4ada1451b82bd71c341589681c2a2fe8947a5b1373b6960e18106178854a622e

Resubmissions

24/08/2026, 01:29

260824-bwdehasane8

24/08/2026, 01:28

260824-bvt1vsxtfs3

24/08/2026, 01:24

260824-bsgyhsbg553

Analysis

user interaction
yes
max time kernel
43s
max time network
43s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/08/2026, 01:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Screenshot 2026-08-03 130940.png
Size 9KB
Sample260824-bvt1vsxtfs
SHA256 4ada1451b82bd71c341589681c2a2fe8947a5b1373b6960e18106178854a622e
MD5 8c34586eb03210fa8422355039fa90c3
SHA1 ff9f97e54f9576fdd814b7341453364049598244
SHA512 3ab2669e12899c40c4455bd6569e4798ea42e3081589f1191caef19e0e39290f3e04273510d629479643d4957d40fe62fcfacece7058d297ce21241fe2a20c92
SSDEEP 192:zPDmcP4hiJ31lz413HzRSrAXd65Enfp0H5kdf90UmFe1E:z7mIEiJ3z413th6Ka6dLC
TLSH
T162127DF763037DC25B99C82F449B9A1518D3424E267C0CA4AC55186DE0B8E05FB62F4F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4044	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134320085226281079"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{89375F97-609E-4A7F-A0E6-7DE6EB9B2E00}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3704	mspaint.exe
3704	mspaint.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe

Suspicious use of FindShellTrayWindow 10 IoCs

pid	Process
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe

Suspicious use of SendNotifyMessage 8 IoCs

pid	Process
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe
3040	msedge.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
3704	mspaint.exe
3704	mspaint.exe
3704	mspaint.exe
3704	mspaint.exe

Suspicious use of WriteProcessMemory 50 IoCs

description	pid	Process	procid_target
PID 4684 wrote to memory of 3040	4684	msedge.exe	89
PID 3040 wrote to memory of 5024	3040	msedge.exe	90
PID 3040 wrote to memory of 4044	3040	msedge.exe	91
PID 3040 wrote to memory of 3100	3040	msedge.exe	92
PID 3040 wrote to memory of 2256	3040	msedge.exe	93
PID 3040 wrote to memory of 3100	3040	msedge.exe	92
PID 3040 wrote to memory of 3100	3040	msedge.exe	92
PID 3040 wrote to memory of 2256	3040	msedge.exe	93
PID 3040 wrote to memory of 1388	3040	msedge.exe	95
PID 3040 wrote to memory of 2816	3040	msedge.exe	94
PID 3040 wrote to memory of 1388	3040	msedge.exe	95
PID 3040 wrote to memory of 1388	3040	msedge.exe	95
PID 3040 wrote to memory of 2816	3040	msedge.exe	94
PID 3040 wrote to memory of 2816	3040	msedge.exe	94
PID 3040 wrote to memory of 952	3040	msedge.exe	97
PID 3040 wrote to memory of 952	3040	msedge.exe	97
PID 3040 wrote to memory of 952	3040	msedge.exe	97
PID 3040 wrote to memory of 2436	3040	msedge.exe	98
PID 3040 wrote to memory of 2436	3040	msedge.exe	98
PID 3040 wrote to memory of 2436	3040	msedge.exe	98
PID 3040 wrote to memory of 3480	3040	msedge.exe	99
PID 3040 wrote to memory of 3480	3040	msedge.exe	99
PID 3040 wrote to memory of 1552	3040	msedge.exe	102
PID 3040 wrote to memory of 1552	3040	msedge.exe	102
PID 3040 wrote to memory of 4672	3040	msedge.exe	104
PID 3040 wrote to memory of 4672	3040	msedge.exe	104
PID 3040 wrote to memory of 5040	3040	msedge.exe	106
PID 3040 wrote to memory of 5040	3040	msedge.exe	106
PID 3040 wrote to memory of 4512	3040	msedge.exe	107
PID 3040 wrote to memory of 4512	3040	msedge.exe	107
PID 3040 wrote to memory of 1364	3040	msedge.exe	108
PID 3040 wrote to memory of 1364	3040	msedge.exe	108
PID 3040 wrote to memory of 1364	3040	msedge.exe	108
PID 3040 wrote to memory of 3068	3040	msedge.exe	109
PID 3040 wrote to memory of 3068	3040	msedge.exe	109
PID 3040 wrote to memory of 3068	3040	msedge.exe	109
PID 3040 wrote to memory of 3208	3040	msedge.exe	113
PID 3040 wrote to memory of 208	3040	msedge.exe	114
PID 3040 wrote to memory of 208	3040	msedge.exe	114
PID 3040 wrote to memory of 3972	3040	msedge.exe	115
PID 3040 wrote to memory of 3972	3040	msedge.exe	115
PID 3040 wrote to memory of 1876	3040	msedge.exe	116
PID 3040 wrote to memory of 1876	3040	msedge.exe	116
PID 3040 wrote to memory of 3984	3040	msedge.exe	117
PID 3040 wrote to memory of 3984	3040	msedge.exe	117
PID 3040 wrote to memory of 5144	3040	msedge.exe	125
PID 3040 wrote to memory of 5144	3040	msedge.exe	125
PID 3040 wrote to memory of 4476	3040	msedge.exe	134
PID 3040 wrote to memory of 6008	3040	msedge.exe	135
PID 3040 wrote to memory of 5992	3040	msedge.exe	136

C:\Windows\system32\mspaint.exe
"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\AppData\Local\Temp\Screenshot 2026-08-03 130940.png"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3704

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService
1⤵
PID:588

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --edge-skip-compat-layer-relaunch
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Modifies data under HKEY_USERS
  - Modifies registry class
  - Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SendNotifyMessage
  - Suspicious use of WriteProcessMemory
  PID:3040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x234,0x238,0x23c,0x230,0x260,0x7ffc4b8ac188,0x7ffc4b8ac194,0x7ffc4b8ac1a0
    3⤵
    PID:5024
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1876,i,13887208608402027010,8325661661986160619,524288 --field-trial-handle=2400,i,6228200761427742697,11885287121022283704,262144 --variations-seed-version --mojo-platform-channel-handle=2448 /prefetch:3
    3⤵
    - System Time Discovery
    PID:4044
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1652,i,4883904337362897647,478499848567717416,262144 --field-trial-handle=2400,i,6228200761427742697,11885287121022283704,262144 --variations-seed-version --mojo-platform-channel-handle=2396 /prefetch:2
    3⤵
    PID:3100
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2208,i,10601726288337501898,2055453042899963930,524288 --field-trial-handle=2400,i,6228200761427742697,11885287121022283704,262144 --variations-seed-version --mojo-platform-channel-handle=2456 /prefetch:8
    3⤵
    PID:2256
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3456,i,2178539495083485765,4075816205938056688,2097152 --field-trial-handle=2400,i,6228200761427742697,11885287121022283704,262144 --variations-seed-version --mojo-platform-channel-handle=3504 /prefetch:1
    3⤵
    PID:2816
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --instant-process --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3460,i,5733766991819942123,4190187477280323376,2097152 --field-trial-handle=2400,i,6228200761427742697,11885287121022283704,262144 --variations-seed-version --mojo-platform-channel-handle=3532 /prefetch:1
    3⤵
    PID:1388
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4252,i,2396499225655656251,11974087500757550271,2097152 --field-trial-handle=2400,i,6228200761427742697,11885287121022283704,262144 --variations-seed-version --mojo-platform-channel-handle=4264 /prefetch:1
    3⤵
    PID:952
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4272,i,869886038915116182,16326269941260299424,2097152 --field-trial-handle=2400,i,6228200761427742697,11885287121022283704,262144 --variations-seed-version --mojo-platform-channel-handle=4336 /prefetch:2
    3⤵
    PID:2436
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5112,i,10695157474603598245,18149823320352780795,524288 --field-trial-handle=2400,i,6228200761427742697,11885287121022283704,262144 --variations-seed-version --mojo-platform-channel-handle=5108 /prefetch:8
    3⤵
    PID:3480
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5304,i,15039868666305656701,199441643085656955,524288 --field-trial-handle=2400,i,6228200761427742697,11885287121022283704,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:8
    3⤵
    PID:1552
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5540,i,7545314856687793500,16959446161040204707,524288 --field-trial-handle=2400,i,6228200761427742697,11885287121022283704,262144 --variations-seed-version --mojo-platform-channel-handle=5556 /prefetch:8
    3⤵
    PID:4672
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5704,i,5233090292898250470,4193217647818017047,524288 --field-trial-handle=2400,i,6228200761427742697,11885287121022283704,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:8
    3⤵
    PID:5040
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5708,i,15900389119206930671,13229077048325652425,524288 --field-trial-handle=2400,i,6228200761427742697,11885287121022283704,262144 --variations-seed-version --mojo-platform-channel-handle=5752 /prefetch:8
    3⤵
    PID:4512
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=6300,i,10993381903975443006,8041586111317112626,2097152 --field-trial-handle=2400,i,6228200761427742697,11885287121022283704,262144 --variations-seed-version --mojo-platform-channel-handle=6232 /prefetch:1
    3⤵
    PID:1364
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6484,i,3800314373851638267,2911680869887568260,2097152 --field-trial-handle=2400,i,6228200761427742697,11885287121022283704,262144 --variations-seed-version --mojo-platform-channel-handle=6180 /prefetch:1
    3⤵
    PID:3068
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,15429335456270230890,13412409893597542142,524288 --field-trial-handle=2400,i,6228200761427742697,11885287121022283704,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:8
    3⤵
    PID:3972
- - C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5380,i,15429335456270230890,13412409893597542142,524288 --field-trial-handle=2400,i,6228200761427742697,11885287121022283704,262144 --variations-seed-version --mojo-platform-channel-handle=5352 /prefetch:8
    3⤵
    PID:3208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6672,i,14842405202897616477,13161622980918884354,524288 --field-trial-handle=2400,i,6228200761427742697,11885287121022283704,262144 --variations-seed-version --mojo-platform-channel-handle=4428 /prefetch:8
    3⤵
    PID:208
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6720,i,660223303124745262,2252904160244392913,524288 --field-trial-handle=2400,i,6228200761427742697,11885287121022283704,262144 --variations-seed-version --mojo-platform-channel-handle=6716 /prefetch:8
    3⤵
    PID:3972
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6672,i,15343632825591091212,869082263446644197,524288 --field-trial-handle=2400,i,6228200761427742697,11885287121022283704,262144 --variations-seed-version --mojo-platform-channel-handle=6704 /prefetch:8
    3⤵
    PID:1876
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=unzip.mojom.Unzipper --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7028,i,508858970329576037,9352020218928098971,524288 --field-trial-handle=2400,i,6228200761427742697,11885287121022283704,262144 --variations-seed-version --mojo-platform-channel-handle=6700 /prefetch:8
    3⤵
    PID:3984
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7044,i,7939686417310398762,15019668010226962989,524288 --field-trial-handle=2400,i,6228200761427742697,11885287121022283704,262144 --variations-seed-version --mojo-platform-channel-handle=7056 /prefetch:8
    3⤵
    PID:5144
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4356,i,15752387915244365018,1939821615161781671,524288 --field-trial-handle=2400,i,6228200761427742697,11885287121022283704,262144 --variations-seed-version --mojo-platform-channel-handle=120 /prefetch:8
    3⤵
    PID:4476
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4412,i,18225474284681792982,261883795098682111,524288 --field-trial-handle=2400,i,6228200761427742697,11885287121022283704,262144 --variations-seed-version --mojo-platform-channel-handle=4340 /prefetch:8
    3⤵
    PID:6008
- - C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7308,i,12030843480089044894,16989364085814824900,524288 --field-trial-handle=2400,i,6228200761427742697,11885287121022283704,262144 --variations-seed-version --mojo-platform-channel-handle=4400 /prefetch:8
    3⤵
    PID:5992

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

f_0000d5

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000d5
Size 234KB
SHA256 f9b2c93a89f1cac9c08adcd9a95cc35674b5c17e0322c77d23fa3ec5cdfe5bec
MD5 9a7ed54495546ec389375cd7da3ea232
SHA1 ee16faa99b1c34140d424f42e612ea70655eaf1e
SHA512 84a8dbf8d31db248e0c5ab7636717f2bd92c72ab433832ee2ac29455d91e5c2624af437da19e9baef503b16eefd3ff58697bd2aefa7e5213e09b29f2b5eca2e2
SSDEEP 6144:Z8PqzgCNQ3qQ4kl3W1rxGZhdapxsTvndvpUlU8tCW67m:Z8PmgCe3O43W1rmnEERpcRb67m
TLSH
T1DC3423488336254DE70C00B37AF307A67F71D2471A57871B59412A2ADC8E1F7BDA7A3A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_0000d7

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_0000d7
Size 309KB
SHA256 7288f666738af430aa4a9e80d5bedeac41bacbfba60de7df6af9f1c630f5abf9
MD5 187bb96db1ce53482a0ae17b56be0225
SHA1 17e25351633a399d47065e222d5b0b84558229a8
SHA512 48f2439bb3c61c0c2d57201340b4ead72f636d7182a32359346510037eba0110c9b115a159510ade50911d55a86eed57856e4f38a69b86e9867dd47ba4bd612d
SSDEEP 6144:pCUt1hEW6c0gT/0xzXS6fw+FO3VQPiu6Om07dhn4ti4+sgrvnfiGCXwXISwyX4bG:pCK1hEWUgT/0dixVyFPxHnX4+smvqB41
TLSH
T1A46423EFA67D2678DC62EBF56D41E2317260E85A2E10835B589F42460DB3BED0DB0533
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 6KB
SHA256 6095dc25c22f02ca3e182d94b5383adc9e8eb69c80d2f32469c063dd0a4cfd32
MD5 f2ddbf1059f396356e5cd5930472b1bf
SHA1 d1363feee301d992d04b6246eac9a1b0443c2d13
SHA512 cd29109891dd4c795c2cd98be8aa80ac3733e64eb4fa1ded837943539b41b1f3f2cfa9e2b715428d88af0ea08f2dae8229b63594b09d367251f6e9847aafe306
SSDEEP 192:98St7LtENktYYmIKza6NiqStKhrroQDMq6cqNSzH4euU0Dh/Y/nzV+FGWbG7qdP5:KU060rj6
TLSH
T176D18638459D5472DB8A0FB00AE168D2317E69E2F5C74F7BB9945E3628CFF913878204
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe590016.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe590016.TMP
Size 3KB
SHA256 9605c90767e9f54c4742ea585b4d89974d6cc5e2a25c45d1e0f253475a788f2f
MD5 8cbe642b600d7a601b6dcdf2c9bf1f74
SHA1 0249e730d8ed6e40b11da63d8763e15aacbae57d
SHA512 4609bb0bb82923f594478333da6a6960b7d2c21a303f46cce50d0a5a2bcbfbe8f37a8bb0d1014dac65a44ca428b252561de14c29f4a22efe0a9fd463332f13f1
TLSH
T1C461E638091E0871E39A28F156D5320720B6BDEBFA5A5E75C1E49E37211FF25B93D508
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

be0f1f2d-0fca-44c1-aa4f-e95a5c06d6b1.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\be0f1f2d-0fca-44c1-aa4f-e95a5c06d6b1.tmp
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 43bd8264200d3cd4e55d9a0690e0205f17649986b9d4b0d69a46ac4adc65804f
MD5 baedede3ebdbe43fed8925df671dce42
SHA1 a2815bbbef3c24432111b315a3d89406bd71a860
SHA512 02f4548ece1dcfb813ccb4041120eadbf53cbe1d35e30c94ee2c6e62b321c58cbd05d715d9466e1f7ec6241d1daa0e007a8cb729adbe85bba73450be9bc6b9c6
SSDEEP 384:sxZpyMD/fHsg+yMaK+85VHbNOBSXrDVc2qh:sRfD/fz+FHbNOerDXqh
TLSH
T14F82E742662488B7CDCBD519F965BF57DBF504629E900D8CAAFCC91C00EB6FD221682B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 abb9245473b1efba0f56153c04c69df6689ea1161234626647c494d098f47287
MD5 e75f19700393f9b3c1fa422282806e73
SHA1 9050044a8ff6d4c9a0ebe3e2c907f0230bf4ff29
SHA512 08331261190b866327346681c29fdc02f96f07ddcc11d81f8d6a5008333a0505f1b7a3cea3b62112886ef24f8112570b267db7e764f0e1db237016065af21cd4
SSDEEP 768:56cv20wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OV5FLlwmWNWroK6VbU8:56cv20wWvu+Z+u1jaCFLeRNtK6O8
TLSH
T1A5E20B2B280CCB7E4F841E9CED2AAF866DE801CB57988D5447FA494C03C77EB511B49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\08929bc1-762e-47ed-82c9-8d4933a83e18\index-dir\the-real-index
Size 528B
SHA256 92f0a985f2b05cf732ab20bf8b89f2b2fd79c2f2db6525e12697cdc3fd018503
MD5 3cc2cc8e61250865d5c50938b1c73a47
SHA1 d9d81f1ef195f947918929d3675ca249eb102a9b
SHA512 0a3e0aa9e4ccaa6dfaa273dd0148aa6530b2a27b140163d12fe33488505be8ef6bab5e2a5986b34b53e462517024bb1c4333641d71b6d975027348e6cfb468f9
TLSH
T14DF0F1214E910C16D95007B22AF290A4B2704ADCB324D837282D16162C16344749B1DD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe586a8c.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\08929bc1-762e-47ed-82c9-8d4933a83e18\index-dir\the-real-index~RFe586a8c.TMP
Size 528B
SHA256 f8ea5c7d2976906e1ef41f352db1fa96e879b25dfe30400b909f847e9987282b
MD5 9d192197eafa12a2e9d451e08bd43e8d
SHA1 6f9de276b6ce522175e29e68a1402c13b4d4e314
SHA512 c4f48d27e92fb807b44d588c226759748178e012563cef4732c17a8755c111e213d4486ef53c0bd339ef7091e73cf4ef41a40d2491ae7afae9b2143fa2027300
TLSH
T154F0C06987D24C12E45402BF3EF6D6ADF3304C90A369F5B3242E692E6C26BC859471CD
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ef3171eb-710b-4724-b438-3d7977bad9de\index-dir\the-real-index
Size 72B
SHA256 0dee7feb5d373df05a9c9ec37cba8bd4414634721d745ad8c34f3cb9f9a6f6e6
MD5 ba104d5f39b07ace8f5f02ce7b257935
SHA1 9b3a9266d34e067952f1e901f43b54837b130167
SHA512 10ef976a59d068cd4c0f5174c5bf4adecb2a5a474f958d20080b945de2f670eb147b41fdb04dbda45b29c1cc6e9396ee900e4435272f7ba089511600f1761a9f
TLSH
T1E0A0029323C04095D05A11F215536287265188102900125B609502D4CC5C484594500C
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ef3171eb-710b-4724-b438-3d7977bad9de\index-dir\the-real-index
Size 72B
SHA256 9d4f82090fcf10528c6191cc99587b5bec77efeb32091956266065f4b8a83d99
MD5 93f03757899562f5cbd0c06b7a1bacbe
SHA1 6ba96409a144cf12044254f733c34295f90da2fe
SHA512 1780834e561a630c62e989fc14b5dcc63b3d1a3447fdc89147e8ba76d005a129e5a0f5a656c8d54821a6fd3e6a5ecd017b0efc020823926b17455f71171597de
TLSH
T122A002580E830051C50757F0BA9639A92715C9204255134F55938088CC73945CE4281D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 a07a5bdc95e5d938f5c554fdcd49f3afcf0c4cdb283f1c21b8e53c13e70c5158
MD5 b30935026cbfe03a996f0050bcd3e738
SHA1 95aa518005728083c29ea468ccd6918e1a7a9f69
SHA512 ca2db2f7a2afa59be10d2347a24b5fdcc3f202a1bce3ba4f6a0a2fb42e5446947d94ff30a8168237616da5765af5045b8a685f3c23c9ce272ffaf9280ceed915
TLSH
T135A00220CA499022D4364BF0146E61E0B3544DAA51E91723B8B890A9AFEDF8051C5141
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58c186.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58c186.TMP
Size 48B
SHA256 17090bb168e8b2689132bf2e6f7ac766bd2ea07bb9e7ab8048781b971a90f904
MD5 d5cad6c8bac0275a5a2cab64a39fafb9
SHA1 48a8dec70887ae50768263dbcd04f10c87c64473
SHA512 eab1b8cd6341dbf08286257f934670ea71d2dbc663e1c48e96d2282e4e957272356fedb3a04430ed2e0951d2fc380532ff5efdcff5242e8b2b2b3b64eeeff122
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 d59fbca2b1f42db0daa63b83c717c866ede7455eb7f82878119e25a3261c6157
MD5 bda7ed19b81dad68ccfcddefc59d6efd
SHA1 b0c85b270685cb2c1600b562587aa0cabf949646
SHA512 673e14d2dac9baeadf6c9d40e4c146dd3adcd11dd117e9e91686bfb762eae939507d0e3c42042ff36944f84b898f3ad021e63b187cb46cd2bda347da1acc61a7
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDqAoKRef6KcKDyCx:mTLqHPx
TLSH
T146917412313B1292787F6948A3528A368E4636A3380CF56F7BB800B55F27E651DFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

a5e485d3-464d-46e2-a930-eab7b13293dd.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\a5e485d3-464d-46e2-a930-eab7b13293dd.tmp
Size 17KB
SHA256 362a3d209bade77049c25c14242c7574ab9e77384a12ddd16935ae69be26619e
MD5 31854bee409fcf36048aa81680e54efe
SHA1 c3c34bd9435ff472c3b74828554b8c9b3be33ba1
SHA512 dddf52935e92152e6b2b8a789ed0b196f6686e6b207f92e9323d1acd29d597a0d25787c8ff3a3c5688e0db4d07d7676f0704d4ffb5af6e04fa8af36b94f6a307
SSDEEP 384:sxZpXMD/fHsw+WK+8fVHbNOBIH0/UDV3pIqh:sR8D/fj+3HbNOiHGUDReqh
TLSH
T18882D6426A2488B7CDC79519F965BF57D7F50462DE900E8CAAFCC91C04E7AFC221682B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 1b25d2af2b439fe8915f5e7ac9692dbcd967fc43120ed9058639ad0c95702b3f
MD5 f4d3498fffb459bffa127403377afa67
SHA1 c33153b4bc24ef1a9c05df191bbf1867ff5a191b
SHA512 97e1fa52811675f21da8ed7619ba40bb80d4668cb010d2e84ad6b2281891fce4725d3e909f7f94c79cd59cee474c31398ccc42a89bc56766d2aa2647346efac3
SSDEEP 192:zCLsNUJTdZu9N4+YLevCGmiU1yrtZe+CGlOdmchePuCiG1qCgOq:zwsNUJT/u96ziCUze+CMOfIaGDFq
TLSH
T15B423A3568786C27AEE7A506F54B36039FB94177D7893F80D5ED2F1C01DB29C230A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 d61975c70ac1137bcc676b824a2841525071cc2a54979744943f56ded622d162
MD5 abb83f992ff91bb0e39942585e6c7e41
SHA1 9c1fbb56f53ae713d8cf58cf2765358c810ced17
SHA512 934f44d52f3c2976317eab147740a5f2366f7668b550f6399d2db15792353047b5d8eca9bd46853ee65bba8ceba1d91c793789fc745f231ab14e55a0ba581b72
SSDEEP 384:nzZcIhsNUMT/u96ziCyie+CMOfIRGDivB+agoC:rhv6cVkOfIRGDiJlgh
TLSH
T118928D315C785C766EE6D145F98B3A076FB89037D7C92E8084ECAF2C01DF698230B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8e90dade6c711e52b8752871d81a1880786f194431a24a07708891f4d25731f4
MD5 c267de7ebf39608549beca10a2aa1c2a
SHA1 3cfb4f633b62fa5dd4e56c59454d4a88e70eaacf
SHA512 289f1b629f4710f824873befc9d46b739b8354d4fd067d47171db56db7188feae5f11b34797cee3fecdde5ed7ef5549b4710029f02e609767e82118e1cd73ad4
SSDEEP 192:CON96v+YLXQmiUycU+h+CGlOdmchePzCHG1qCU6:CON96vztQ+h+CMOfIAGDU6
TLSH
T1D3120935A8786C6B5EE2A554F48735139FA94237EA857F80D5DC3E1C01DF69C230A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 39bc627476caa240cb6d278e7e9952afd5c417d28ccc6647b5b697b3f584d54f
MD5 395f44f12d31c10149d8649ebbdd1603
SHA1 a7b76a192750f44d64e551f89999e51e0616d203
SHA512 cff03846e3c586744debb792821011da96025c86105af540438d3a495bc553084e2b2a4063119aabafcfa175dad892474d79af5ff0ffa28004b35359fa88d518
SSDEEP 192:JONVh6v+YLNQmiUySUZh+CGlOdmuusGnEU6:JON/6vz/QZh+CMONGEU6
TLSH
T1F502F93579682CAB9FF2AE45F48737275FA8213BE6912F80D9D82E1C01D765C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 435065a7576f3590470e8d91420b358cb9f65f36c5834abe9b27ae35428dae23
MD5 0c614eec70f03c0379bd29b33255d0bd
SHA1 e78d7b79ce79053563c7e6855522351dd71a41ac
SHA512 ea259e5257beb619fa5bce66946fa95a2c50c6a20fa97e06332ae9f1552bab36d4658459c1c4676cff61d4ea43076c77ac4d7bc5eff9411171dc0f30d96fd46c
SSDEEP 384:nxZcIhsNUMT/u96ziCyie+CMOfIRGDivB+agoC:Zhv6cVkOfIRGDiJlgh
TLSH
T1F8828C315C785C766EE6D245F94B36176FB9803797C92E8084EDAF2C01DF698230B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6e4828cf-0986-475d-87c1-ca1ef782a752.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\6e4828cf-0986-475d-87c1-ca1ef782a752.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 b49f22c884c5b889ede33133247a0d53cd96b394f8b9e343ec87b71d57184286
MD5 23237c91015768f043792919a86b8b04
SHA1 43f8e642dce0703cf45cd42c55079906ac101092
SHA512 1166745005a79d382600c64e8c5fdfd8abdd6832ce6b39d6acb61604122c7034e1a91a0fb9295ac693b211f0a62ebd84bc8d6c19c242c7dbe5d522dceb38fae8
TLSH
T14941F849B7F91158B3776E5A9FF6A86E847BBD772E07845E10010E4F0A26B40C871737
MD5 SHA1 SHA512 TLSH

Submit Download

2d39e653-8468-4ad6-88ea-8306860b1ba5.tmp

Path C:\Users\Admin\AppData\Local\Temp\2d39e653-8468-4ad6-88ea-8306860b1ba5.tmp
Size 10KB
SHA256 67d161098be68cd24febc0c7b48f515f199dda72f20ae3bbb97fcf2542bb0550
MD5 78e47dda17341bed7be45dccfd89ac87
SHA1 1afde30e46997452d11e4a2adbbf35cce7a1404f
SHA512 9574a66d3756540479dc955c4057144283e09cae11ce11ebce801053bb48e536e67dc823b91895a9e3ee8d3cb27c065d5e9030c39a26cbf3f201348385b418a5
SSDEEP 192:YEKh1jNlwQbamjq6Bcykrs3kAVg55GzVQM5F+XwsxNv7/lsoltBq0WG4ZeJTmrRb:fKT/BAzA05Gn5F+XV7NNltrWG4kJTm1b
TLSH
T19D32CFB695286380C58EE63D86423BE3130AFBF8CC05F156815069D768A13591B4B8BF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

7c1f6fa7-ba96-48ff-9e86-5bf301b1a873.tmp

Path C:\Users\Admin\AppData\Local\Temp\7c1f6fa7-ba96-48ff-9e86-5bf301b1a873.tmp
Size 1B
SHA256 cdb4ee2aea69cc6a83331bbe96dc2caa9a299d21329efb0336fc02a82e1839a8
MD5 5058f1af8388633f609cadb75a75dc9d
SHA1 3a52ce780950d4d969792a2559cd519d7ee8c727
SHA512 0b61241d7c17bcbb1baee7094d14b7c451efecc7ffcbd92598a0f13d313cc9ebc2a07e61f007baf58fbf94ff9a8695bdd5cae7ce03bbf1e94e93613a00f25f21
MD5 SHA1 SHA512

Submit Download

content_new.js

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3040_1278918116\CRX_INSTALL\content_new.js
Size 10KB
SHA256 d4aa4602a1590a4b8a1bce8b8d670264c9fb532adc97a72bc10c43343650385a
MD5 3de1e7d989c232fc1b58f4e32de15d64
SHA1 42b152ea7e7f31a964914f344543b8bf14b5f558
SHA512 177e5bdf3a1149b0229b6297baf7b122602f7bd753f96aa41ccf2d15b2bcf6af368a39bb20336ccce121645ec097f6bedb94666c74acb6174eb728fbfc43bc2a
SSDEEP 192:+ThBV4L3npstQp6VRtROQGZ0UyVg4jq4HWeGBnUi65Ep4HdlyKyjFN3EbmE1F4fn:+ThBVq3npozftROQIyVfjRZGB365Ey9+
TLSH
T1DB22B68DA5A8ED7C1AC0C952E50EA62E5D342531E6E7A30320874ED8015CFB9D519FFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

c2d71a0a-e2af-4ddf-9853-4e9e832cc4a6.tmp

Path C:\Users\Admin\AppData\Local\Temp\scoped_dir3040_561496367\c2d71a0a-e2af-4ddf-9853-4e9e832cc4a6.tmp
Size 154KB
SHA256 e56c9164b667ad97b0cefcb26e48bcb2b04d8cc1a362ee921f2119a6a8798000
MD5 a922bd2071b7aa9f2154c991d41885c7
SHA1 c88b22d16c951cbb0bfdab367232cf830e0464d1
SHA512 d8ed2d6b1c3a421a9771e3a5109eaea839bf64be7b7e672ed7b8aa47590ff35c6e78aa79712ce37801cedc56db552fc6a7c3ca55004295a438219ce4a8f007a0
SSDEEP 3072:Aj0amyoD1f5NQQHyR5nYbGnkBEGsvsq5UBkUM4RIJ+37HVeCsKkwQuBp/Z:AoHBD15HEYbQkovswoM4RIIzvXkwtBpB
TLSH
T12BF3F11D7EDAC952C40B92BD3C1AB18BC94B8F0A431674CF264D90248EA578E07E5EFD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

default.dic

Path C:\Users\Admin\AppData\Roaming\Microsoft\Spelling\en-US\default.dic
Size 2B
SHA256 b3d510ef04275ca8e698e5b3cbb0ece3949ef9252f0cdc839e9ee347409a2209
MD5 f3b25701fe362ec84616a93a45ce9998
SHA1 d62636d8caec13f04e28442a0a6fa1afeb024bbb
SHA512 98c5f56f3de340690c139e58eb7dac111979f0d4dffe9c4b24ff849510f4b6ffa9fd608c0a3de9ac3c9fd2190f0efaf715309061490f9755a9bfdf1c54ca0d84
MD5 SHA1 SHA512

Submit Download