hxxps://github[.]com/p2r3/convert/releases

Analysis

max time kernel
598s
max time network
592s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/08/2026, 09:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://github.com/p2r3/convert/releases
Sample260823-lds3cavfph

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
5056	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134319507438209721"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{F9A91F89-31A1-48F5-B28F-608932133A76}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4816	msedge.exe
4816	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe
3284	msedge.exe

Suspicious use of WriteProcessMemory 40 IoCs

description	pid	Process	procid_target
PID 3284 wrote to memory of 4924	3284	msedge.exe	87
PID 3284 wrote to memory of 5056	3284	msedge.exe	88
PID 3284 wrote to memory of 3300	3284	msedge.exe	89
PID 3284 wrote to memory of 3300	3284	msedge.exe	89
PID 3284 wrote to memory of 3300	3284	msedge.exe	89
PID 3284 wrote to memory of 2172	3284	msedge.exe	90
PID 3284 wrote to memory of 2172	3284	msedge.exe	90
PID 3284 wrote to memory of 2992	3284	msedge.exe	91
PID 3284 wrote to memory of 2992	3284	msedge.exe	91
PID 3284 wrote to memory of 2992	3284	msedge.exe	91
PID 3284 wrote to memory of 2208	3284	msedge.exe	92
PID 3284 wrote to memory of 2208	3284	msedge.exe	92
PID 3284 wrote to memory of 2208	3284	msedge.exe	92
PID 3284 wrote to memory of 3824	3284	msedge.exe	94
PID 3284 wrote to memory of 3928	3284	msedge.exe	95
PID 3284 wrote to memory of 3824	3284	msedge.exe	94
PID 3284 wrote to memory of 3824	3284	msedge.exe	94
PID 3284 wrote to memory of 3928	3284	msedge.exe	95
PID 3284 wrote to memory of 3928	3284	msedge.exe	95
PID 3284 wrote to memory of 3260	3284	msedge.exe	98
PID 3284 wrote to memory of 2252	3284	msedge.exe	99
PID 3284 wrote to memory of 3260	3284	msedge.exe	98
PID 3284 wrote to memory of 2252	3284	msedge.exe	99
PID 3284 wrote to memory of 4040	3284	msedge.exe	101
PID 3284 wrote to memory of 2460	3284	msedge.exe	112
PID 3284 wrote to memory of 3680	3284	msedge.exe	113
PID 3284 wrote to memory of 3572	3284	msedge.exe	114
PID 3284 wrote to memory of 180	3284	msedge.exe	116
PID 3284 wrote to memory of 180	3284	msedge.exe	116
PID 3284 wrote to memory of 4816	3284	msedge.exe	117
PID 3284 wrote to memory of 1600	3284	msedge.exe	118
PID 3284 wrote to memory of 1600	3284	msedge.exe	118
PID 3284 wrote to memory of 3364	3284	msedge.exe	119
PID 3284 wrote to memory of 3364	3284	msedge.exe	119
PID 3284 wrote to memory of 1008	3284	msedge.exe	120
PID 3284 wrote to memory of 1008	3284	msedge.exe	120
PID 3284 wrote to memory of 5028	3284	msedge.exe	121
PID 3284 wrote to memory of 5028	3284	msedge.exe	121
PID 3284 wrote to memory of 3444	3284	msedge.exe	122
PID 3284 wrote to memory of 3444	3284	msedge.exe	122

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://github.com/p2r3/convert/releases
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3284
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2f0,0x7ff9c878c188,0x7ff9c878c194,0x7ff9c878c1a0
  2⤵
  PID:4924
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1924,i,9436432985360259772,143045947816346653,524288 --field-trial-handle=2096,i,8556880323495220353,16002056959585884476,262144 --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - System Time Discovery
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1664,i,324338937314214472,12178530638637800244,262144 --field-trial-handle=2096,i,8556880323495220353,16002056959585884476,262144 --variations-seed-version --mojo-platform-channel-handle=2092 /prefetch:2
  2⤵
  PID:3300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2604,i,11350713068266099508,12639379537769057841,524288 --field-trial-handle=2096,i,8556880323495220353,16002056959585884476,262144 --variations-seed-version --mojo-platform-channel-handle=2744 /prefetch:8
  2⤵
  PID:2172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3424,i,12280712695860175023,6096531934554044737,2097152 --field-trial-handle=2096,i,8556880323495220353,16002056959585884476,262144 --variations-seed-version --mojo-platform-channel-handle=3484 /prefetch:1
  2⤵
  PID:2992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3428,i,15494596593680729477,11166240131706973617,2097152 --field-trial-handle=2096,i,8556880323495220353,16002056959585884476,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:2208
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4132,i,11623058412692030359,1647988947973347333,2097152 --field-trial-handle=2096,i,8556880323495220353,16002056959585884476,262144 --variations-seed-version --mojo-platform-channel-handle=4180 /prefetch:1
  2⤵
  PID:3824
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4156,i,3722543063189713106,8508223664590169435,2097152 --field-trial-handle=2096,i,8556880323495220353,16002056959585884476,262144 --variations-seed-version --mojo-platform-channel-handle=4192 /prefetch:2
  2⤵
  PID:3928
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4964,i,17036660957798537267,8450751215732759570,524288 --field-trial-handle=2096,i,8556880323495220353,16002056959585884476,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:8
  2⤵
  PID:3260
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3936,i,13356058352824119628,8575212682512706456,524288 --field-trial-handle=2096,i,8556880323495220353,16002056959585884476,262144 --variations-seed-version --mojo-platform-channel-handle=5100 /prefetch:8
  2⤵
  PID:2252
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5620,i,13091156782335519029,884987338738949017,524288 --field-trial-handle=2096,i,8556880323495220353,16002056959585884476,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:8
  2⤵
  PID:4908
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5620,i,13091156782335519029,884987338738949017,524288 --field-trial-handle=2096,i,8556880323495220353,16002056959585884476,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:8
  2⤵
  PID:4040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4212,i,4865628457678018828,1355412128010837211,524288 --field-trial-handle=2096,i,8556880323495220353,16002056959585884476,262144 --variations-seed-version --mojo-platform-channel-handle=2916 /prefetch:8
  2⤵
  PID:2460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5868,i,944208503975439410,8096965656821019659,524288 --field-trial-handle=2096,i,8556880323495220353,16002056959585884476,262144 --variations-seed-version --mojo-platform-channel-handle=120 /prefetch:8
  2⤵
  PID:3680
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4740,i,10098171454210208590,2743401013744161046,524288 --field-trial-handle=2096,i,8556880323495220353,16002056959585884476,262144 --variations-seed-version --mojo-platform-channel-handle=6148 /prefetch:8
  2⤵
  PID:3572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5284,i,15185872531075792123,16496493479114881299,524288 --field-trial-handle=2096,i,8556880323495220353,16002056959585884476,262144 --variations-seed-version --mojo-platform-channel-handle=6164 /prefetch:8
  2⤵
  PID:180
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=6044,i,15476570812466903471,1950184439033262494,262144 --field-trial-handle=2096,i,8556880323495220353,16002056959585884476,262144 --variations-seed-version --mojo-platform-channel-handle=4412 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5364,i,12335857966934956615,11607331267705738771,524288 --field-trial-handle=2096,i,8556880323495220353,16002056959585884476,262144 --variations-seed-version --mojo-platform-channel-handle=5876 /prefetch:8
  2⤵
  PID:1600
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5236,i,11049624291598579536,1492637835314442070,524288 --field-trial-handle=2096,i,8556880323495220353,16002056959585884476,262144 --variations-seed-version --mojo-platform-channel-handle=3528 /prefetch:8
  2⤵
  PID:3364
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5228,i,11369926896923707641,17902865250892929501,524288 --field-trial-handle=2096,i,8556880323495220353,16002056959585884476,262144 --variations-seed-version --mojo-platform-channel-handle=4396 /prefetch:8
  2⤵
  PID:1008
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3340,i,3752649491586730381,5124448075313300086,524288 --field-trial-handle=2096,i,8556880323495220353,16002056959585884476,262144 --variations-seed-version --mojo-platform-channel-handle=5404 /prefetch:8
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4256,i,10333902855826209021,11825667923766628278,524288 --field-trial-handle=2096,i,8556880323495220353,16002056959585884476,262144 --variations-seed-version --mojo-platform-channel-handle=2792 /prefetch:8
  2⤵
  PID:3444

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 f0ead82c3c8a4cd9959a8cd1cef74705c67e276b4a574243e75c890cb0b0b8fe
MD5 f8a5a8774310485121aa8917052b352c
SHA1 78542cc17bce16f7d0117a4beed6ae29c39c3042
SHA512 94c06ac4086f7321e54c95657a2fc0769092ed3577572d27a9a75f404a57f6b0c02e9bb5c1e8c0c285a577d89a5801c60face4ebf1cee334d6be346c240f09ad
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7C:fwUQC5VwBIiElEd2K57P7C
TLSH
T1D5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CrashpadMetrics-active.pma

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma
Size 16KB
SHA256 814d47aad78c212b52568b9c7b58d242899d490d3afebce66181cae50c880df5
MD5 8c7cdfea4284ba987d295d82a9c7ddd6
SHA1 7d1a3a66f2d64a383b230196ba89a263ce7ee957
SHA512 59c8229e834c944265aed4131c79f41f9f940a48651b9fb18800cef5bae36d17c7fd5880120c6fee8ce22a157b65bc63846b65765bc4dc86e15926dcce400d0d
SSDEEP 12:sf9iXhV0xoUZxCe+JKlkQuMRxCb8TXuYJ0IJpPK6BsyW1inPiz:U9iRqxoUZxWMk8xVTeYWI31BtXP
TLSH
T105724C85B34498FFC8835E7189BD27903774F6DF1F02866B6A6A760E2E271C84F44224
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1c8e6fcbb66aba64fe595f222fc4117e00e82ccdc0eef2100a1b4f7babb04f87
MD5 398d1e7948d46a763209c466fdacd0fb
SHA1 b26f2c32bc106089a59ce779d792beaba59f92bf
SHA512 a0bbf31d803e7333d004f03de9c261732d00cceb5d82dd64b5f0decf8adc8b840891187c72bb21cce83873e6d4dd2fab89d4c7efa320afe2ef3589678dcb1424
TLSH
T1B6D080277A196004F3964175A483D7061319956129575711F310C44CA9775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5d2c4e39ddbeb0ac61628bae04f1ac5787600ec893b0e230d1a84d61470771a9
MD5 cd6e704306442404371caebfec7f5b29
SHA1 e4beab8b7820af3633bf7c75a5498a958a95832e
SHA512 de66681a9245e8ece7d7e2ea2080251c395f2aeb8a885ac007eaf16f2ee3a3e36610d2afc17be964a038704371cedfbe4da91143ebed5adac20dbda97768d6e6
TLSH
T13AD080273A196404F7964175A483D7061319956129579712F310C44C99775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 e365b963433c0dcb3ee6099dfe313201c7f54752485c637b972101137b4889b2
MD5 8417a6e2bc68d00131d5c480010d92ae
SHA1 367003c1496141ed4c2f32594aee9ec7625a18c4
SHA512 dd02c660901cd83b5f5e454d96dc3399357e0ff9c633e22f0bb6af536c12c9da2af97340586faa840c81774652b46d4dd1389a8deaec9fb31530fa9aae08bf56
TLSH
T1A4E026D423C6C2A519C2969BB15C731A49507945FA8FC4DA721E73AAB820A81CF4B4E2
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 9348d432e06f74d951db7f8e1614fd5c17a944bcfe3da81a90e03707060d50aa
MD5 0c322daaa89f4064e13b86d401d8f364
SHA1 3767156ca999aa0aa2ddba1717fd2a641f2ce31a
SHA512 7d9a9595bcf9d305ed1f98e30e00e9fecd5ad5b1b76ebb2c6a30cf2cfb4abc6fd1a7d96dbcf51fcf947e2af0a3a831987f34be39a13c1e7dcb5d7b0361db1455
TLSH
T12AC08059BD4C845FC28018BE5726F000176055519417D6570650FDD032407A01F2D264
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 2b8f08246200155e1af7f3500222021d6f22969719d20128db6e042b67aaead4
MD5 2ef0490bc3173c17267eaa09b8b29919
SHA1 1cfb4bf248b47ed22260881bfd265d698503f360
SHA512 eee6caa0dfa36f86fd6722cc148f11002dd794654a9910ce6df980bd434ce3226cc79b3ba98f19c8f5b6c1ed14aab0ab7f038cd0e5ee0893edba4fde2a67d25a
SSDEEP 96:6r/6CNSpg3PgWdI16nzO0/EQzv8cb7OLjO:BaSa3PgWdI17gfOO
TLSH
T16CA13CFC25B9C39BE335CA7A40F1C104B5B180ECF0AFFEE57D505A302962BA1C215A96
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58da6d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58da6d.TMP
Size 3KB
SHA256 1997d2e4e459945c060eac93602adc4f4652b6c472ddc024b797351d70c284a2
MD5 a8241315a022601633d42f9422f2aacd
SHA1 3c2bd0629da79f62a79dd355d3eba2c3c56b9480
SHA512 26bd564d88afe6f7a6952f7a849123d9301a53c73d7c36ad723097d7449871021825b102ee69a54a3f310377e6b6a686fdf01c2a154f968a39547a7a57c9b4e0
TLSH
T1B1714CFD2A52419FF354C2BB40F2C10479F195E8F41FCECABDA04C302616BA5C269B98
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 5a09f55d8fc0e2a368323695522b9aac01e980c07cbef6dd4065217603dfec3a
MD5 8798a3fcfbe0a390e80cbedaa4d49df0
SHA1 a3a636b7acc10f371d441392bc55ebcb091c9d3c
SHA512 d352b645fd1290d0ad840f180505c7088d58568c855184704e5e3dd334a3f88db0d65d99e9c01a99ea93fb8c6eb5aaa7817235232f509acffd64ee09360744aa
TLSH
T197417AF387E1956DCA0256F0AA18EE1BCF2D0511831C7C2989E4BE57D3E3871E002A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 48d7a746f0e72579fec318552af74f04917a6c6eeb4cc67216141642b519468d
MD5 c09c2fc4c78c3eb279d62b2716112028
SHA1 8c2af0bb40a007bb36c332cf13ad5e3f42cf3c77
SHA512 8ee74a21c13bbd68e9ff4b049a91c2faebf26e8bbcb4e36020835c370872a480b3b06e51eb50d02591288c4b1d00147153ede10c2a57f5f15ce4f4505b7a05f4
TLSH
T1684169F747B295ADDA1255F0AA08EE2BCF6C0111831C787985E0BE56D3E3471E002B6F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 411d53985c4f07444c9dce0dc61c4c7e92b625c1a61c86b7f0cd887265158b32
MD5 7b327990aeb8de92a4a9f06dae12d706
SHA1 f443dc2c382bf7b3f218ded72fdbf4b2baba6b71
SHA512 c0fe85ffc3cfe95cafdfcbe27d09f77ac5acfc4938375e2c84fb05eb6322a439ff8337284350a1fbbee2451b24b9008fb4dc9d1530850944bb759549dc4ef0e3
SSDEEP 192:sxZvRkyM/jK1Ml8Mk2/fisnnuJIdp9rKHW6+WNYtEZ/YChiKMHa5IgrJ:sxZvOM2/fisnuC0HbJ/o6F9
TLSH
T1DB52F8116A349977CCCBE209F955BF53D6F9443292905E48AEFC9A1C00E6BEC2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 885f6c831d21b71cce8da3bb8c9ad8d63c0081b34a335d8834d43f0d3327652c
MD5 cfd8ab317f76c34475b1d47f7cd90f0c
SHA1 79fe4180be243b1fd742d95decaf10beea05f2b9
SHA512 432cf1f35a9c67a66b14ebaaecd0a315a15855d95d5b06109b4e2cce962bb0d51ab85019c79414e980539af133febcf1911942ab4e8673bd7572bce064212987
SSDEEP 192:sxZvRkyM/jK1Ml8UQok2/fiscnBJIdpvrKHW6+WNYtEZ/YCQ/KZHa5Ig5ZJ:sxZvOqL2/fisWBC2HbJ/V6FJ
TLSH
T10952E8116A345977CCDBE209B945BF93D6F5447291905E48ADFCEA1C00E6BED2207C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 670c3fdcd32d1729405030c5eaf7cdc6d9360a41166baa49b7a23b049f90bf96
MD5 b9ded4764d40b1de5100b81d51c81c0e
SHA1 59f461604de1dae59ab2fd14491ea0787c5e5783
SHA512 f4d9789e4524dc1c496adcd7f25fe69474bde8ca754d2632eaa3455596cdaf287061dd1c68fd4eeac945f90896938c5571197f994d08a7b16742cee4895918f4
SSDEEP 768:f48bqn+WvSCt68F1+UoAYDCx9Tuqh0VfUC9xbog/OVnZLlRTKV4roU:f48bqn+WvSCt6u1jaCZLbWVDU
TLSH
T133D20A3B280CCB7E4F845E5CED266F962DD801CB6B988D4447FA984C03C72EA511B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dfa4cd3b-6396-44b1-9341-22ecfa35924f\index-dir\the-real-index
Size 1KB
SHA256 d5d885e019a07c89b0853adbfa3b479bbcc321cec92dd6aa2d25dd90c15f4d0c
MD5 3813839c3c6ef21e1b99151d7fc270f9
SHA1 2e52963e8c9148ffdc69d182867b7166ccc39574
SHA512 754acfb28d2370e5a3ffebe84123a1cb6bd63942d85d31865920e82ed7e7be93fd4580fbe08b60e93342dc6232327bd3ab1bb4fca0b8c60e5aa287a1b9b334a7
TLSH
T1F841A59E8D9495AFDCA409B204B2A0A83374CDCC2B01D2835C7C72377C5373A1A4F1AC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d1fa0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\dfa4cd3b-6396-44b1-9341-22ecfa35924f\index-dir\the-real-index~RFe5d1fa0.TMP
Size 1KB
SHA256 c6f07d3d19c8f195a8f5ddebc48144e8ee77d1ea8a9a5c5232d85c71d468f1d7
MD5 3b474d171883d4c02c3aca8d3477a31f
SHA1 b3a79cb4098654060caf465cb3dff262a5b82d4c
SHA512 8070f0bc379c79f8588fa8a763098e80a90c43bf065821e63cf73ad8d50f0c6ad085614f2e9c36405aa6a4c50bcb1f4d68214ea61c1e8eca9ab4219ab4f1098a
TLSH
T1A941848A4E45861FECD000B206D3A4B83379D9405322768794B8563AB8B57BD2E4F1D8
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 401e64b5683b9ca7c22bf5016c5a61aa8dddf85d9ea79ae622c55feaa9b12f4c
MD5 8fb59504267a35675a207b185d8cb1d6
SHA1 d73a0cd86702e6cffa4031f8cac1eba9a1580266
SHA512 cfcd985264bf769c064b4713ae2c87622df6a384eed73d089d438c4af11bd64fd7c65cbebe9327b5f4242bb685a59dfe5587a321fc376d8e2ae30c1a097f70e5
TLSH
T1A6E068FA29E72860BC7BA3F5247008E002597988C986BC9F00A9A1D710B33622856C60
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 f489c9675b2460d7d84212da49d85b35d78f0ee0545454ea182f1a15e95eca41
MD5 251388f68c787d1c92befb1d9a47c02a
SHA1 51d57c17a91b0d902dd83553a484b36f0e65adc6
SHA512 43f499e0aa731a586f27c6e46d8b063e6c8d449d0b4b15bdc1be41c1ca2f68e315edfb6e15a167eee79400d639767d666263ecef3c4f7ce0a0f1257015ba11b6
SSDEEP 96:KA/ArPNhtY5p+L/HYKn9/lYTHnOlP1W9KKe8CaMAKdqrp8zvR/jrz:ynBtXYp8zvR/j/
TLSH
T16D911F22727B130238BE680CA65A873B8E5232E33855A46E77FC40550A77E212EFD4DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 c437e5d8c2d1fc2f647387508d60604a972954cf2360ac40252d80aeadf1cd56
MD5 30944ea6075543940e7839e53af045dd
SHA1 125b84d074bf9b5fdf0f9817c73ef6ca580ec181
SHA512 4003a139eda9b6930c7329fc972b34698f74da636567bc5432d1470e0743de65b00b611e44e9ed9fadfd25d636cbe782258bfd2fca02e1b09d9cd64a57707ae6
SSDEEP 384:FZcIhsNfI/5CH50OEa+UOH+MHjqivp+aFoj:9hh/LNaJOHZDqiRlFs
TLSH
T104827D365D385C7628F2A185F9463A17AFB89077D6CD6F90D5DCAF2C00EE698130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 7bd8a583928b3394b18efd43dad8935447958781d59208617aaa256f92348f3d
MD5 0130e5d90579cadba46a321f20d9d6ce
SHA1 e7950066dc497ab4f41f7edf1dc674df760870c7
SHA512 c1dc9c00028b3a117ea2bbff6a9df86f41609c005da6badbb69952010429703e6392f8efbe7a808ff5925ae195fef3a1ae02ca3d8ae51e484a57b7cf81c43995
SSDEEP 192:vONJ6Db6QmiUylNHBa+joOmw+4sRgJCU6:vONJ6uyHBa+UOH+WgU6
TLSH
T13902E835697C5CB79EA26E49F88B37279F94203BD9966B94DAD81F0C00D764C230B837
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 b7ac1f10c5a49d639abfb564d8a0715ccaf61cf7ac80c81481519aad5e74881d
MD5 b218a20be62a8a8e1c5f64ff928c06e1
SHA1 6e758cafd890447694ced8c8dbeb8c9455a58ce3
SHA512 8011102d98654989bc9149618da4825954e7bbe4375eee5a4b9185b1530140d5ff5bee5bc7b13376b0d786b4f1a74a6c2b7ff1536e5e244e5f90ac1fe32e96e5
SSDEEP 384:AFiZcIDsNB8TUNTUlIlP/5CH5gOEa+UOH+MHaqivp+aFoj:AFQDQwgx/fNaJOHZ6qiRlFs
TLSH
T100C219F208E74876D8AE9747AB3D2D179EBCC067B585A650B7885B1CCC961BFC306C11
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 388a7d5841b7a607cb7b085a21bc6c192def3b4919ed78cc978bb3b4a1cb6603
MD5 a3d45016f79f90e0228e1476cb6e53d5
SHA1 f8360eebb4749c6b301beb7475839ef1cfb7a609
SHA512 938f1c5f7f00ca2b44e4c53b6439f237fef72a8cf1618369068e1f3219825f1512f1c2101469d1599756aa5c9e73d4ca1a6085260136bfee900f09f5b86eeb11
SSDEEP 384:rZcIhsNfP/5CH50OEa+UOH+MHjqivp+aFoj:zhk/LNaJOHZDqiRlFs
TLSH
T183828D365D385C7628F2A145F9463A17AFB89077D6CD6F90D5DCAF2C00EEA98130BC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 12e7872e6551b774c35291caf5f937817b3ba727303707424b89c0f56124a6e0
MD5 2c6425ed9c251e839c6a9cddf8d09a29
SHA1 0c5c71cb809c7fcc6fee0b7fcc1353863e600e6c
SHA512 d09a6f08de2e36d1607cf8e7fc6eb845f39e7f3d82d07f1e36a2f2f3cb43db98491d6b69d8f5953db7f64dca1986e4de6e59108af6ea50a0be363d6b9dcb4faf
SSDEEP 192:vONq6DbnQmiUyaNqBa+joOmw+4z5FVlNz8rqsU6:vONq6hTqBa+UOH+MHJqU6
TLSH
T1E0120736683C5C775DE26585F8873A279F945027EA8A7B91D6DC2F1C00EFA5C230AC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

4d66c5bb-dbe1-46d5-9421-7d7efa74bb3d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\4d66c5bb-dbe1-46d5-9421-7d7efa74bb3d.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 8bb01255eb4a0b41bed5b06355106409f927bbbd76a490bb3928807642271335
MD5 895513b2616d293a4382eafeb78fd044
SHA1 1b28e71a51097af23ca54f90174a511ad85ace6e
SHA512 2ef37a3c25e1bcb5aa15d5a5d1ed3bb0421f9fc9a4545683f4ac0af46f85d1811a5a85db0801daef1d28912a6ac4994d91f94b12af2f70e6fbc1545fd203987d
TLSH
T1BF411858A6F91108B7B76F569BF6A8AD487BBC772E06D09D00110D4F0663E40C8A2733
MD5 SHA1 SHA512 TLSH

Submit Download