354002c2ba6de58a0ca470edeab96ff951d3e2bf4c49cb460ca86c6e606193fc

Analysis

max time kernel
898s
max time network
865s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/08/2026, 20:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
a4xd9pdhvvg7.html
Size 5KB
Sample260822-zapseatxes
SHA256 354002c2ba6de58a0ca470edeab96ff951d3e2bf4c49cb460ca86c6e606193fc
MD5 6c04ae400d5c379c7af885097026e79f
SHA1 76c4a289acb53d08a20c6d82ae6b0284acaa927c
SHA512 66c31071704cd8fdfe9d84ade72c305cfe909533dccc65e344d85a6e7236c656cd26a0de601cf29f816a7441769df764d97915f55d20b7e11ac30d6983a4f9b1
SSDEEP 96:PNyrtoXZzIEb0EaW87d2lDFIMYQrnyd3rANvSDoBmYzueh86amw:PNCtkCBklDafQLwrANvRLy6w
TLSH
T1DAC14DF3AD35512793A11BE5507F735CD721B16CAB01D259A9E0D73CA6ECF0E81062D0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2440	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134319042854891953"	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2115213192-531537726-3295841909-1000\{1EFD1959-5C8E-400E-8ABA-96F9FECD259E}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2115213192-531537726-3295841909-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2156	msedge.exe
2156	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe
1088	msedge.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 1088 wrote to memory of 4524	1088	msedge.exe	89
PID 1088 wrote to memory of 4616	1088	msedge.exe	90
PID 1088 wrote to memory of 2440	1088	msedge.exe	91
PID 1088 wrote to memory of 4616	1088	msedge.exe	90
PID 1088 wrote to memory of 4616	1088	msedge.exe	90
PID 1088 wrote to memory of 1940	1088	msedge.exe	92
PID 1088 wrote to memory of 1940	1088	msedge.exe	92
PID 1088 wrote to memory of 2940	1088	msedge.exe	94
PID 1088 wrote to memory of 2940	1088	msedge.exe	94
PID 1088 wrote to memory of 2940	1088	msedge.exe	94
PID 1088 wrote to memory of 4100	1088	msedge.exe	95
PID 1088 wrote to memory of 4100	1088	msedge.exe	95
PID 1088 wrote to memory of 4100	1088	msedge.exe	95
PID 1088 wrote to memory of 756	1088	msedge.exe	96
PID 1088 wrote to memory of 2748	1088	msedge.exe	97
PID 1088 wrote to memory of 756	1088	msedge.exe	96
PID 1088 wrote to memory of 756	1088	msedge.exe	96
PID 1088 wrote to memory of 2748	1088	msedge.exe	97
PID 1088 wrote to memory of 2748	1088	msedge.exe	97
PID 1088 wrote to memory of 2988	1088	msedge.exe	99
PID 1088 wrote to memory of 3808	1088	msedge.exe	100
PID 1088 wrote to memory of 2988	1088	msedge.exe	99
PID 1088 wrote to memory of 3808	1088	msedge.exe	100
PID 1088 wrote to memory of 3360	1088	msedge.exe	102
PID 1088 wrote to memory of 3204	1088	msedge.exe	106
PID 1088 wrote to memory of 3128	1088	msedge.exe	107
PID 1088 wrote to memory of 296	1088	msedge.exe	108
PID 1088 wrote to memory of 1572	1088	msedge.exe	109
PID 1088 wrote to memory of 1572	1088	msedge.exe	109
PID 1088 wrote to memory of 2156	1088	msedge.exe	111
PID 1088 wrote to memory of 5536	1088	msedge.exe	112
PID 1088 wrote to memory of 5536	1088	msedge.exe	112
PID 1088 wrote to memory of 4188	1088	msedge.exe	113
PID 1088 wrote to memory of 4188	1088	msedge.exe	113
PID 1088 wrote to memory of 4316	1088	msedge.exe	114
PID 1088 wrote to memory of 4316	1088	msedge.exe	114
PID 1088 wrote to memory of 5648	1088	msedge.exe	115
PID 1088 wrote to memory of 5648	1088	msedge.exe	115
PID 1088 wrote to memory of 4796	1088	msedge.exe	117
PID 1088 wrote to memory of 4796	1088	msedge.exe	117

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\a4xd9pdhvvg7.html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1088
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffcfe5cc188,0x7ffcfe5cc194,0x7ffcfe5cc1a0
  2⤵
  PID:4524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1592,i,9926035799773654238,8534883832421397652,262144 --field-trial-handle=2116,i,16390195567880153953,5774761834413428429,262144 --variations-seed-version --mojo-platform-channel-handle=2112 /prefetch:2
  2⤵
  PID:4616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1944,i,1728607799350378997,1083454604073366713,524288 --field-trial-handle=2116,i,16390195567880153953,5774761834413428429,262144 --variations-seed-version --mojo-platform-channel-handle=2252 /prefetch:11
  2⤵
  - System Time Discovery
  PID:2440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2604,i,16445328458062749831,2937004142009703202,524288 --field-trial-handle=2116,i,16390195567880153953,5774761834413428429,262144 --variations-seed-version --mojo-platform-channel-handle=2652 /prefetch:13
  2⤵
  PID:1940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3580,i,17785095948751940464,12351117405412666067,2097152 --field-trial-handle=2116,i,16390195567880153953,5774761834413428429,262144 --variations-seed-version --mojo-platform-channel-handle=3624 /prefetch:1
  2⤵
  PID:2940
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3584,i,16345807519813150989,17167928906099112135,2097152 --field-trial-handle=2116,i,16390195567880153953,5774761834413428429,262144 --variations-seed-version --mojo-platform-channel-handle=3628 /prefetch:1
  2⤵
  PID:4100
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4400,i,6178450497490646579,5867032172212218585,2097152 --field-trial-handle=2116,i,16390195567880153953,5774761834413428429,262144 --variations-seed-version --mojo-platform-channel-handle=4468 /prefetch:9
  2⤵
  PID:756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4388,i,15818003992449654340,18031750373316498345,2097152 --field-trial-handle=2116,i,16390195567880153953,5774761834413428429,262144 --variations-seed-version --mojo-platform-channel-handle=4740 /prefetch:1
  2⤵
  PID:2748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3740,i,17075060553660674765,9074882650477041480,524288 --field-trial-handle=2116,i,16390195567880153953,5774761834413428429,262144 --variations-seed-version --mojo-platform-channel-handle=5396 /prefetch:14
  2⤵
  PID:2988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3752,i,17233024027117820578,17773649456106932577,524288 --field-trial-handle=2116,i,16390195567880153953,5774761834413428429,262144 --variations-seed-version --mojo-platform-channel-handle=5424 /prefetch:14
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,885782646903566672,5344236753060070152,524288 --field-trial-handle=2116,i,16390195567880153953,5774761834413428429,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:14
  2⤵
  PID:3208
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6076,i,885782646903566672,5344236753060070152,524288 --field-trial-handle=2116,i,16390195567880153953,5774761834413428429,262144 --variations-seed-version --mojo-platform-channel-handle=6124 /prefetch:14
  2⤵
  PID:3360
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4384,i,18001823339184565770,3935978292841300487,524288 --field-trial-handle=2116,i,16390195567880153953,5774761834413428429,262144 --variations-seed-version --mojo-platform-channel-handle=5056 /prefetch:14
  2⤵
  PID:3204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,9611199157304609948,777379770447058372,524288 --field-trial-handle=2116,i,16390195567880153953,5774761834413428429,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:14
  2⤵
  PID:3128
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5052,i,4898117322468769234,2417193761390320500,524288 --field-trial-handle=2116,i,16390195567880153953,5774761834413428429,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:14
  2⤵
  PID:296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5444,i,7499197544668832382,5025639831652026390,524288 --field-trial-handle=2116,i,16390195567880153953,5774761834413428429,262144 --variations-seed-version --mojo-platform-channel-handle=4628 /prefetch:14
  2⤵
  PID:1572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6468,i,8463654399296925952,3336243240932406105,262144 --field-trial-handle=2116,i,16390195567880153953,5774761834413428429,262144 --variations-seed-version --mojo-platform-channel-handle=5672 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2156
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4084,i,17147425221792009099,16133044826090082988,524288 --field-trial-handle=2116,i,16390195567880153953,5774761834413428429,262144 --variations-seed-version --mojo-platform-channel-handle=4100 /prefetch:14
  2⤵
  PID:5536
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3380,i,12163611116761727431,4505416856413675789,524288 --field-trial-handle=2116,i,16390195567880153953,5774761834413428429,262144 --variations-seed-version --mojo-platform-channel-handle=4068 /prefetch:14
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6620,i,16428306748723676379,10016032071221380763,524288 --field-trial-handle=2116,i,16390195567880153953,5774761834413428429,262144 --variations-seed-version --mojo-platform-channel-handle=1088 /prefetch:14
  2⤵
  PID:4316
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3788,i,12868778568684415010,6108233835754886766,524288 --field-trial-handle=2116,i,16390195567880153953,5774761834413428429,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:14
  2⤵
  PID:5648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2492,i,15499080578376975271,13813841487816495798,524288 --field-trial-handle=2116,i,16390195567880153953,5774761834413428429,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:14
  2⤵
  PID:4796

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4580

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:5300

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k GPSvcGroup
1⤵
PID:3404

C:\Windows\System32\SecurityHealthHost.exe
\\?\C:\Windows\System32\SecurityHealthHost.exe {08728914-3F57-4D52-9E31-49DAECA5A80A} -Embedding
1⤵
PID:1880

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 c80f71026fa07cc9b3e69c8779d4b4b40710cf7bc2893b740943db0d0f79591a
MD5 590eca05f11ec72644a09f205b548fbc
SHA1 c6521700bee3b500259ee3a70292b90201f20597
SHA512 fddd457c35c61ceb727f99bd39f55314cdeb7d062798c573a377675121f972ed95109fec329f911c502139a1794b70e5a98a57dd3b21b5a70e6518890a361f66
TLSH
T1E7D02B7A37C40404C0D0747221F24602D530C520AC4C81088801702CCC207C3010B8EF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ee00825bbd5a4f21308ad2e10e5a9d3c4512f07fbd288ec8ac76788de6019e25
MD5 c3584e6bc22b3ad2f168ede48d20a993
SHA1 ffb4ecef8f65638ca17e16a32806195193977c7e
SHA512 5fd777359305e67e9f30fc404af9013a876846b1d6db271fa73dfcf2ee22fb25a8e26d4d0c970cc3a8219df11038dc6b4c2c411db652593bda1c3d7643753c0b
TLSH
T18AD02B7637C40404C0D0747621F34602D530C520584C81088801B03CCC207C3010A8DB
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 603689033bbbb1abe4cb46c8c1ff0763db43f7fe07555d16ee6236219f74842c
MD5 1dc374b4f77f9b3aa037531903cddf1b
SHA1 6971cc26c45185d85434b1b0fa777850ffc6b6d2
SHA512 c64a51437f17736c9720642e3ac2f87132df815f7e14443e3bd97ac08fc71d62c97207f5e9912f9aabf3631e02659f3cc1c9fdc83bde0aff95c4fc7a2c5ce42e
TLSH
T12BE07D9404C8C36EE61174C75378530CC2D0360FE2D8E97A370084847785840F6E66B4
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 4ceeebdb6aa094264810e3937725a7ab410f5c28c2b24fd20c9dba2bc66ed003
MD5 4a150492bd3e1f26b1681f31ff65a32f
SHA1 cc7ec4a0f103b263158ee73fb381784bbce11589
SHA512 4cd23b42b53c739c8d30c9b9883a7963a800d148d6410b00d14a60eacf4c571971860331501478b3a47b1ec4e97d2716b7d8b955b8100b14fcaf37b5d62f3150
TLSH
T128E026C404E8C32EF68177C75378430C82C0361EA2CCEA3A2B0488847346480F6F67B0
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 fb08a4d3e62141c5ff9d40fc64398183b435cd5c6b54793c717d6962c9e3651d
MD5 be3ba45885fc915a7989e6310bd5f3e2
SHA1 b0dda7f45265d83e0daaedcfb87c2ab7ade71550
SHA512 69480d8abf3f229283aa7bbbef557df1e69883659f4461cfe9fbf105bdec4b2ab97eabc2d2a182db5815ff0e52579e3617a8eda31a27f020e171fbc8533f80f2
TLSH
T1EDE0268444DCC36EF702B48B636C4B8CC2D0360FE3C8E9AA27008888B745854F2A66F1
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 2a0bf29cbe7180810928b6d7fa2b8a5d3b35751d228a5b4fc473a8b2ec43b028
MD5 a1d8c783075984f5caba27d8e68e050b
SHA1 1a4240b676da2750be7afeec70649dc8f56094a5
SHA512 ecc1b7a8285138bb76b01f63521fc026736fa501001c8499e15faf22971e3effce52063c999f1b5a1c876086253c0d8684654100685548f4fa2e944d59959099
TLSH
T149417738C32B28DACB6A3971FAD16199B2F1447855035A203C526E764EA6FC430ECC0B
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe59babb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe59babb.TMP
Size 2KB
SHA256 46cb9a63ab526c0ef57e34e2a94e052485dfff070fbeca00a3a56e9ae49b2ec9
MD5 a9b9a6da0c0cc49a225cc921282f953c
SHA1 b28a4e22b87bf9607f45c16f1d8f6a571c8b7f13
SHA512 bcbcdc94f138e177d12dac10408e094194a132847b7a6dfb5224601a6141ee764ab4e737a0d1dcab711535c33b2f9beb30df17add408fd2df08f660703e26835
TLSH
T125415738C72B28DACB6A7972FAD15199B3F1447855436A203C526E764EA6FC430ECC1B
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 96289192ad9e59d5c62b44c5f98d8a40345bf4cbacd4618259aa08044aec6acb
MD5 20dcf74a826aacc0ccd00ad4b0cde3aa
SHA1 1b4d6cf46831c4ae7b1cbdf3ada49c54d65ca9b9
SHA512 76f23d31bb42206041e075f9781e7a2dc23e61456a4f141fe9e36696b1a8a9283126353b37dbf5c7aa78259ab35c56ce78c18e740e6b21cfdabc872c5a67d187
TLSH
T19B31C0F783B4957E9A1196F0FB046E1FCE6C0411432C78AA85E06D2793F3461E041A9F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 0923448526d259ca69dafc4a749136395fb28164f531bb37c541be3d85b785cb
MD5 852d48949c36163a62c56703892bbbdd
SHA1 c5c77bff7e4e0f75c8dd4bff2098bf34a97430d4
SHA512 81c87fad5373f2f4278073a0c6af344a87c61f818eaed2367d80eb23e7833aac75facbc2e5e742de306686dbc3f4a92b0fe77d3e60a3a2b6af26a362248d768b
TLSH
T1A531E0F383B4857E8A1196F0EA046E1FCE1D0411436C78AAC5E0AE2793F3471E041A9F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 2891283b3833bb30f1bc8735d86b12e2b7f2676cec4a7e24d66f412a63939180
MD5 9bd5d4ee1865e1e55d6e250de237f49e
SHA1 5b38e44bf7e9fd806fdf1d4b1150110bf8fe6374
SHA512 b7b975b6858478bd0df6f0a525886ae987188dbdafbc7fdb81b136ef661530d1720a136d0069c5b4bb136d0d4020cf869b95d1b88c21b5786b22ccaf02eb9ffb
SSDEEP 192:sxRcRsbt/fxsSah3At6zoA8p47/g6+WNIYZFLm8DGWIgDoJ:sxRcEt/fxsSahEu/5IShQ
TLSH
T19142D8166928A97B4CC7E21DBB55BF53E7F95032A1902E08FAFC971C14E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 90e9f3a225a1cb8469ca179228456f919cd47c6f892e6ca4b7f3d6101245c5fd
MD5 cc3b0dfe13f9251b53c23ede790a7679
SHA1 bfb0df665837f8e72e306c192e51913294d77cb6
SHA512 bbe59d0e02cee0837e1c01220e3f8bd6a307294477841841588e2d5b35a7602604233f32007ab97dc7c7cff33d4c67bb985b221d2aad535adfb2f45daafb4659
SSDEEP 192:sxRcRsbt/fxsS0h3At6zoA8p47/g6+WNIYZFLKaDGWIgDyJ:sxRcEt/fxsS0hEu/5ISVi
TLSH
T14532C6166928A97B4CC7E21DBB55BF53D7F95032A1902E08FAFC961C04EB6DD221780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 0d26cc78182b34ad25ed236a730257c830d92d39bf6259acdbd9c069a493590e
MD5 4716ed5b8b2b209ee7a63b1fe3daddff
SHA1 bb386ae8fbcc905e22909643fe8fd430f01c227f
SHA512 deea6a5374e3d2c800e36be80e76d061b00fc9236c4ab151acd4f6d2323a114d4e29e9d22f31b845db0b10fb7e068e38324082f05dbfdf8d75ebd6c6d1783f44
SSDEEP 192:sxRbRsbt/fxsw0h3At6zoA8p47/g6+WNIYZFLKaDGWIgIJ:sxRbEt/fxsw0hEu/5ISVs
TLSH
T12332C7166928A97B4CC7E21DBB65BF53D7F95032A1D42E08FAFC961C04E76DD220780B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 cb52a27c6574a8e80d47e875de5d064f7a41b8a4fb82f5d58be44819fa0eede2
MD5 77884225ea1a645593fa0c126c343361
SHA1 8839f6abe14bd55255564fb370e8483c304c7fa3
SHA512 3b0519dd78b4286782f8b594c991cbf6e6e12832359cfb228f96b20db4791e9690c4d7a13cc7b346b17c1e2921c1c0239027bc37fc8490f10414fc80e3baba0b
SSDEEP 384:KAX0EdqfCtgNbFfVNKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVui9LZRGErocmy:K80EdwWgNhfVN8F1+UoAYDCx9Tuqh0V4
TLSH
T137B2CA3B640DCB7E5F800AADAC196FD77DA802C796988D4047FE994C02C77EA911A4DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\db2984d9-f335-4172-b4eb-94bd2b391b98\index-dir\the-real-index
Size 72B
SHA256 34d9974252bbc7e0dcf32c43afed111e7bab4473cf524db1b27c79da83a4c0b5
MD5 c90ae4e9768c229a49a230d4a84955c8
SHA1 459a8a51a9617c8abbc9f60efd43c1d72b16ca30
SHA512 ca64318171e3c8e53d25ef44757d9d4940f488108828f5d9236e78d73e5574b492e74900a5fc4e30d9330705bf428fb24db91f9f8042e8bf3673489a2454cd61
TLSH
T18CA0027156D4089AEC05117816A3B75C561388580C54870390DC14598893444E199005
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5dfbd7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\db2984d9-f335-4172-b4eb-94bd2b391b98\index-dir\the-real-index~RFe5dfbd7.TMP
Size 72B
SHA256 7ef73c70d84b7f0ff1cca938b132047d19ef46601d2c701681f51a5febb09f2c
MD5 13aae723995d732ec85502cfb27d9fd3
SHA1 1485e1a90133ef6faca263b8faa869934fae8858
SHA512 2cd75208a312916f7e6c97308794c2f9ad221d3170ec078a27446968ab221bc908f6151848a01403e2e523151069c114aaa622e84bbe2f09544aa2420e3ff9bd
TLSH
T1E2A0023543D00C91DC1152B06413975C5A92CC140010C70BB4D450598D93440759900D
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 370B
SHA256 cfe2a05e0f8da09dcd399215392293eae390a8ec69d39f3eaf0fc572254a0c21
MD5 7224d70f9cc438dba8863094932ab5b7
SHA1 8ee9d6eed6dacd1f53be72e4abc396764c90ff1d
SHA512 d51631e5101d3de3dc194e1e99df3c34d022ec66acd604c1cacd749b69f5a3d7594566be4532dc853ab907a164cf91a6bd3a9cd22cb4a4263103f1ce156415d6
TLSH
T122E068F76DA72820EC6BE7D724B114A44500B458C985EC8F201AE683D0B13A424AAD62
MD5 SHA1 SHA512 TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a5833.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a5833.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 773acb3efb55df98fba4c95b4bc7ed60ccf6a4e26f075ca789578465aa629d5b
MD5 a21d81da510a6c4eb6323fdfa4accb05
SHA1 48db2079f344d87cd444dd129e798bfd4541d395
SHA512 0bf5133617f4eed63aadacaccc2e87bf1fa5689f1cfc6731f7fd9e9a303650f00d74139ede09adb84e5bc8ddeac6af02de05aee1c472e3707dac6c8f637de419
SSDEEP 768:Srv+4UNbdk3FH+LeSFOUkCrt0X4fouOToPvB2thtA9VAgBF:Sbsbm3fsnnwthtt4F
TLSH
T1EC03CE32B4AC9963DDE5D388710A72832FF0801396C41F94AEDE2B5D068B9EE570FD16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 39KB
SHA256 e755d84e16acdf680cee9ef134685c8fbed7dd6946151ecff8ca1884748d6ade
MD5 647820ed48b5f2d51ae77a10c4e7e44e
SHA1 70ff081bfe0f218797df1ee0df063837ca3a9ee0
SHA512 363ef459437aeb9b4873bc290d438c1c5bbbfd1cf65ee14bba4e8967a4dd681a409afdbfca435dd438ec4b56121a862c8ccd5cfb2756770eb5ce6f39a342440b
SSDEEP 768:srv+4UNbdH3Px+LeSFOUkCrtMX4fouOToPvB2thtA9VABBeVH1SlX:sbsbh31snnwthttfEH1Y
TLSH
T16A03BE32A4A89933EDE6D398310B72432FF4911396840FC49EDD2B5D069B9DE470FD66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 7c140c0770333a00acd94b33ac0afe6cfce87bbb0e68f653feff172cabd6c4d3
MD5 1e15630fc8f6988398e86b70bd877a04
SHA1 98575be97f5404401f23779d09bbb4ca5375cb8d
SHA512 88eeb85ef025df473978afed9b5b1408a778cf9c892c375efa80613f5335e97be878ff0e85c627435cdd8c46e6ae3678776d1ef8cae1c9202bb57b4be0ce7e58
SSDEEP 768:2j3rH+LeSFOUkCrtmX4fouOToPvB2thtA9VAgBf7tN:2j3hsnnwthtt4f7tN
TLSH
T16DF2B072A8A99D639CE9D3D8730A72835FF0801395C46F845EDD6B2D059BADF070BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 50f183bb7766201736f0d14c84ea83d6eeaed0a1280fff8852446939ae6e04dd
MD5 4d364334596992d4fc62ffdb3f12c649
SHA1 a429884f824c210aa7549d9a96e8033effd1a5d5
SHA512 99495a3f7e9995aeabbab39f3798519a5fd4478cc0c051ed8b5bb4efc013178dc17c0ffd36691b61388b67b23dab3d303036e9aaa3c4b8da1764c0840dc79789
SSDEEP 768:1j3CH+LeSFOUkCrtmX4fouOToPvB2thtA9VAgBf7tN:1j38snnwthtt4f7tN
TLSH
T1ECF2B072A8A99D639CE9D3D8730A72835FF0801395C46F845EDD6B2D059BADE070BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 acbc9517b8020c6fa387eabb5dbec1cd721e7e55a10c2c525995c31b9429b756
MD5 e22888f3ed4d9d89200c09febe81bbec
SHA1 9114e370f27b545c8d7234e16b997a060f00d55c
SHA512 7047cf0924c6dba1802e44163a0a69e967be89213d5dc6446efedd873cef880a32ff95913ddaa131219219560a4705ad834b3bee0d1f1c1e9a6221a65a3354a2
SSDEEP 768:XFQ43iwgjH+LeSFOUkCrtaX4fouOToPvB2thtA9VAgBf7tN:q43Ssnnwthtt4f7tN
TLSH
T113F2AE739898C977EDE9D7D8B30A72425FF0806385C4AB90ABDD6B2D015B5DE070BC25
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 9b04cdede80e0a95f831b34395bf6099f89c52ae76b29a0c002ad85f16e952d4
MD5 5864e1bac008bf2c44b0e051d2318b1a
SHA1 911f0684ef274432dc30861c334f90049c462dd4
SHA512 205884bb8c1fcf6bba9315442525c202935b05910607cbeae5724278344344f4d9cd09417498f6e7bedc74ce5c5f19d53609485af84fea5a4f55c0aca4f37520
SSDEEP 768:grv+4UNbdH31C+LeSFOUk/X4fouOToPvB2thtA9VAwXeVH1SlX:gbsbh3Msnnwthtt6EH1Y
TLSH
T1F703CF32A8AC8933DDE6D388710B71532FF4916396900FC49ADD2B4D069B9DE470BC66
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ff6bcaca-df17-4ece-abc5-5cfcb55a3957.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\ff6bcaca-df17-4ece-abc5-5cfcb55a3957.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download