hxxps://github[.]com/gitsquared/edex-ui

Analysis

max time kernel
899s
max time network
731s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/08/2026, 21:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/gitsquared/edex-ui
Sample260823-1d3dcabd33

Score

6^/10

discovery

Malware Config

Signatures

Contacts third-party web service commonly abused for C2 1 TTPs 12 IoCs

Legitimate web (hosting) services can be abused by malware authors to host malware or C2s.

Web Service

T1102

flow	ioc
46	camo.githubusercontent.com
53	raw.githubusercontent.com
54	raw.githubusercontent.com
42	camo.githubusercontent.com
44	camo.githubusercontent.com
47	camo.githubusercontent.com
48	camo.githubusercontent.com
49	camo.githubusercontent.com
61	camo.githubusercontent.com
62	raw.githubusercontent.com
43	camo.githubusercontent.com
45	camo.githubusercontent.com

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4792	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134319944368117756"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-876885714-46325919-1482798410-1000\{1EBE8D51-30C9-4134-AA04-67D7B7476621}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-876885714-46325919-1482798410-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4024	msedge.exe
4024	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe
1996	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 5116	1996	msedge.exe	86
PID 1996 wrote to memory of 4792	1996	msedge.exe	87
PID 1996 wrote to memory of 924	1996	msedge.exe	88
PID 1996 wrote to memory of 924	1996	msedge.exe	88
PID 1996 wrote to memory of 924	1996	msedge.exe	88
PID 1996 wrote to memory of 1844	1996	msedge.exe	89
PID 1996 wrote to memory of 1844	1996	msedge.exe	89
PID 1996 wrote to memory of 368	1996	msedge.exe	91
PID 1996 wrote to memory of 368	1996	msedge.exe	91
PID 1996 wrote to memory of 368	1996	msedge.exe	91
PID 1996 wrote to memory of 2928	1996	msedge.exe	92
PID 1996 wrote to memory of 2928	1996	msedge.exe	92
PID 1996 wrote to memory of 2928	1996	msedge.exe	92
PID 1996 wrote to memory of 3740	1996	msedge.exe	93
PID 1996 wrote to memory of 3740	1996	msedge.exe	93
PID 1996 wrote to memory of 3740	1996	msedge.exe	93
PID 1996 wrote to memory of 2632	1996	msedge.exe	94
PID 1996 wrote to memory of 2632	1996	msedge.exe	94
PID 1996 wrote to memory of 2632	1996	msedge.exe	94
PID 1996 wrote to memory of 3612	1996	msedge.exe	98
PID 1996 wrote to memory of 3172	1996	msedge.exe	99
PID 1996 wrote to memory of 3612	1996	msedge.exe	98
PID 1996 wrote to memory of 3172	1996	msedge.exe	99
PID 1996 wrote to memory of 2356	1996	msedge.exe	103
PID 1996 wrote to memory of 2504	1996	msedge.exe	110
PID 1996 wrote to memory of 2404	1996	msedge.exe	111
PID 1996 wrote to memory of 2040	1996	msedge.exe	112
PID 1996 wrote to memory of 3840	1996	msedge.exe	114
PID 1996 wrote to memory of 3840	1996	msedge.exe	114
PID 1996 wrote to memory of 4024	1996	msedge.exe	115
PID 1996 wrote to memory of 2380	1996	msedge.exe	116
PID 1996 wrote to memory of 2380	1996	msedge.exe	116
PID 1996 wrote to memory of 4816	1996	msedge.exe	117
PID 1996 wrote to memory of 4816	1996	msedge.exe	117
PID 1996 wrote to memory of 5064	1996	msedge.exe	118
PID 1996 wrote to memory of 5064	1996	msedge.exe	118
PID 1996 wrote to memory of 2848	1996	msedge.exe	119
PID 1996 wrote to memory of 2848	1996	msedge.exe	119
PID 1996 wrote to memory of 4660	1996	msedge.exe	120
PID 1996 wrote to memory of 4660	1996	msedge.exe	120
PID 1996 wrote to memory of 4380	1996	msedge.exe	121
PID 1996 wrote to memory of 4380	1996	msedge.exe	121

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/gitsquared/edex-ui
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x294,0x7ffb6119c188,0x7ffb6119c194,0x7ffb6119c1a0
  2⤵
  PID:5116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1756,i,2889072866792983404,17589721036697341864,524288 --field-trial-handle=2272,i,7963206647448204441,14724451479191941295,262144 --variations-seed-version --mojo-platform-channel-handle=2308 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1628,i,18258644124265826039,12420294122400469750,262144 --field-trial-handle=2272,i,7963206647448204441,14724451479191941295,262144 --variations-seed-version --mojo-platform-channel-handle=2268 /prefetch:2
  2⤵
  PID:924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2632,i,6840615951390841957,8384592382427221338,524288 --field-trial-handle=2272,i,7963206647448204441,14724451479191941295,262144 --variations-seed-version --mojo-platform-channel-handle=2624 /prefetch:8
  2⤵
  PID:1844
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3432,i,10072130884143625551,2531019234536419839,2097152 --field-trial-handle=2272,i,7963206647448204441,14724451479191941295,262144 --variations-seed-version --mojo-platform-channel-handle=3448 /prefetch:1
  2⤵
  PID:368
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,3095883485919136513,4692479006040238466,2097152 --field-trial-handle=2272,i,7963206647448204441,14724451479191941295,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:2928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4156,i,10846603570748309828,14673905910935460960,2097152 --field-trial-handle=2272,i,7963206647448204441,14724451479191941295,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:1
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4244,i,5054242186944326438,10649297264120359464,2097152 --field-trial-handle=2272,i,7963206647448204441,14724451479191941295,262144 --variations-seed-version --mojo-platform-channel-handle=4356 /prefetch:2
  2⤵
  PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,2518871612134891556,4815269331547262404,524288 --field-trial-handle=2272,i,7963206647448204441,14724451479191941295,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:3612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3484,i,3834024258682966976,17955803311590758413,524288 --field-trial-handle=2272,i,7963206647448204441,14724451479191941295,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:3172
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5808,i,18259270799664673171,10128559758546101495,524288 --field-trial-handle=2272,i,7963206647448204441,14724451479191941295,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5808,i,18259270799664673171,10128559758546101495,524288 --field-trial-handle=2272,i,7963206647448204441,14724451479191941295,262144 --variations-seed-version --mojo-platform-channel-handle=5924 /prefetch:8
  2⤵
  PID:2356
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=560,i,11515332547521531722,6592101908431477172,524288 --field-trial-handle=2272,i,7963206647448204441,14724451479191941295,262144 --variations-seed-version --mojo-platform-channel-handle=4496 /prefetch:8
  2⤵
  PID:2504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4524,i,5143020506740561799,7599901832590744560,524288 --field-trial-handle=2272,i,7963206647448204441,14724451479191941295,262144 --variations-seed-version --mojo-platform-channel-handle=4552 /prefetch:8
  2⤵
  PID:2404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4536,i,7923220634717281888,17780961879432112208,524288 --field-trial-handle=2272,i,7963206647448204441,14724451479191941295,262144 --variations-seed-version --mojo-platform-channel-handle=4516 /prefetch:8
  2⤵
  PID:2040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5972,i,5576510131690203766,6423524813530635911,524288 --field-trial-handle=2272,i,7963206647448204441,14724451479191941295,262144 --variations-seed-version --mojo-platform-channel-handle=3056 /prefetch:8
  2⤵
  PID:3840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=760,i,12354078195948255086,17354956722551789011,262144 --field-trial-handle=2272,i,7963206647448204441,14724451479191941295,262144 --variations-seed-version --mojo-platform-channel-handle=6076 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4024
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5208,i,14741161569990592419,1295089305230784852,524288 --field-trial-handle=2272,i,7963206647448204441,14724451479191941295,262144 --variations-seed-version --mojo-platform-channel-handle=6008 /prefetch:8
  2⤵
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3380,i,9296369496546248747,13133552768080165044,524288 --field-trial-handle=2272,i,7963206647448204441,14724451479191941295,262144 --variations-seed-version --mojo-platform-channel-handle=5320 /prefetch:8
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=760,i,5923134212203547465,2025824098493044222,524288 --field-trial-handle=2272,i,7963206647448204441,14724451479191941295,262144 --variations-seed-version --mojo-platform-channel-handle=4392 /prefetch:8
  2⤵
  PID:5064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3372,i,4987721122792206565,2556548646748504113,524288 --field-trial-handle=2272,i,7963206647448204441,14724451479191941295,262144 --variations-seed-version --mojo-platform-channel-handle=1992 /prefetch:8
  2⤵
  PID:2848
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1620,i,4674132046542521378,8187879930786379812,524288 --field-trial-handle=2272,i,7963206647448204441,14724451479191941295,262144 --variations-seed-version --mojo-platform-channel-handle=5488 /prefetch:8
  2⤵
  PID:4660
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3380,i,14663526821386222218,8151154922526738500,524288 --field-trial-handle=2272,i,7963206647448204441,14724451479191941295,262144 --variations-seed-version --mojo-platform-channel-handle=6064 /prefetch:8
  2⤵
  PID:4380

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:5032

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

31aad10c-fc5d-49d5-9c72-3f02239d9afb.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\31aad10c-fc5d-49d5-9c72-3f02239d9afb.tmp
Size 18KB
SHA256 3b3fe69b794c87ad13033a98342f4e48571177dc877e07e7b0abb321ea5519c4
MD5 ac4d4dc898a0a99b0a4efc571ffc8ef8
SHA1 8eaabe63771d2beb5a0e84861d2d0a8bb582a1c4
SHA512 47dbfb3d07cd83b1a54c736f8249dd3e633a1d064f38496a395d5bdd57ea3f7d22332f757c2a5fe891ef9dd76f96af272b2f5e19221cf14c7660470b7cc7b675
SSDEEP 384:N3yFaeO8WsNxexVqLOI4f+j8IMX/+24F1iT9YA44GKf:N3IzhWpqJgj/lm1iRYA44Gu
TLSH
T130827D32A8745C778DA2B281F1473253AFB4445FDAD66F90DAEDAF2D04CA59D130BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 707c0a63a018be182dd327d61f24ae614d8bf02ffda39fdb66cfe859df8e6d90
MD5 2c06dd9a8eeb3e210783d42396870f59
SHA1 ce3b609af27d6c15d832d559b6c1f61710ec43dd
SHA512 9d0211e9b2e3b08c98a2e522305d7c597845ab72a08bf4e84d98dabce6778c27176a8a6048e98c7d318423219947cbcc6a95ea0cc735fb94e03d9ba054a7a5a7
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P72:fwUQC5VwBIiElEd2K57P72
TLSH
T159B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6de34b260036ecaa4ce5839bc4a7ff7495e50b7b94349b12d9f840ca0e76da3b
MD5 56d82099872fb501c566d072ae897035
SHA1 2c96501551fc13c09496780960d8e7ccb4957b77
SHA512 c4b4017256caf25e88f146e6104134cddfd15089203e8e74c5196627fc92897f9fe7e3fc5c8305032be88e9409cdbc5dfe1e81017fcd5e38b3579b3d823b4a41
TLSH
T160D0C073378C7C00EA090170D013C3031FA7855824C39F03B100C01C54B43D9738B093
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f5dece638cd89af82b06bd2fcb3d1738eef64d2275be237184ea8bff7af3fdfa
MD5 f19ec2293392af872f10929c41627e26
SHA1 0576f5277c470f5bb8c3f4d3786ca8d967d0a33e
SHA512 4cc85dc71d34bb516f8fe45b565a6a9b4cda255a931f33289247ed84150baf0e2df40fc87109df41771553b92545ed858197cdd3d673694c83458cf9812aa9dd
TLSH
T16CD02272268C6C00EA090170D01383021EA6855824839B03A100C01C44A52D9728A093
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 fde8997bae41d62017648f10a4a9e90be849bfbcd60d8c7854c3ec5bfb918546
MD5 765731cbd20aa44f8e0e7de3b3705c46
SHA1 7f23bd77ea41514652a044167c918af54e36a517
SHA512 21f9c12c184fc65a0c513f3770367308a90f94930f74c69eb5ec2ea4185e9dc9e7e023f875b51e9bae32183f8f0a275f3b3e1e58acee3b22db98b1e938388c01
TLSH
T196E0264D13C4C2AA6E899B47E8DF7358C0E0700AFA8DD97A3B1EA4CF74A00844249DCC
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 f049d98c9a29029c9b9ef6d07c9acd11307f3b1449cf667a6c323d637052289f
MD5 5e8619787462df3f87b20b47be53b63a
SHA1 1a1ab124c987bda9826efbf070c4c5862c426bee
SHA512 7bd38b302cef6ca6a37dac5b2f271e1ef0f8a2bfe05cfea19f930f875e0966c06323fdb82135fdecc4602d10efedadc517702ea401836954f40f9f591c8a1314
TLSH
T1FEE0268425CCC23E9A89B5CF926C630CC280360FE7D8E95E6B2984C6B0024D0E386D90
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 3162af488c283bbdb6565f4200727821b4e60ce0c47948b8d5b3655271a2625a
MD5 7b9f1e9c5ca7be7a0fd051116a616b72
SHA1 8a88b30a2e0c8a2c94e5512f0a5bb56573a6d8b9
SHA512 2c13705b178f640305a8b7685e6b6a7e49374c53b0713e7e54da2205c3c290a3f79ad3280c111728c5383ffc23941c73a23b34049e67b876aa1915e6e2992364
TLSH
T183C08058798C845DC280187FA726F400177155115817962705A1FCD031406A01F2D124
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 5KB
SHA256 72d5661ea12e858cfc739e431d7c7e4a3295768b8c634d605ca6fbbd8650243c
MD5 7d09216330aed10eb53360eb3d71db79
SHA1 0bfaa99179493fceefae89a8b02104fb34e14d1c
SHA512 48fa22f2c8e9092d5f06daab58993e144c614c49126ac6820fe03956dde9c878ff046c081b758d76b503c0726e450c32176c7546739d1fcbaac0a0d07eb073f5
SSDEEP 48:YwjCm07e1um9W9DAXbkTZDKtQAZfnJyCXvVATfaJSk6v70FroJEy5MM9gP5vc38I:YwR07ukDGI5yZfJDXv+Ttj0WGq9gF5I
TLSH
T166C13A48A1DE4C21EF6A1DBAF1E005C93DF3455B8FD75E22C7F480BD64AAF5AB5A5000
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58b512.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58b512.TMP
Size 3KB
SHA256 a28b35156f644dbdfab5c6101fa952ed26ee2d3f1892023a719b392951ee7b36
MD5 848aace4dbaa2da0088518255ad0acf2
SHA1 530a9d9559d0685cbeb94311ce2aa37885a28036
SHA512 7927f5b773ba695b77b1dc35b0ba7df3c624063c9d41a96ea44c24976ec76aae1676fb31409faba543e0dede0c45062160b6c070b41a23a62d93832bf2ba0a8a
TLSH
T1A4613B1802C24972EFBE1072C0F196193EF3499F8EDB8E1247E4C4FD6039B1EAAE5004
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 ffb726695b7e7dc3eb1bfe6e4aa1b4eaab82bd5a3343c43d3fd0ed694e0e2b61
MD5 f9f845c554794175f2a9f5535072882c
SHA1 66e7bb51b34220664f0677c8219da085626e3647
SHA512 57831ee23bacc8f75bcbcefedee79b485c63278183fe66a2e41b5defae47fe6ca5d4cd4f10ff946c6822728126b40eeb9f2e1d98485ef7287fa93b3149f41b31
TLSH
T14E4127F747B2956DDB1255F0AA08EE2BCE6C0111831C787985E0BE56D3E3872E142B6F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 55a604b52aa178b769f5e47e0cb04e7aaffd7eec699f0aee34ea2c852a42f5ef
MD5 986699a9eae18e4872e80bbe5b7cf457
SHA1 1280a913f9e02d26c6dedcb83292bbd27096483c
SHA512 565754f7ab6af98753dd6be8c233dfd60736553a84fd65be471bc7581bb728981a779601b6ab292b2aff4d0875c216aad5ba08f3114bdd876ae6a8900413cfea
TLSH
T15F415AF787E2956D9B0255F0AA18EE2BCE2C0510831C787985E4BE57D3E3871E10275F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 d8e05b299594fd80e82de946bcb75bb5a729fe23fc6a92573c85c89a6d2f1813
MD5 cd0acd29276f3eba553692e32aec3164
SHA1 f2825e5571370014df51295bf3d58cc776a05100
SHA512 b6de1785d411c049dcf6e27749ee7a159ac601f8555944be0e55319665b5447dda4fb80e1801ba782d0340f3b7e567985bd1087f0f7254a5d08520d00a52ed0c
SSDEEP 192:sxZCRJyM/jK1Ml8Mkf/fKsQFV83OIdp9jBHW6+WNYG1/Ywm6LVvIgrJ:sxZCLMf/fKsQFVSfTHbL/Rx9
TLSH
T18C52E8016A34997BCCCBD209FA417B53EBF54466D2900E44AEFC991C04E6BED2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 93953c37060cf8bccc3c111d171b37cadeee40fd99c3185438a3bc7f49995d83
MD5 8c6453088b235e2e2bcc8796c679693e
SHA1 49db8cb1796b418274fb70994cf13b5479103037
SHA512 b4d7813c020fab45cf3bde4ffa627ece3de3c6e514b27c0a9e3f744903ad150754819aaaf0abbd1c8328b479b693c9e6a9159dee5c580f98b8d2359b1292c47b
SSDEEP 192:sxZCRJyM/jK1Ml8UQIkf/fKskFVp3OIdpvjBHW6+WNYG1/Ywf6YYvIg5NJ:sxZCLqrf/fKskFVlf1HbL/wxV
TLSH
T1BA52D8116A3459B7CCDBD209FA41BB53EBF5446692500E44AEFCDA1C05E6BED220BC2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 49484456a7081fdf88f416b271c905d17df8326786f9e9f442bdf86cce46310b
MD5 869268ae07f1c8f2586c5833439a5a1f
SHA1 ddfec87dda6ab9605ccbae203f74fe758b699a97
SHA512 2da176e54f8e20de78aadab85da9964b3913d400d56ca76cc8a8d7f47d45df9579e200a406b6c9dff1af6671c5a23d967b7d20ef84e5e53ebc75ed287ea96898
SSDEEP 768:tG4jeXmWvmKLE8F1+UoAYDCx9Tuqh0VfUC9xbog/OVhPLlrZ+dirohAYc3aLh:tG4jeXmWvmKLEu1jacPLZQd5Wv2
TLSH
T12BD20A3B284CCF7E4F844E5CED26AE976ED801CB6A584D5047FA894C03C76EB512B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\06cdf1d3-b695-4c71-9713-e0c03943cb59\index-dir\the-real-index
Size 1KB
SHA256 5fba257ec105f3ab977dc4039b1c3760fcf190116e88745836996eb954635f77
MD5 364803acbd02a9a978f00258ecc5bebf
SHA1 2d2f9923d43debb1940110d8f7bccbd1d2c9c300
SHA512 024d70bc1ef1b44ca871653ff840cadfa6636270cd6cc11a983b87430fb46f6a813208c87ddaf7579bdc72d704166c05d1039c3c9bb8380f78b20f272a07e8fc
TLSH
T14D2140998ED15D1FF868857B1673B8F8B3708ECC8721E363686C22721E1178D1A5B2CC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5cf8fe.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\06cdf1d3-b695-4c71-9713-e0c03943cb59\index-dir\the-real-index~RFe5cf8fe.TMP
Size 1KB
SHA256 5e43bac7c2976cd7a78babb7d3cad9b555cc26753db0e5014f805722a09955d3
MD5 79cf68603f87d32a252e90f5ce7d942e
SHA1 b932edb0e10bc9f4fbb217b84f0d4440908fd367
SHA512 1a5bbe998d0dd6dc7e4efa0f945f7f64566a0586e2a380894125e766364fc697ae9a5af4aba51cd0d84f5d18c7261751846f6bbdacf98b103a89008276487dad
TLSH
T14F21279547D14D1BF894917F1A57A4F4B2308D004722F793693C31798D35BDE1A0B0C9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 23045e14b7a350584b5a48de400d8f7e9a20626ae885e56efc89347616c480fb
MD5 83095b5781f1c4c2d1a379b9ac25e332
SHA1 3bacca3d6ee37ce794d5065e495ff238d6ab17af
SHA512 90b898b851c2d753288cd5f87450984ad5fa444c241e18057ee09bb8b473db61066c1b1e800b04b96ea64f912c7916f579e9ed865e3a1958d45c17c1d9e9e1bd
TLSH
T11DE0D8FA2DD72E20ACBF47E628B245A44156B469C555AC8F2416A2E751A02682016C61
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 8e09053ba81cf61d2e0386db8b482d95c250bdd22e0bc922c0099161a86ae893
MD5 8a595b3d2ee3efb4e1a58b79643f2200
SHA1 afc3baf39351546e4bf3a80bb6b011119882200a
SHA512 5de9ec7d2510571b3a92d9eb3d19782ba6aa6e34b531cb77669440e2c61a5b337291820d2b54afcef6e4c223900b7a84211deed91d79de04fd062b046b915318
SSDEEP 48:KceI3KLKIjy9lI5KGUc+4JCegOSbBCrqISWbKHi/UbL4L8T6yoyPFup1XT7vIlKD:Kce0KLKeOl2KGUdRKKCMyRvuK00l
TLSH
T171B1754530BB42013C3F155CB2E2A637498179637029E52B7FB904BA5E66E519DFC8DC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

b975bb32-808c-4d25-bc71-5236b260bcc8.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\b975bb32-808c-4d25-bc71-5236b260bcc8.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 c6f450453403527beaad124122039fd4e79a3f890b7756c99f12410530c92b89
MD5 338ce8b3c39c5ace0f2f138e4ff27a9f
SHA1 8d780df0f63967db177a929fa542ec6bd8c6ddfc
SHA512 809f3dd8c4bc0d8a8df097c0ca334ccda4473edc83a14a304a70d90933385616f219ba0cde016638ef1833f2d9da3b136f2b4017516a150b0858a032eac1c4ba
SSDEEP 384:L3yFaeO8WsNx/xVqLOI4f+j8IMX/+24F1iT9YA44GKf:L3IzhWeqJgj/lm1iRYA44Gu
TLSH
T1D4826E32A8745C778DA2B681E14732539FB4445FDAD66F90D9EDAF1D04CA1DD130BC12
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 1b0b2ff65895e355225485e8ea220e27ff2a4d54aac29971301317a20e8c3d4d
MD5 c0c1a89ffbece72fafff327097438461
SHA1 737ae18c29f670d65a64dc5135e4cfd55d69a876
SHA512 d4d824a3cab9790d79b657d940d5c73536cd5fd350166f327b6d13afdeecc388d9fad38abf572dedb57284fa96838bac06f002424fc5f48418f4f12775709a2c
SSDEEP 384:riFZ3yFaeO8mpsND8TUNTUlIlexVqLOj4f+j8IMX/+20F1iT9YA44GKf:GFZ3IzhmpOwgYqSgj/lS1iRYA44Gu
TLSH
T1A6C229F248D78876D9AD9743A33E2D139EBCC05BB591AA50B7985E1CCC861BFC30AC11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 516d0b1d24197edef97a1a6d14a2d2bdd6066936d6fe1c4e93bd878c3265c8fa
MD5 49ab1a80421418db2c081a6ac34bccd5
SHA1 5cf2a8b715136cb38cfbd7ec7e6b83c05fc2a50b
SHA512 fdf646c6a356a836c660fe235efbf01c836f3b9793999534bcbbdcd71922c97af310412b5b7ec5c9323e222235f8ac35d0c061a26de6bb44f99e105b03ad6e7e
SSDEEP 192:EONJ6hZ0QmiUyaspc/+jVRjzorIz5wOZ5AhU6:EONJ6oypu+j8IK2OhU6
TLSH
T15202B93568787CBB8EE2AE45F48737235FE5116BA9956F84DAE81B1D00C769C2307832
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f3638d5623e4e304dd4de16071e2670302510a742cffe099e3c21b8ae5b3b7d9
MD5 b6eb032d04a4d8f6d3d45b75b4350add
SHA1 1b739e02fa259adee2cb9e4c19b460f0fabfcec0
SHA512 2fd82a9eea869e3275a448cb7aeae4657d63ce53a5cc342bcda851f44027ec1e9692f756f574b62a651b28443e2b096787393565a09287f48370e99242d52775
SSDEEP 192:QON06hZhQmiUy8EsIc/+jVRjzorIMXTr+2a5cOqFqoU6:QON06jPIu+j8IMX/+2191U6
TLSH
T1A312FC366468AC675DD2A695F48732235EE5511BDAD6BF80D5EC2F1C00DF66C230BC22
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3b97ad64-fc52-45d4-9780-5e9aeb4e0fc9.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\3b97ad64-fc52-45d4-9780-5e9aeb4e0fc9.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 0fec236ff2e6dab12f06dc23b84a54808cbfa618d992d863bc0a2c97512d8b7c
MD5 14f27e937cf8134d24397fd16968f618
SHA1 c39ea1de3b339691813397f539f367c7149658de
SHA512 e52dc610f66c56418a3b6698f529b3f875713c98b74861a9eac38f74810f65599c42294ff0066beb5987c32591b6c8942edaa5ef152910741da2c95fb32dee2b
TLSH
T163412A59A6F91148B3B76F5AABF7A96D487FB8772F0AD15D00010D4F0B22B00C962737
MD5 SHA1 SHA512 TLSH

Submit Download