100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5660,i,14762881252013482511,12199863678353567658,524288 --field-trial-handle=2108,i,10390780933817399136,6440732011626776210,262144 --variations-seed-version --mojo-platform-channel-handle=5704 /prefetch:14
  2⤵
  PID:4340
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5176,i,6121304239767968008,1015597738165822511,262144 --field-trial-handle=2108,i,10390780933817399136,6440732011626776210,262144 --variations-seed-version --mojo-platform-channel-handle=6712 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3472
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3420,i,944557193618243458,16696811634757310893,524288 --field-trial-handle=2108,i,10390780933817399136,6440732011626776210,262144 --variations-seed-version --mojo-platform-channel-handle=6188 /prefetch:14
  2⤵
  PID:2084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6004,i,831491875788764922,1535502634280385523,524288 --field-trial-handle=2108,i,10390780933817399136,6440732011626776210,262144 --variations-seed-version --mojo-platform-channel-handle=5256 /prefetch:14
  2⤵
  PID:1052
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=600,i,8285213709566778424,5113918092774723250,524288 --field-trial-handle=2108,i,10390780933817399136,6440732011626776210,262144 --variations-seed-version --mojo-platform-channel-handle=5548 /prefetch:14
  2⤵
  PID:3648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6664,i,14258494454002591392,10178153202525879561,524288 --field-trial-handle=2108,i,10390780933817399136,6440732011626776210,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:14
  2⤵
  PID:3408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5188,i,2422678219443189940,16887961701228915863,524288 --field-trial-handle=2108,i,10390780933817399136,6440732011626776210,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:14
  2⤵
  PID:3340

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4932

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:1908

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:1328

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:2560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 da739d58d61b2ac7b5d9bb7ad60982cb15b364d9c7c9297fd0c9719c271cd985
MD5 2d2e0ac0da9a175b4b6a8be7c9d51cce
SHA1 ff15c8a5ff11faefae3f7491c7968a2163702b81
SHA512 0ae78f15909f04e1a81109917b8eeb5b8062a49558d8a40f15c02076b087f36e82b88b329e9d984fc68c62cb15408123b9db7f705f2745bfefc30b5aa2e164e6
TLSH
T1EAD09B5A72455D4CD641343224E55217E3108821754546194253F0768DD668717ABD9E
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 18a644ba613d5b4137dabc346f57eca622b6888922eaec751025ab3c0a002fd5
MD5 5eddc74c05def624cfd47ea0a7e304a5
SHA1 b5f795fcc3846bb781e66e0373fce119975b2659
SHA512 1c777d774c154e89b80817ce7344495d83eecf133c36e0ad7c60dd14d76e628697535cc3fc379ca4eeb776f3bea5096f94d0fd76a2394ecd2e52f5ca8dc0053f
TLSH
T133D09B5672455C4CD641343224E55217E3008821654546194353F0768DD668717ABD9A
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 fcb8ea40d7c84ec1ae7838f0fc4723d7f5cdbbabce7e685a9964b7eb656dd9f8
MD5 83b07fa8265f289992631f050db00b43
SHA1 f1d8121871315cd46bbed9cefa33a5ec8d228da7
SHA512 67b86fe836d94aaf23c50f12343adc9260bbed0f28192470831c0c81a4a649ebb7e5a5bb8022f9a8ee4e6ca84c7696e2665eec31c267b05f172fdcb890ebbdab
TLSH
T173E07DE408CCD2BEA7096647516FB34C82803B1BD3CCED1B3701C8CC76056C4B6C6690
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 9447b462247c5fb535bcc81ddd7010c8eaf526ee88376df6a7137e28f961bcad
MD5 83eceea93c9bada154a7ccd3cf883e5a
SHA1 3cd0680b0dbd6e68347b4ff8c979488f99e90ac1
SHA512 8b9d50b14d00de21009203353bb1b2affaf83289216088e09f11865b0f29a1fbf89a7f2ce738f12f88b3ae472a5771f61a7154900075048640326f7c3da66f3c
TLSH
T151E07DE404C8C22EA6027C8791F8730C8280370BE3C8FD1A6748C48970874B0F7F2A90
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 5165404bdc85c1d0fd69b7b9995a33d75e768b4d8c706fe3990786d109964843
MD5 9dbd79fd4d0eace1067e9e6f03943777
SHA1 5a1e65d8c2d5e55451d48cfe01548af16ed19ba1
SHA512 b608a2ff4c3d41793423dabebb4f711c64ec22df24ecdc7f126a8991096c84cf0b0661490dc14bfe597f121bb343a128d4a18bf3fd99f302b7ec78bcd82ef41d
TLSH
T1BEE026E405CEC2BEA6106C875178830C9380370BA7C8E91A6704C8887186D80B7A2695
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 7278e9cc20ef25f60ce75cd58d4a9b2c01b886e7b2fbe5d8f5292bdfe9009dd9
MD5 ec05bfadb17a453db94d42dcdf4d5272
SHA1 6726c2f69d3022ba6c7492c00cf8b4c6b5f7820e
SHA512 64fa16f2a9984171ffdfa4e4d7561a0aa545143044080dbf358cc03a5069146a1a8dcda341d2de64baa007fa3326b26967e32be9cfb709d15a31bf881095ba03
TLSH
T15B515043831E15DFD735C97A2CA85A3F3AFAC267058BAE1470902DB4D70AF4453DA627
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59b0e7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59b0e7.TMP
Size 3KB
SHA256 c311617dfc81bb50906c8b633f0f103f34af08b6415533ef9832629841fce0dd
MD5 9da7c97060dccfe23ddb08dab7dc4ca4
SHA1 78115823ea3cdd82f6f34efdead93ca5a948aff2
SHA512 4f0f0101d958462d9ace612649abefe4361788633a3b681ccff25acbaf9158338984e1b13ade18a5057aaffd279b72cd13f8cb5864a96321f729e87343cae96a
TLSH
T16A515053831E19DFD735C97A2DA85A3F3AFAC267058BAE0470901CB4D70AF4457DA223
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 3KB
SHA256 f4bc493180a7002b9da7115560ee7a4691b2f1e5d3dba2b2e99cd632feb13246
MD5 0f7666af456d9d9dd10b0b051b30ed97
SHA1 4f40197c949c6dc237161abb2e260d464c504703
SHA512 66438a34c5c45e3bf1b33f396266a4be7c162950ff5caf46e69bbb5f735b51de396ecaf62f610db3fcc56fb918a6edfe20828f53cb34b9ed977d461a157423da
TLSH
T1AA71CBF7C3D4877E885126F15A296E5ACD2D161B82283C568DF4BE1F63F20B1D102A9F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 a586e6f72c5b836b4c356f1619802e339d6639d156df3c5f985680e7f14e18fa
MD5 3f8521d86f3c6cfba8c43666935f1a73
SHA1 57c6f12d0e4d0b597113d230a83e06144f25c384
SHA512 263db7e31a0f4243cea5f31df0203ee355c0c286d8391128325fd9b66249f6d92c977958e6874e3ab269a133a4c33990b33bae7659d6c6c4b52fc1cf9fabfd3f
TLSH
T17351D0F783E487AE991156F09A18AD1BCD2C1116432C7C658DE4AE1BA3E2071D142B9F
MD5 SHA1 SHA512 TLSH

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

e625fbf1-67f9-44ca-8421-b2b28a912c99.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\e625fbf1-67f9-44ca-8421-b2b28a912c99.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 8a5e0be36092ac07d8702ead9334d31c126501c9d4e8bbdb735f57a2433f6cef
MD5 33dabdded730a55000a4825edfaab6ff
SHA1 7742cdcef2ef101d3569cf30899cb26f9df8da0c
SHA512 e4a077c8a3b7156ea86bf7cd5ccf006098e88579b0b1604856cafb36e4d13870c3bae2d648c528683ad7a4856958631245d07bd0f672db3dd09511298dc6fc9b
SSDEEP 192:sxR0Rpbg/f6smGwYCbQzoA8p4q/g6+WNIYEgR3vGAXIgIJ:sxR0Xg/f6smGwPJ3/5IIBs
TLSH
T1C432C7166928A93B5CCBE21DFA25BF53D6F9503360946E48BAFC860C04EB6DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 65fb9f7790a8c304fcfcbfbf1d57de78539d0f1c8b962eb44f72f68055de5a18
MD5 55a091c97e843dc662c8af572bb44177
SHA1 093e31cc9736c3994e0c05e13e3bbd170a5090d4
SHA512 a7f6eaf594fe987cb9c5c3d06101a4ba075e84fcb9dcf30e0563ae17be5a544ea4ec136e7340d7debf04052abb18430d77c17cb7d009b4bb0e49164d85b5304e
SSDEEP 192:sxRrRpbg/f6sNGJYCbQzoA8p4q/g6+WNIYErN3vGAXIgDvJ:sxRrXg/f6sNGJPJ3/5IpB9
TLSH
T19842B7156928A93B9CCBE21DFA56BF53D7F8503360952E58BAFC861C00EB6DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 049692dbe46d642d75672774a9aa6f5017ec3a5b2a2ef1e8126d382471c96bad
MD5 5ff357a4abae652a33ed0a33a1e6ec61
SHA1 0f48c39da5fc1eabf7593a1252928c70f5ae514a
SHA512 18f07a96cc2c3097e2e097342849486069bdcb7cb16677f8171512356ab83e614a6ef9012368dd35638e4ea71825ace441b98aab320d61bec87501371dfe5d4c
SSDEEP 192:sxRrRpbg/f6sNGwYCbQzoA8p4q/g6+WNIYEgR3vGAXIgDJJ:sxRrXg/f6sNGwPJ3/5IIBP
TLSH
T1EF32C6166928A93B5CCBE21DFA56BF53D7F8503360956E48BAFC861C04EB6DD220740F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 00134e63292763981a0933cb0f6bbe6d829d7fbcd290cc93456256676d723ef3
MD5 45445ef6ad1720d3fd7d3718bcec3511
SHA1 fbdf86b2376b7a054629a0f22d49c7946b0f8b9f
SHA512 805b44fbb6545c3648b71a90541a048c6ee78a60077d75620728ee3616a5cb26e8c1f5e2ad4a1df3a13d1965eab592474bc6951870519ab12b85d80ae8d96893
SSDEEP 384:40DxK6DJQD810DrfCtgQ6DRFfIQDFKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVt:40Dk6DJQD810DbWgQ6DjfIQDF8F1+Uos
TLSH
T1C8B2DB2F640DCB7F5F804A9DAC196FDB6D9802C796988D8047FE990C02C77EE92194DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0c259ee3-ec75-49af-a8ff-a5f337b654d2\index-dir\the-real-index
Size 816B
SHA256 369165516f29b1b4e627fc699e26e6d0dbd23bc3472b918397c47f6351cbe99e
MD5 3826c9c1b28c049c4126540621ef2195
SHA1 35665201bb67b8f80dd6384285458e142ef3f6be
SHA512 3df76d735f3a348065d8e4ca548f75a1317bc340bf76baf970d651d93894bd08944b7c13bca0167354d8f24ca942346b1157c59a493df971cd0e01b0d543c36b
TLSH
T1C601A2538CE6A84BCD17BDBA253E645A377A14FC1209CE87102D783C49569384610609
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5df2fe.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\0c259ee3-ec75-49af-a8ff-a5f337b654d2\index-dir\the-real-index~RFe5df2fe.TMP
Size 816B
SHA256 839b33b127a5c9f7ad934ef465069bbc93252b7fa3a23f399c4cc1c7450d38ad
MD5 d8ba618bf4e409e9a10c13f9f876f958
SHA1 5e04fb7e9b182469462f2a4af6f4e70741ad7a67
SHA512 09822ae3f32125ec17f9483f1a146490e6ca20f07ed20ce2c4b224073a3108b3bf1e0b4adda0be9aac45c9738ae778d21b29bf96c0b2baddce7590861688db91
TLSH
T1BF0120E740E1FC43DE27B1F9712F601AB37E8830212ACB4B71AE7C3D59666388B41A55
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 2587164a40dc54f4dfbc3e7930c9752a67623398a744b949bac9b4fa47171c93
MD5 e78473e642b972ffa45b59d5ef38762c
SHA1 95ff8367caacf17856a3620dc986c079bd0d4ba0
SHA512 1495d9623aa7c0984825132493742c2d9807f4c3ffc494edbce7495c8e292aafcd63b59e0ae0d9a3d12ef2e493c8d1d1fab117a55f3816e143308e81f202f98e
TLSH
T12FE0C0FB2CE71818EC7F83C32571C57201017828D108EC4F011692C340B5365AC9AC31
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 a83119d7e50692e1930df083ffbdff51909cfb1bc989cc826021eeca0a8147da
MD5 fb9b0b755b93d215c15157aa2d8d109c
SHA1 e11039f854fc9ed67724beafc2f75a3342efeb2b
SHA512 c73e7267a5e06a2966beda56d5b0f25ab2f8aced8aa14cded25db09d9625b494b5a3e88fabd31f128e7c224e2e06363a485d6995996cf3b72f7411be4188104b
SSDEEP 96:KRS3eyEkUyW8pBgiyK43gYyciKxQy7HlyLf1vz3W7gugn3K4Wg53cdF4LWO8K/6q:CS3eyEkUN8piiK3gY5iKxQy7HlyLf1vV
TLSH
T14F91821431FA4661383FAA0C8175AC6E9A82B472341CAC2F7FE815E10F67E025EFD5C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

8e9d7339-3e36-442d-86c0-503721a5c8f2.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\8e9d7339-3e36-442d-86c0-503721a5c8f2.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 40KB
SHA256 2761542b58b58010f23e6183f392e8e070efd8973dbe0df9294c93b8a31eaeea
MD5 d6742c8194bafa2ce1c607c144dd1d35
SHA1 85e7697ce8d268c212381da254de597dab95035f
SHA512 4db608f3a73a2ae39c4b2e78ad0c021764a3a31925546142577597431fdeb4e338469d028495d83103f92f32b02544d8b19d7a60d6090e0c660a1a1dde8b957d
SSDEEP 768:Crv+4UNbdG3rrcDTd+ZG2WIeX6+qTko0u229a4vsSZeVH1SdW:CbsbU3pmvVTVKa4vEH1h
TLSH
T10303BE32E8649A778DF69685B14B71472FB92263C7880B90D8DD6E4D024F0AC230F93B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 712bb666dc9a0a5c5838ae0fe7ff1f49244d14fa88ae09ece8314586235d2538
MD5 38072d9769f32605ade6e036f0337c20
SHA1 286e47ac6c1e8b1fd821ed7dca00ccac727263a0
SHA512 dcee7f388fe6ef6a645753dea9663a3b55ed6462385d012af793c350a26ec89e9bb707ce35ca083b236206e25794f176c0b2ab208dcd148b773a9bef4ae30db2
SSDEEP 768:hv3kHeDTd+ZG2WoeX6+qTko0u229a4vsTZftg2:hv3IIvVTVKa40ftg2
TLSH
T108F2BE31FC619CB748AAD784B20772476EB91173C7CC6E9499DDAB2C014F6AD170B82B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 37KB
SHA256 17761aef6ffa7113187e1e06a8d15cde8c87d9e469da95cdea56b18b605c8cb3
MD5 c61ed2e5df5ccda5fd13abbe08b304f6
SHA1 65b843387ca6a1370cb54d954ca7f35650a8214b
SHA512 750c2a68c3621135a7085ecc69c06652c656d750ac469b3442ce2cca0078bdf68b4f8f644c50dfd88b9746374f9b31001f655eadc3f7d456909050c6f138f005
SSDEEP 768:VFQf3hwguHeDTd+ZG2W2eX6+qTko0u229a4vsTZftg2:0f3GEvVTVKa40ftg2
TLSH
T16A03A032EC94D9774CBADB84B21B31479FB511B3C6C9AA549ADDAD1C015F1AC130BC2A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 41KB
SHA256 00093bb3610c6bcbf42325da7f2a044020428fd60074f570b177dfd2a1c2da79
MD5 7bc4c2562e1e1f57eabce11b4a08b124
SHA1 fd5c5e42c357a3c347364dd42a475c9937f6d90f
SHA512 cc0396cac6fcc2d7cc833d9fee4b76d7c8766dfcf7cc1d9cf25898d101e3cd7871104ec3f97a09be62ad182fd6ad7f89d4d64299ea955dac56b423285e21c030
SSDEEP 768:Rrv+4UNbdY39zeDTd+ZG2WoeX6+qTko0u229a4vsTZeVH1Sdq:Rbsbu3xIvVTVKa40EH1R
TLSH
T1AF13BE32F8649D778CE6D684B14B71476FB81263C6880B94D9DDAE4D064F5AC130F92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 0cb9939ae0b067d19bd68df2d3b0e0faff77d14b5e399c20aeb0dc5f0b66869f
MD5 e80629b60c4fff724ac31703398a8058
SHA1 d564f0a7d26f3dbb3b380d465b0be9a9ebad7a98
SHA512 f6aba9648a474c7b4fd1ec1556ecdd7fb38803853317f27efeda0c9bfa4ce09eae8301da6c63e087d2e6d9278d8be1a82a34d23cd7b92e88de8f3312fb76ccce
SSDEEP 768:prv+4UNbdG3DPwDTd+ZGyeX6+qTko0u229a4vsDceVH1SdW:pbsbU3R+vVTVKa45EH1h
TLSH
T1E503BF32E86989778CE6D784B14B75573EB92163C7880B90D8ED6F0D025B5AC270BD3B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ba80c0c9-70c2-4aee-a860-d31b94bdcdda.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ba80c0c9-70c2-4aee-a860-d31b94bdcdda.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download