hxxps://recoilscripts[.]com

Analysis

user interaction
yes
max time kernel
899s
max time network
729s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
24/08/2026, 19:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://recoilscripts.com
Sample260824-ypl5dsshjc

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1504	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134320750727458030"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-540052884-2969440504-464782435-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-540052884-2969440504-464782435-1000\{DCDF03DE-E493-494D-8375-B2988FAADFAF}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4352	msedge.exe
4352	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe
4280	msedge.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 4280 wrote to memory of 4816	4280	msedge.exe	83
PID 4280 wrote to memory of 1504	4280	msedge.exe	84
PID 4280 wrote to memory of 4148	4280	msedge.exe	85
PID 4280 wrote to memory of 4148	4280	msedge.exe	85
PID 4280 wrote to memory of 4148	4280	msedge.exe	85
PID 4280 wrote to memory of 4072	4280	msedge.exe	86
PID 4280 wrote to memory of 4072	4280	msedge.exe	86
PID 4280 wrote to memory of 4544	4280	msedge.exe	87
PID 4280 wrote to memory of 3328	4280	msedge.exe	88
PID 4280 wrote to memory of 4544	4280	msedge.exe	87
PID 4280 wrote to memory of 4544	4280	msedge.exe	87
PID 4280 wrote to memory of 3328	4280	msedge.exe	88
PID 4280 wrote to memory of 3328	4280	msedge.exe	88
PID 4280 wrote to memory of 2140	4280	msedge.exe	90
PID 4280 wrote to memory of 2140	4280	msedge.exe	90
PID 4280 wrote to memory of 5056	4280	msedge.exe	91
PID 4280 wrote to memory of 2140	4280	msedge.exe	90
PID 4280 wrote to memory of 5056	4280	msedge.exe	91
PID 4280 wrote to memory of 5056	4280	msedge.exe	91
PID 4280 wrote to memory of 1400	4280	msedge.exe	96
PID 4280 wrote to memory of 4352	4280	msedge.exe	97
PID 4280 wrote to memory of 1400	4280	msedge.exe	96
PID 4280 wrote to memory of 4352	4280	msedge.exe	97
PID 4280 wrote to memory of 4720	4280	msedge.exe	99
PID 4280 wrote to memory of 3372	4280	msedge.exe	116
PID 4280 wrote to memory of 816	4280	msedge.exe	117
PID 4280 wrote to memory of 628	4280	msedge.exe	118
PID 4280 wrote to memory of 712	4280	msedge.exe	121
PID 4280 wrote to memory of 712	4280	msedge.exe	121
PID 4280 wrote to memory of 4352	4280	msedge.exe	124
PID 4280 wrote to memory of 2784	4280	msedge.exe	130
PID 4280 wrote to memory of 4380	4280	msedge.exe	131
PID 4280 wrote to memory of 2784	4280	msedge.exe	130
PID 4280 wrote to memory of 4380	4280	msedge.exe	131
PID 4280 wrote to memory of 1256	4280	msedge.exe	132
PID 4280 wrote to memory of 1256	4280	msedge.exe	132
PID 4280 wrote to memory of 4944	4280	msedge.exe	136
PID 4280 wrote to memory of 4944	4280	msedge.exe	136
PID 4280 wrote to memory of 2732	4280	msedge.exe	137
PID 4280 wrote to memory of 2732	4280	msedge.exe	137
PID 4280 wrote to memory of 4756	4280	msedge.exe	138
PID 4280 wrote to memory of 4756	4280	msedge.exe	138

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://recoilscripts.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff90f1fc188,0x7ff90f1fc194,0x7ff90f1fc1a0
  2⤵
  PID:4816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1892,i,4361153958871561888,15392662215570042807,524288 --field-trial-handle=3008,i,14102734406322167971,7419001865535469028,262144 --variations-seed-version --mojo-platform-channel-handle=3036 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1504
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1748,i,14672181522376014842,13522954674579441042,262144 --field-trial-handle=3008,i,14102734406322167971,7419001865535469028,262144 --variations-seed-version --mojo-platform-channel-handle=3004 /prefetch:2
  2⤵
  PID:4148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2212,i,12204418531766574510,3194341750893074663,524288 --field-trial-handle=3008,i,14102734406322167971,7419001865535469028,262144 --variations-seed-version --mojo-platform-channel-handle=3044 /prefetch:8
  2⤵
  PID:4072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3444,i,17642576494797329890,6923288940809570558,2097152 --field-trial-handle=3008,i,14102734406322167971,7419001865535469028,262144 --variations-seed-version --mojo-platform-channel-handle=3520 /prefetch:1
  2⤵
  PID:4544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,7764772425856647940,11311988737140483734,2097152 --field-trial-handle=3008,i,14102734406322167971,7419001865535469028,262144 --variations-seed-version --mojo-platform-channel-handle=3524 /prefetch:1
  2⤵
  PID:3328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4172,i,12087174145122683967,5548843752423674558,2097152 --field-trial-handle=3008,i,14102734406322167971,7419001865535469028,262144 --variations-seed-version --mojo-platform-channel-handle=4300 /prefetch:1
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4184,i,10966967615787048899,1993191698547575958,2097152 --field-trial-handle=3008,i,14102734406322167971,7419001865535469028,262144 --variations-seed-version --mojo-platform-channel-handle=4308 /prefetch:2
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5128,i,1499186058983544786,13953594849895425819,524288 --field-trial-handle=3008,i,14102734406322167971,7419001865535469028,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:8
  2⤵
  PID:1400
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5124,i,4383423917968146679,13747784091034396033,524288 --field-trial-handle=3008,i,14102734406322167971,7419001865535469028,262144 --variations-seed-version --mojo-platform-channel-handle=5176 /prefetch:8
  2⤵
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,15233470876353808621,18387176993677303253,524288 --field-trial-handle=3008,i,14102734406322167971,7419001865535469028,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:8
  2⤵
  PID:4956
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5944,i,15233470876353808621,18387176993677303253,524288 --field-trial-handle=3008,i,14102734406322167971,7419001865535469028,262144 --variations-seed-version --mojo-platform-channel-handle=5712 /prefetch:8
  2⤵
  PID:4720
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6276,i,12016957689030116480,16296096311141845459,524288 --field-trial-handle=3008,i,14102734406322167971,7419001865535469028,262144 --variations-seed-version --mojo-platform-channel-handle=6320 /prefetch:8
  2⤵
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6252,i,5757845537668198533,53459438413996022,524288 --field-trial-handle=3008,i,14102734406322167971,7419001865535469028,262144 --variations-seed-version --mojo-platform-channel-handle=6340 /prefetch:8
  2⤵
  PID:816
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6248,i,2071156038770131264,11779049095300362306,524288 --field-trial-handle=3008,i,14102734406322167971,7419001865535469028,262144 --variations-seed-version --mojo-platform-channel-handle=6392 /prefetch:8
  2⤵
  PID:628
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6360,i,12034265507935205923,8853313321323189452,524288 --field-trial-handle=3008,i,14102734406322167971,7419001865535469028,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:8
  2⤵
  PID:712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=780,i,15318684280149823376,2424959568322318314,262144 --field-trial-handle=3008,i,14102734406322167971,7419001865535469028,262144 --variations-seed-version --mojo-platform-channel-handle=6216 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4352
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5604,i,9630550891733995091,15518686123046343736,524288 --field-trial-handle=3008,i,14102734406322167971,7419001865535469028,262144 --variations-seed-version --mojo-platform-channel-handle=5496 /prefetch:8
  2⤵
  PID:2784
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5340,i,9841391523854456231,10090949894268842376,524288 --field-trial-handle=3008,i,14102734406322167971,7419001865535469028,262144 --variations-seed-version --mojo-platform-channel-handle=3372 /prefetch:8
  2⤵
  PID:4380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5280,i,5272854899099012166,13057917427194393587,524288 --field-trial-handle=3008,i,14102734406322167971,7419001865535469028,262144 --variations-seed-version --mojo-platform-channel-handle=5216 /prefetch:8
  2⤵
  PID:1256
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5504,i,13226921421592795120,11548982956712009987,524288 --field-trial-handle=3008,i,14102734406322167971,7419001865535469028,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:8
  2⤵
  PID:4944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5432,i,17533456284310195988,15972774122671426166,524288 --field-trial-handle=3008,i,14102734406322167971,7419001865535469028,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:8
  2⤵
  PID:2732
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5152,i,275945180858847653,11102861654180103454,524288 --field-trial-handle=3008,i,14102734406322167971,7419001865535469028,262144 --variations-seed-version --mojo-platform-channel-handle=5340 /prefetch:8
  2⤵
  PID:4756

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1064

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 cc11c2ba3ec4cb292b61dd36af338e083bb0ce5868e654b17f3c58ecf3c8fdfb
MD5 22bfe5ff5070c92c37e54f6f278efd25
SHA1 2fc94025f3a738879f1fcececb95937cbaa0cdd1
SHA512 b57abd220e674cf733b39ea299fc66d6fe964ab448ae0758482efe80597e3678909cd989b9635acc0317001af0fe6dbbbccfd3cf110ec5ad1b9e4c084de22188
TLSH
T16FD09220B719A2C3E24704BA94A6AB52A916C57AA0B7F7017232640CAE65089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 201729318e073e437978c4f830a6df095e397d14193bbab8cb94016e3e0e1540
MD5 038903102cb76ddedd18207430e00005
SHA1 e694b970e01eb43fddfb00d36857e2b64f8c931b
SHA512 bacb50167c8d736bccc259f2ffbffff915c7c6dc188c6c2c1476ded8cbd822ff968f690173d1b8e35c352ec62f9ace3913a556b80bc1a59211be000ee9ea7447
TLSH
T17DD092207759A6C3E24704BA94A5AB52A916C57AA0B7F7027232640CAE66089F28F192
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 d26a0d2113902dc41d794b13b45f1b6cf2c7d71fcc62bb74a7a48f2ff4462c1b
MD5 3ac519e615b5dbce5e001cff17cfe30f
SHA1 e8a0573f9223f84c05420d2d1b8cdc80a4026243
SHA512 b7eaa9e2cc739b6c8c134a4f14ff9e9837819a267043ed333e771fbed8bc4f3d1a57259e1cdeeaa83481de9691b9e4d96d7a0671f4cc412ec5cd95b48d7cb127
TLSH
T1AAE026C506CCC37FAA10A6C76168930CC280370E93CAF99A5704C88D7442A84A2D3AF8
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 1f14264f2a146146bb322b414a2d222ac50111b2deb8b620cc5a0080f5d53c56
MD5 81050aef52b65af9023045201c42b737
SHA1 5bb6670e3df0c761ac04fd03366e562414be6172
SHA512 c5f2f2c8de2cdf3a3f8dcc10b9509eb1aac3abe41d28a9de9c94cdaa5728921beebc0bdbe41488e2a5a014e518d41dbed3345845c7dda364903ac4f3ccc52c03
TLSH
T131E04FD84AEAC36EA605E4CB9368439CC2913A0FD6C8FD9E2B04E48EB541544A3D66B5
MD5 SHA1 SHA512 TLSH

Submit Download

f_000086

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000086
Size 24KB
SHA256 2fe5b21bfcfdfea9a45f9923bd03bdc452362538dcfaa6256d58c5b7b91cab16
MD5 479ba0deb11c3366dea3691a7a021637
SHA1 e7da050fad92b078363509836bc95a1d2770c3da
SHA512 b1ebc8c2b5206ae63522cf35d6c96e80b6d04b0de62296eb1a7c5a22915fca7cba43e45c556b825124475ac5df7dadcbd3400f9fa3c7cda60088aecab01bda27
SSDEEP 768:q35O14DKV/sYy67ZyLcHqlNQ4DnhZfBJVIRa702/MNk:+5o4Diw4KDQ4DnhZ3VI4702r
TLSH
T1FCB2F2FBD49740FB9790F7D76D1A5C52B2236C30CD26ABE3136443020D2A5075B72AB5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 85902610c4cf71ac2d7bee5a1cd42dc5d0d0be96a07a512fb390cb481c17bc04
MD5 83406a402cf4d88941d1c3127d9ba3dd
SHA1 e2908cee18a1ed342099d0d8df18dd47d7ca783e
SHA512 583910bf5c2105d200f13d01d1ad6ecd52f8b036ebd46e0802391c6d02871a1191f24a2219c1a644411b6df222b90452b867c465ea37b05860533fbd317fbb9b
TLSH
T19F71523D192609A1D3A1897278CD12847DB1C9EEFE336DAE0179FA74E50D71B812F0B8
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58970b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58970b.TMP
Size 3KB
SHA256 9084e0bd4634c69e96dbbc3c9bae7c1525ab4683d0ca1db5459c292e9e09218e
MD5 b444c61754920c39e99dc28072d0a855
SHA1 3c43294c9f6f973085a565be98b7eaf4ba162912
SHA512 9fa79b7124473910beb60b32820453b629341ce477cf74fc586ec51f4da193eb59e117ea87a20502fb11e05c3b30b3a41b69d8b8d01d296de783c212add19257
TLSH
T19671523D192609A1D3A1883278CD12857DB1C9EEFE336DAE0179FA74E51D71B812F0B8
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 8215a2901513f2a9033915eaf6e2015e36481eafefb2e76b34f8b79130dee6a7
MD5 4e4f04ec9fd7ed63070bed3a68bdd1fc
SHA1 fcadc8d98ef7e1f6b3d7facfce81cf31a5d430d1
SHA512 ebc02187f65700e544e13d0adbf4c460ff2863c9e6e720b7b6dd462b199dc55640db0c9db254d6a6638245b849a9e97d1dbc0aa6412e4a4bf75523fc9faf3b13
TLSH
T12951ACB3C2E896ADC81112F06A257D17DE2E092443683D5AC5E8FF4FA7F2072E20195F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 c2598049c1d85c159c86d8bfa19f9e2f87841cf49586b76ea3cc67f3afd65c96
MD5 918867d4cf7b32d5b8aab205a29b046c
SHA1 5d29123bf441709e7d60cde3c50404385c9ed705
SHA512 9b614c7cd262d77e0f66e718f720333a47c6b634d59cf7a60005dccdb7fd2546fcf4e3f079222849859832dbf0dd83ce78d98edaf11213ddb663d2a5135824a3
TLSH
T15B41CBB783B486ADC91051F0A914BD17DF6D0424436C7DAAC5E4FF4BA7F2072E242A5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 f88f4fdf1be3acbd567a456c11266869ee11e256e48bbf96ce35eb41400ba9ca
MD5 2cec624c0c5b7d76e7ba5c9a5dce97cf
SHA1 d8d6a13e4a84190e84c6315f28633c4789e4fcfd
SHA512 00fa6fee76083a72cf1dc08fbf9717257fee231f48db52a4d360684d1bd7a06f65dcc15d296c22a1ea8fed1e9fcb80128daabae3a5bb569d787ece14b9208b33
SSDEEP 192:sxZCR1k3/fXsEg2IdpZsLHW6+WNZLXIo/YIEntOIg5uJ:sxZCM3/fXsEg3oHblH/zA
TLSH
T19C22C8126E38A57B8CC7D21DFA15BF13D6F9107291D01E98AAFC961C05E76DE224B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 25KB
SHA256 d0941bccf2e9a8385279b8d7bb17938f1346f4954eeb0e608dc8da9e82263b6e
MD5 c14acbdf7c4f1b82992e4b2348909abd
SHA1 1cdd7a53c51bbb884f8fec4398204dd7ab979262
SHA512 ed830e5e975c8669df8950937dd19499f80be42fd4bedcd715fa60fc5efd1e6c5e63512b6f9656d16ee6e7d107ff70606c34abf26c6521f1c190a339ef53a6b6
SSDEEP 384:sxZCM3/fXsE866s8qMpRiYnazAW8pZS15posJWeT+b7AHbBdMja:s6M3/fR84Mnc7WeT+bMHbTMe
TLSH
T19AB2D505A924C83B9EC35D1CA53C7E33EAEC505222C5DEDA5AECCA1C019E1FDAB4B457
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 3d5aa5c8ead61dcfc4fdc2b251974983963eeae6b7b9a09bf5ff309f77820b82
MD5 990ea643aa4978f0a41dd38469c2bf23
SHA1 af28f4bbc2bcf33cb1d7d0032430a17791578976
SHA512 0056d6516686bd85153c5975d9dc6918dc571c6abea887cf099bbb235fd326fc2bfd4d02220f14c71b04332e9003e9a210cd3d15541da6c6c7371df359757eec
SSDEEP 192:sxZCR1k3/fXsAg2IdpZsLHW6+WNZLXIo/YIEntOIgrJ:sxZCM3/fXsAg3oHblH/z9
TLSH
T16A22C9126E38A57B8CC7D21DFA15BF13D6F9107295D01E98AAFC961C04E76DE220B80F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 856342bff337957270f00ad814e5f721d5903b3c9433b660acc37f442eb65d05
MD5 ac1b2cfa0e8358d5b7580ea3a8c0f162
SHA1 274a8280622dff771c75b4620945539763447c3e
SHA512 9cda7af756e1a1c236837988e2cfd1128ec61a0fffbddaabfd75034026aa8c2916b62117e8f9fb1a0bfae0143a0e53f34ceda8b80b8e0a383c857a0b31246c8a
SSDEEP 192:sxZCR1k3/fXsEHyIdpZsxHW6+WNZLp9fYIhxtOIg5EJ:sxZCM3/fXsEH7mHbZfCa
TLSH
T11C32B8166E28A97B8CC7D25DFB15BF13E6F9103291D11E48A6FC8A1C05E76CD224B80B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 b863cbb1526f5bd10850e68c5daae1db943b3a54840e5ac553595b6ad533b982
MD5 aee7bedcafe951ae70effad7b6afb872
SHA1 77e8789211310fcb3797218eee62f5e73b5542e1
SHA512 4172438a1f68fbe483070faf1dbca88fe01967c1fb14858b17a0d26ed41516c06494607f8656b7f2435a3d5afcb77e591c95a2187a4f115619727b5becc3c3b0
SSDEEP 768:kzyqbblWvJDjT8F1+UoAYDCx9Tuqh0VfUC9xbog/OVE4Ll6AR7brof/B:kzyqbblWvJDjTu1jah4LAs7ofp
TLSH
T1BCC20A3B654CCB7E4FC00A9DED5A6FD73E9802C7A6588D4047FA994C02C73EA512A4CB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ee743e92-8f67-4188-9bcc-a865d9829eff\index-dir\temp-index
Size 1KB
SHA256 39d539cda2ba6000f0bca62bbc9b23805e5e4ad4988030d1ec1408c9e7de52b9
MD5 c256e55a8c8e751e2c0d8ad8a3198b71
SHA1 a806141168691535d22506563697e550264c9997
SHA512 6f86dc146d8234805b89a2ca65e0c2c87fb2ba4bbcb068671381488bf4be15db4eebdc02f38cebf62d3858888e83c9433a2653b70fd1fa8def8254472149cfcc
TLSH
T1782121DD4EA1555FE9A549F31032A1E033B0C9CC6B11E3535C7C32772C223892A4B1C4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ce084.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\ee743e92-8f67-4188-9bcc-a865d9829eff\index-dir\the-real-index~RFe5ce084.TMP
Size 1KB
SHA256 4928ebb6593dc7ce7d71daf2eac9fab7c897fc4f56ea9076df3406262f6e46cc
MD5 f2d7bc443a898895bb1dadbe7f38dffb
SHA1 351ec2068a1fe4f2abbdf8657a083945238850e6
SHA512 da9697faad9e90d0b7adb7e7b4ee45e96d3f217b78948a01160dbffbf0b55cfe1ee0190571af606e6acc5db716224cc6442684c66eb6d6ae40eb0b0551c5efe5
TLSH
T1CC2140CA8B92590FECE054B60653A4F83370C9006322B3D3A879633E5C3579E2E4B0C5
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 5ee01528dfe041ac332d549a75297dac7c61a291cdeaa57aeb2cbb943994fbab
MD5 d38b0b7143a2bd7bd1c7e663bde1fdd0
SHA1 63bebc8b4913f2529b51c9fae2cae04e0709e485
SHA512 bdc73dd36e27484b0d307d7b9def0c43536b6a9754b119328d40c96234e82acc71aed681be045a2a95e9d48d53bdb9c187e94874c56f99616c5f9132c1393b4b
TLSH
T13EE06FBA2AE70800A8ABC7EE087344A64410F828C8A1EC4F1029A28750622B02822C26
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 8b39ab6bbe6b7e9c43825d76e46548b1509a1451de836f7a4c9b3bd7da54efd3
MD5 434c7a80d426279ac6e15c5495724c01
SHA1 d503bfa6efb4bd8bcd76598a61e48b7d2fc3806f
SHA512 4f905e22b7c7fa2cfec0bc43b386377c5ae1d2c356796333ae8d239def3054ecf311ca4252daa8d8cd4c41dbdf07a15460f2fade09b4d017c49fe710ac07af9b
SSDEEP 48:KPYNs4iCiac6vpI9IaKGveOaS4K7H2oTyuEVQUK+agembzIfcgKU1cCgAswpLikX:KYbaKYIKOfuKQY+S2gKnKkQhWCAyE
TLSH
T1CF915916757E0342783D2858B3A69A374F4532A37018A4EF3FB850624E66E224DFDDED
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5933f7.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5933f7.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 f59984d3100ebe181887385d43b62c6e50b5048f5dd36aeda0359a8f7fd073c1
MD5 baf7e3e6ff24c0d6133531a57f1bf99f
SHA1 c3cf7dca4da9532e23e906732bbe0c496cc82b13
SHA512 4ebdc8a55b9e663415acdef1da8b12b1957bad61cf29a7be63c115142f6fb0bedd32e95d33dea077c6588bc11a17351abbc239c5890d6d4e8988228ab7c60e20
SSDEEP 384:8iFiZcICsNn8TUNTUlIlHS6bYt8VRNT6bPfiv1+aXoq:nFQCewgcSHTofidlXZ
TLSH
T1E2C24BF258D7883AD9AD9747E77E2D039EBCC067B588694073D84A1CCC961BFC30A925
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 6e1f53350847b7b2e440558fbef570e3a4191c92315b2bad23dbcd568f7ebf22
MD5 c1f70ceff131f4e1936e633350e0b5fc
SHA1 9e656beaa7463a4bb924ca512c3a06242b6f3787
SHA512 e2e7646f6df69cf8eb08936db5b45f7e54012dd810d197e65a0c31127f9dce92af1450b6b47fb19423f5290425f5ad50e795a7f48fec933374f082097113c87b
SSDEEP 192:ulm+xasuheOwQxMGsNdHQZvkRboDlQmiU1jhz4VRNKFCk5dZc0vdSRzqv5ut4/tP:rZcIhsNdHS6bYj8VRNT6b4fiv1+aXoq
TLSH
T177828D326C345C7B5DF6E144F9873A135FB8906BABCD6E4091ED5B2D00EB998030B92B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 e1215fdab912d637c05de0bd49aaf4881551db5945f038d8901dae656a0a6cc4
MD5 1f8623f31251ffc2376393022dcb198b
SHA1 ee49c1b883feca996eef2bc4f7153485ff520e01
SHA512 ae0275bdecc5c9f54a2055186324ba9d14077a829dd38e10a2776273f68209379e20f033098180718b0f663276f045d2984cc421e37eb7f3caa2c9e1716aa94f
SSDEEP 192:tONb6JkRtQmiUy1DW+RNKFCk5dZDh3QREU6:tONb6Ur2W+RNT6bVnU6
TLSH
T1E802FB35AC386C7B9EF36D05B48737275FA4117BAA952F80D6E81E1C00D765C234693A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 869cc9ab189122c9c6a5330f1f4686b072a63941f666a362abee064c37fc66a0
MD5 a4b3eb488ea16679f8ee048944574ccd
SHA1 7dd1ba94d1351c44033e78068280891ba915c1b6
SHA512 05ab16b4a5767ba6dada4ee806d236a3fd17b0988d332d0f3efa7d966d47f257559a3e89b2924dec0a396cfd336c3385f5925f3457acc778f8546ac0fd04cfb2
SSDEEP 192:uhm+xasuheOwQxMGsNdGQZvkRboDlQmiU1Whz4VRNKFCk5dZc0vdSRzqv5ut4/tP:zZcIhsNdGS6bYY8VRNT6b4fiv1+aXoq
TLSH
T117828D326C345C7B5DF6E144F88736175FB8906BAACD6E4091ED5B2C01EA998030B92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 c40f746f208dee72a433592cb4d9685c7a69fd4403b7378fd8669d892ff83359
MD5 54e59e8442a9603b2c281b0b22e3aee3
SHA1 bbc026c968f71e48493d996295bfdf112b548867
SHA512 37a6708ede30415ddba87a806ea48159a7041ecfef91fd016ff13ff05885a598a70cba1228c6dd1f3d4565307c14fb2486b3ab2530cfe4b55b8bb70dfded7b33
SSDEEP 192:6ONY6JkRDQmiUy0Ds+RNKFCk5dZc0v4Vczqv5uU6:6ONY6U1ls+RNT6brfU6
TLSH
T189120B36A8385C7F9DE2A845F4C736135FA4922BEE897F40D5DC1A1C01EF99C134A92A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

36710e66-174d-48ce-8261-c6a38a66dee7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\36710e66-174d-48ce-8261-c6a38a66dee7.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 fd8b9d278c51594d478353352599e790d1733337eb4b0602ce2d30dbffdefaa7
MD5 49bbf5020d0fca3f23d7b6c8f01441b6
SHA1 9ea943c6c0ca27d4ba0836f0b77edc471e2b9180
SHA512 313f63e3c49353d13437353e4ad098039a742403faf42d298de1b938a4d7e95e364c63b99a67e833375c0e4e89cc75deab14bacc353043e740142864a3b1a537
TLSH
T1EC412748AAFA1148B3B77E5A9BF6A87D447AB8772F16D45E10010D8E0B62E00C972737
MD5 SHA1 SHA512 TLSH

Submit Download