hxxps://singaporehandbook[.]com/how-to-book-an-appointment-at-a-singapore-polyclinic-using-the-app/

Analysis

user interaction
yes
max time kernel
900s
max time network
730s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/08/2026, 03:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://singaporehandbook.com/how-to-book-an-appointment-at-a-singapore-polyclinic-using-the-app/
Sample260825-dlntlaweke

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2516	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134321009829035817"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-204488895-2999877624-296153668-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-204488895-2999877624-296153668-1000\{7777A5CA-8BFC-4458-B3AA-03E3B44CD8B1}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3544	msedge.exe
3544	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 5 IoCs

pid	Process
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe
2768	msedge.exe

Suspicious use of WriteProcessMemory 44 IoCs

description	pid	Process	procid_target
PID 2768 wrote to memory of 740	2768	msedge.exe	86
PID 2768 wrote to memory of 2516	2768	msedge.exe	87
PID 2768 wrote to memory of 2104	2768	msedge.exe	88
PID 2768 wrote to memory of 1640	2768	msedge.exe	90
PID 2768 wrote to memory of 2104	2768	msedge.exe	88
PID 2768 wrote to memory of 2104	2768	msedge.exe	88
PID 2768 wrote to memory of 1640	2768	msedge.exe	90
PID 2768 wrote to memory of 2968	2768	msedge.exe	91
PID 2768 wrote to memory of 2968	2768	msedge.exe	91
PID 2768 wrote to memory of 2968	2768	msedge.exe	91
PID 2768 wrote to memory of 3676	2768	msedge.exe	92
PID 2768 wrote to memory of 3676	2768	msedge.exe	92
PID 2768 wrote to memory of 3676	2768	msedge.exe	92
PID 2768 wrote to memory of 1812	2768	msedge.exe	93
PID 2768 wrote to memory of 1812	2768	msedge.exe	93
PID 2768 wrote to memory of 1812	2768	msedge.exe	93
PID 2768 wrote to memory of 4016	2768	msedge.exe	94
PID 2768 wrote to memory of 4016	2768	msedge.exe	94
PID 2768 wrote to memory of 4016	2768	msedge.exe	94
PID 2768 wrote to memory of 4696	2768	msedge.exe	98
PID 2768 wrote to memory of 5032	2768	msedge.exe	99
PID 2768 wrote to memory of 4696	2768	msedge.exe	98
PID 2768 wrote to memory of 5032	2768	msedge.exe	99
PID 2768 wrote to memory of 5016	2768	msedge.exe	101
PID 2768 wrote to memory of 616	2768	msedge.exe	112
PID 2768 wrote to memory of 4964	2768	msedge.exe	113
PID 2768 wrote to memory of 1956	2768	msedge.exe	114
PID 2768 wrote to memory of 1184	2768	msedge.exe	116
PID 2768 wrote to memory of 1184	2768	msedge.exe	116
PID 2768 wrote to memory of 5104	2768	msedge.exe	117
PID 2768 wrote to memory of 5104	2768	msedge.exe	117
PID 2768 wrote to memory of 3544	2768	msedge.exe	118
PID 2768 wrote to memory of 5036	2768	msedge.exe	121
PID 2768 wrote to memory of 5036	2768	msedge.exe	121
PID 2768 wrote to memory of 2064	2768	msedge.exe	122
PID 2768 wrote to memory of 2064	2768	msedge.exe	122
PID 2768 wrote to memory of 2744	2768	msedge.exe	123
PID 2768 wrote to memory of 2744	2768	msedge.exe	123
PID 2768 wrote to memory of 456	2768	msedge.exe	124
PID 2768 wrote to memory of 456	2768	msedge.exe	124
PID 2768 wrote to memory of 1508	2768	msedge.exe	125
PID 2768 wrote to memory of 1508	2768	msedge.exe	125
PID 2768 wrote to memory of 1604	2768	msedge.exe	130
PID 2768 wrote to memory of 1604	2768	msedge.exe	130

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://singaporehandbook.com/how-to-book-an-appointment-at-a-singapore-polyclinic-using-the-app/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff90992c188,0x7ff90992c194,0x7ff90992c1a0
  2⤵
  PID:740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1964,i,4024441049007077089,219284958968713696,524288 --field-trial-handle=2304,i,9041847289393482590,12364948546034047817,262144 --variations-seed-version --mojo-platform-channel-handle=2332 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1648,i,17136476205668534397,14552438867090923341,262144 --field-trial-handle=2304,i,9041847289393482590,12364948546034047817,262144 --variations-seed-version --mojo-platform-channel-handle=2300 /prefetch:2
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2424,i,1556914573272603180,11379731450551023701,524288 --field-trial-handle=2304,i,9041847289393482590,12364948546034047817,262144 --variations-seed-version --mojo-platform-channel-handle=3192 /prefetch:8
  2⤵
  PID:1640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3480,i,13508745993027923262,13743551506083549072,2097152 --field-trial-handle=2304,i,9041847289393482590,12364948546034047817,262144 --variations-seed-version --mojo-platform-channel-handle=3556 /prefetch:1
  2⤵
  PID:2968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3484,i,9037619865817831737,8310303184950985232,2097152 --field-trial-handle=2304,i,9041847289393482590,12364948546034047817,262144 --variations-seed-version --mojo-platform-channel-handle=3608 /prefetch:1
  2⤵
  PID:3676
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4192,i,4762194414644357713,16372541590360790418,2097152 --field-trial-handle=2304,i,9041847289393482590,12364948546034047817,262144 --variations-seed-version --mojo-platform-channel-handle=4256 /prefetch:1
  2⤵
  PID:1812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4232,i,8587961662482556533,2524509210553628726,2097152 --field-trial-handle=2304,i,9041847289393482590,12364948546034047817,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:2
  2⤵
  PID:4016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,10398613033688220188,14252932430041519077,524288 --field-trial-handle=2304,i,9041847289393482590,12364948546034047817,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5064,i,10000730631261082226,18025968567006966188,524288 --field-trial-handle=2304,i,9041847289393482590,12364948546034047817,262144 --variations-seed-version --mojo-platform-channel-handle=5200 /prefetch:8
  2⤵
  PID:5032
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5540,i,3088061385534704372,17549607330861422611,524288 --field-trial-handle=2304,i,9041847289393482590,12364948546034047817,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  PID:2532
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5540,i,3088061385534704372,17549607330861422611,524288 --field-trial-handle=2304,i,9041847289393482590,12364948546034047817,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  PID:5016
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4988,i,2915560530851341874,13231824075349008919,524288 --field-trial-handle=2304,i,9041847289393482590,12364948546034047817,262144 --variations-seed-version --mojo-platform-channel-handle=4260 /prefetch:8
  2⤵
  PID:616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5000,i,16859080241183701063,4203675169644815888,524288 --field-trial-handle=2304,i,9041847289393482590,12364948546034047817,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:8
  2⤵
  PID:4964
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5004,i,10038275662639158093,4429349151227594516,524288 --field-trial-handle=2304,i,9041847289393482590,12364948546034047817,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:8
  2⤵
  PID:1956
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5412,i,7324878356187931220,7516688424131515194,524288 --field-trial-handle=2304,i,9041847289393482590,12364948546034047817,262144 --variations-seed-version --mojo-platform-channel-handle=5392 /prefetch:8
  2⤵
  PID:1184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5108,i,15393167838586733650,7868249913030669515,524288 --field-trial-handle=2304,i,9041847289393482590,12364948546034047817,262144 --variations-seed-version --mojo-platform-channel-handle=5376 /prefetch:8
  2⤵
  PID:5104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5296,i,16713956022326789095,14610176267833664936,262144 --field-trial-handle=2304,i,9041847289393482590,12364948546034047817,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:3544
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5500,i,7207617085751561812,5866550703055310590,524288 --field-trial-handle=2304,i,9041847289393482590,12364948546034047817,262144 --variations-seed-version --mojo-platform-channel-handle=5516 /prefetch:8
  2⤵
  PID:5036
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6504,i,11526500641129561930,16243806362037002078,524288 --field-trial-handle=2304,i,9041847289393482590,12364948546034047817,262144 --variations-seed-version --mojo-platform-channel-handle=1532 /prefetch:8
  2⤵
  PID:2064
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6536,i,12073304514202920018,8308331186558525637,524288 --field-trial-handle=2304,i,9041847289393482590,12364948546034047817,262144 --variations-seed-version --mojo-platform-channel-handle=5220 /prefetch:8
  2⤵
  PID:2744
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2220,i,13591450863025704792,2363483377482775325,524288 --field-trial-handle=2304,i,9041847289393482590,12364948546034047817,262144 --variations-seed-version --mojo-platform-channel-handle=6428 /prefetch:8
  2⤵
  PID:456
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1048,i,4183517882434828564,275600371517981386,524288 --field-trial-handle=2304,i,9041847289393482590,12364948546034047817,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:8
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2860,i,16337008070110702663,13013195410512131004,524288 --field-trial-handle=2304,i,9041847289393482590,12364948546034047817,262144 --variations-seed-version --mojo-platform-channel-handle=2704 /prefetch:8
  2⤵
  PID:1604

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4940

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ab98da7535c8de464335204ae97fd672936e639269325c3a388b3039d8396b83
MD5 1656a3560c7aeae221756f3891b89fd3
SHA1 e48441fe2b843ba3bd0bb7799c07b22a27db8eb7
SHA512 c06d7152d11e33601716d4c5c33c7373ac4e0c16571e80ac4a8ffb9cabb52fae51d4fe8d808fc75be943287b55a320e90a186d71a5f06e9db006f6ab89266400
TLSH
T1CFD09B307B597042D3074031E8074790169E84B5249B86066554410D7D5A485E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 ec6419a915c6f94199df67c6cf1d67bc666c22ef160c8377d6792913a6518679
MD5 a8d0099e5966b86c13c6997282a63770
SHA1 df541b93a0caebe364906ec90c768bb625495f4c
SHA512 a2093c42c3f547b910f560ee7a58cb187cef96045e8e335276c7bde87fdc5e9894b670421e94170d0878e86a2bea8125d914e11181882004f966732f9670a693
TLSH
T135D09B303B597442D7074031E8064790169E84B5249BC7076554410D7D5B4C5E3DF547
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 4f8e7884185c19901cbb73ebf659883815909cb5a37e7d7c4b11bbfb87b880b7
MD5 7e545b5936c3a5347aed2a812b727933
SHA1 2441db241778c7969262aed3c68e598ccd14964d
SHA512 e14f0ea15b9f61df74336764c9af1ade793ee29fee7a25bec5ad10e0389671eced9ee87f5c1de9f7a3456ceedbc77fb829b2bdded362aaf64629daad224c8394
TLSH
T1A2E07DE40AC8C23EBA4174476968CB0DC280360FD2CCAEBA3701C8CA7301244B3C7790
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 e8576beb61bc36064c25d758c2f67043debf36970c4ee517839f685c81326051
MD5 752b3d6a7f206a7dd8746690e18715e5
SHA1 69f4ae594af4b589e82b3cb3f590dc9588c3f3a8
SHA512 a2b2d556e60fb7488bad1e68c7ecefa32e9b5dceeda772d87717578b9c46dec0f883c3dc48af58981f912ccfd551755c404fc17aa90f1f50dcb6c801ebb5dc3b
TLSH
T18DE026E405C8C32EAB8064875178A74E82A03ECEA3C8A92A2B00C89C7181544BBB67D1
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 331B
SHA256 77d937aaaa63722928de72a5dc38772a0d16981023b5abcc3b97b273cc105fa2
MD5 cd407d862750a22c5ad2804548311f25
SHA1 47ebbc685907837ab1138ceeedfb500ec70cc461
SHA512 173e0ba0e7c3c30de76255d5774c38f88840065fbbdc942480c17d947a0a1a9898bdbc805915304dc5d8300d7b42410361bb63f93ef121b81334cf427716bef9
TLSH
T16EE0CDA8C5C9D2BEA7446947B57C878C82B03A0BDAC8AD5E1704CE8D7183644B7D27E4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 573b360864b28d8fa07ead7eb3794dd1b8a5c21e2d2d37a2b198e6c1f84f33ad
MD5 99cfc04030d55ad09686a70ae4ffbdcc
SHA1 f06c9500e7f41a5b2c0922f90712febabc8d94fd
SHA512 abd004413985745c805289b163534afe4e545a4de6907646d95554177ff808d9ea9b9fd2f5dcaa09af7e98d5b7737ad8daf89a8cfdd15caf56282eff61277587
TLSH
T16E81E6318186CCADEB1D04B06CD141F370728DE9F90B6E9BE1BC2E741926BA3B19B549
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a0b0.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58a0b0.TMP
Size 3KB
SHA256 1add2642b9527f5d0c12f323f8e3acb5daf19a96069ba2c1ed43c6a084de384e
MD5 d89a6dc08f0e894b506649a03cafede4
SHA1 bdb8b86152569b701ce60707216af29e0b0ce05c
SHA512 f97b1cdd90ba3e071d3ab4b5c50bbcbef940cb24cc07aa31cc4c7b47f91bba40eb533bdee76c60d4ad9c601ae825bc241a4330a9eec89c4195b3bb56c4221952
TLSH
T19A714C360087DCAEE71D00706CD181F374718DEAFD475E9B91BC2EB41A16B63B22B588
MD5 SHA1 SHA512 TLSH

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 23dfeafdfd1450afab6975de3a2d3e47a9a66764e0d593bffe9a87885e9f8193
MD5 56684909d0d00021e65c19dbe23af9ef
SHA1 41a004c7ca40a94d85779bf41530be7605c5c233
SHA512 0d71a5fa8381da0d0be97ae7c4402bfc888b26f16f4ebd4a12beecd411e98d338fd52d293ed393b9f8e89296193dfe963b048179f38dee6ab554ddd77a07941f
TLSH
T1E041DDB3C7E4922DC94156F0EA14AE17CE6D0A40832C7C9AC9D4BF17A7F25B1D10196F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 776a523f08070e7a5fe884f0cd2888106cd4d459cdb1939cdee4eecefc104ba5
MD5 ce32777113eceffc82d1ada5aab49ea1
SHA1 2c24d9c78e6eb3cb77211d3f7b2c09c47448ed1b
SHA512 26dce0184eb82c9a3b751aa204d268acd02b9b99bace18438911d00935025ad580735dbcb5c3ae1d8469f8be566b8754ff093f66c45ad6344f9a5d0df9e674cc
TLSH
T1EE41CDB3C7E4925DD94156F0EA18AE17CE5C0640832C7C9AC9D4BF17A7E30B1D101A6B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 e57736a2c16f007a3987de2ac9cbc3f4cc92af49a76239942c2ea5f89a16b9fa
MD5 7c91d60f3fee4f43e625cf5ee62909b9
SHA1 0937d84dcb0cf46186dc0b9c8e68b8b0939212fa
SHA512 5261b6a59ae15fd558833b0f9e9048ea57e9b3d15be5be0a3055c0eea2b700db32733e748f0a1da75f32fecfec25de8bc8e4dfe56e0d7ea72541ce29b67ea5f1
SSDEEP 192:sxZu9Rjku/fwsYxSe4bIdpu1HW6+WN9eN/YzuPbpIgrJ:sxZu9qu/fwsZezOHbO/h9
TLSH
T1462295526E38A97B8CC6D219FB15BF13E6F9103291D41E58A6FDC61C05E7ADD220B80B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 25KB
SHA256 a60236921f3cf896a179f1e55d234e9a544ffdb58001ab0424cbb3fee91e5a6f
MD5 f3d48e8adad5df78f5b568eb95f0ef04
SHA1 8f318582650496269e1ce64eff6f42993a023343
SHA512 e9c1fb8cc81c16e9914baa7151daa883b20b9bd3d3d0cbe59f278ec07b6be0ad6e70af368bb2ff885d3c6b39a60c93babafa62ef21efd5ed3107d7e88a6856c0
SSDEEP 384:sxZu9qu/fwszP66s8qMpRiYnazAW8pZS15posJWeT+mz0HbOXrH:sW9qu/fPP4Mnc7WeT+mIHboL
TLSH
T1ACC21805A924D83B9EC35D18A53D7E33EAEC506212C5CEDA5AFCCA1C019E1FDAB4B417
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 b4a48ae1280af1be2bd6fdea9118db71525c4ab2b1a067dd02274ea2af4f9364
MD5 d015c2df2121a6d32b09e018f45beb50
SHA1 28f13b1a712b6faaa2ab9fc7116ac7767d07fbd7
SHA512 50597cfe2ef6764523ca957c0ab7e35bd064c113bf4482bf4ef0c6b8768cd98056fbb1cd340c52ae090285c6e1b82c79df4c7ce6be4b8d16b2b7990a6aa517b5
SSDEEP 192:sxZu9Rjku/fwsKxSy4bIdpu1HW6+WN9eN/YzZlbpIg5vJ:sxZu9qu/fwszyzOHbO/6H
TLSH
T14F32A7566E28A97B8CC7D609FB15BF13E6F9503291D01E44A6FCC61C05E7BDD220B80B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 10KB
SHA256 3d114e9826891325750607bfa87f546500d5b37b1463f4309fcd6d8645a5d551
MD5 8dcc5d72037a55273e770ba0d0afd101
SHA1 947aa9aca8c8a7f998bba4c14160225279ad959e
SHA512 b8d4c43f6e1919a4195f976007aed0e1bf2890ac1335e705187c8cdbf84a22bcb8a2f7caa8a1510c4b1abb15f0b7fc1a2a3a85d06761d5fa704dbcc7057fa84a
SSDEEP 192:sxZu9Rjku/fwsKxSe4bIdpu1HW6+WN9eN/YzuPbpIg5FJ:sxZu9qu/fwszezOHbO/hh
TLSH
T1AE22A7566E38A97B4CC6D219FB15BF13E6F9103291D41E58A6FCC61C05E7ADD220B80B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 2d62ecb162a914883ee6edbc791b6295e1b564f23d55aa1430b66f6e76858761
MD5 a2d5d7554adbc1230b3bec267f46536a
SHA1 fb5945433d621cb08651e5f60615f2d7bfdf81cc
SHA512 a384b61bc1f0bfb5f44ef194e443874b8e53b064bdce86005bfcf38c7950e342515cddb1c147acdd65ad1138ac301df1d51537ec1f058b0e424ddfe73fb772be
SSDEEP 768:hhk7u70WvqiEa8F1+UoAYDCx9Tuqh0VfUC9xbog/OV35LlWYSBKroyBGYU:hhk7u70WvqiEau1jai5LA3Bh2U
TLSH
T14FC2E83B740CCB7E4F801E9DAD566F973E9802C7A6988D4087FA994C02C77EA51264DF
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4520dadc-db5b-4f2e-9026-0b551f142464\index-dir\temp-index
Size 1KB
SHA256 dc306001b240db07ba33334fbaf6abc17086091c17d63a0fec4da91bbeb4cb22
MD5 c839038de2b7a1b2e851a52400029064
SHA1 150635a12f4a6c56f8a5cf6d775fbb7e84455b88
SHA512 30a2851ca929e63357226837c80c9281d2471afd45a10fad69997fba776e9e17c6f3785bd473d7f44bb83f48b0ac2b1f161e05aa82bfa33c672e48fa4ee60b06
TLSH
T1472125898E91956FEAE485F2107775E53371D9CC2712A3934C3C72352C233592E5F1C4
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5ce537.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\4520dadc-db5b-4f2e-9026-0b551f142464\index-dir\the-real-index~RFe5ce537.TMP
Size 1KB
SHA256 95ad38498d15b7ff2ae01affaed7f00fd2db3a5714e8798bab031bcc43775859
MD5 559b786d9f9cf6b26a9677b0c6207c39
SHA1 901983b3f6401737acc3938a3ae5e64c5d53b738
SHA512 3e3f265836f165f05ee80bdf19ce3e67c2d90d3dbaf5af551c2068e7f0aa8d1bcbb45d52850f256b0ccda41470debe24a835f47464e9fd923501468003c9d739
TLSH
T1D4211C8A8A92590FE8E085B60552A4B83375C900A722B3D3983D623A5C3979E6E4F0C5
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 2fa378e5ff212d5b5b1cf07a91d58661ea1908ab82f17e050f4d2aef2f67f38e
MD5 2a6230722a370d2bd529e6f4606f6f85
SHA1 d4e26f31e8006c5de15dbc4725510eeee7447982
SHA512 100736e1d11f1b7e9bc47c0f4ce40b993625aaebacd988c12d0933edf8e6a69aae33693378a7806a16a7ba18f32c8cc2ad84fe89bcc2e7deab28e3fee147f94a
TLSH
T1C2E0D8BB2DFB1824AC7F97D538B1A5A1858539589514EC4E3167A29770F2761280AC21
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 b7f4aacfb2d8056483b5ec199ce73f121d9d65612968df5fb88b6cb2e2dfa597
MD5 1819ecf59cf5df717ca7702140866afc
SHA1 430f3e0fcb9c42eca212bd687a2f7d4636af9bef
SHA512 81b9925a877af7c8642e700c4933792488d63684d9ba73f4ae754a4a4460b332e82a1ab7f1a8218559c95d1e3cbecd93e69902526213a81b58660c3702989162
SSDEEP 48:KfSVOyIQA2aQL9IZy2KYTvNIZKWcMKOIXK/K8TyZ4I/KpD:KIbCKcvNSKWclOgK/Ka64IKpD
TLSH
T10991860D32BB02803DBF684C95968A676E8239533018A96F7B7404629FE7E114EFC6DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe593406.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe593406.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 2d8686d2e4aa30ee815ec35f680661a05c1368b6528db8a4f2dc309b1fba32a5
MD5 09d549f93a4a84e2edc43ea44707077c
SHA1 358bd4ea518c8cbc337bd92563d1ee6a2bcf6403
SHA512 063775564531c0f6293d75ba8da42be64944fb9befbcd4e2e0547ec1a10f02a320166f1b4b0110cc9ef5134b70a5860e6453ceffd6e6c633d3999fa81c5c54be
SSDEEP 384:3iFiZcILsNn8TUNTUlIlNib8a9p7LCyPWivcHov:yFQLKwgW/hfuikI
TLSH
T145C239F248D7983AD9AE9743E77D2D074EBCC067B5849A40B3C89A1CCC9A1BFD306915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 f05419e35526d61f6134b8b6b987ba4aa9653513728f1440a738cb0ab8349744
MD5 20e01007d90e74edd9028cc3aa73aece
SHA1 b979aecd17f0cf278ec307ec1ce435f73587c346
SHA512 591fdfc1ffff8f872ab5b5a4aea32915d22e49e59c12346ed8a5d6bb895b6a3f1dae51d59f425308e866408d63d5833f3154ee4b1466001f76691fc0b6074e8a
SSDEEP 192:MONx64BAQmiUyC19W5GBPKIOCHruaDmjU6:MONx6eAJXW8LLMU6
TLSH
T1E1020B39AC797C7B9EA2AD05F88637175FE8112BB5945F44EAE45B1C00D764C230392B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 454e06ddf3a19a8ba427fd8040fbbea0b07a3b14f24bf149d323f6b7b81e2a58
MD5 b9eecf965554ed136011c754ede66f19
SHA1 dab9bc5ac2f829e1e1c8348b0f61fa54e0f75766
SHA512 765f7c254e5cf556764190134813ffc86f072470a5be6422e9076afa977a6cb28297a3c6a7db6bcf46f540fc84f1a82dd08d3444148b7b29d2132b926154975f
SSDEEP 192:uim+xasuheOwQxMGsNdVfQ4GBbatQmiU1AVMm4aGBPKIOCHrWTPNZdNPbqlt4/tn:wZcIhsNdNib8aap7LC1PWivcHov
TLSH
T165829E76ACB56C3A1DA6E140F58A36075FBC8027E6C86E40D6ECEB2D01EF5992307917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 8cb5fb5736a55ab0213a387d5008efa5be58cef6210318e7bb836e298cdc60aa
MD5 a0f51094fcb125fbc987b0d351d9d305
SHA1 e455b3f26cac21ab14cfc675890f5ca0d4aa1dcf
SHA512 bda0d5ae84012236e46877ee873856c024b433648135fda18b9af07f147122a43e625811a82646df5f3c44f87c6878f65ed83799ee0c29f5bbf4d6fe6822efe4
SSDEEP 192:uxm+xasuheOwQxMGsNd2fQ4GBbatQmiU1AVMm4aGBPKIOCHrWTPNZdNPbqlt4/tn:fZcIhsNdwib8aap7LC1PWivcHov
TLSH
T1CF829E729CB46C3A1DA6E140F58A36075FBC8027E6C8AE40D5ECEB2D01EF5992307917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 49bfff2211d72d3d1d99d52dc5a9bfafc05fd25b6280d8160fef303eb66f1eaf
MD5 6ff4c3f412056c5dac77a39db75e0b95
SHA1 524f2d1d67c8ee282bb0420069a4d6e58c579f78
SHA512 3e414a87f2106c4e5922160c3973359ec3b2f2c473e53ac016fb915ddcc2e51f5ca37ce1e134313a35bcc6f8404f619713ed53a58167c8084eabef7ad49f9624
SSDEEP 192:DONI64BMQmiUy0y9L5GBPKIOCHrWTPNmWwPbqlU6:DONI6ecpoL8LCEPWU6
TLSH
T12F121B36ECA5BC2E5E92A541F4C636035FA9422BF6846F40EADC7A1C01EF65C230691B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

e61f5705-6a54-4e23-8eeb-c70e426f38c6.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\e61f5705-6a54-4e23-8eeb-c70e426f38c6.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 930960736b3e9cfb846db2c8bf978220d8deb24a09efe286b27c3cd4f6d0dd9a
MD5 5782683ef7c5b4ad65aed6c84d3ae66c
SHA1 5e1d26bfe88423c19f8dd9b985ca3145ccc79d32
SHA512 551e751331e90ca7e7e757a378a17d50cc0e0bae53da3efd5de567c2ae80eb43c91c5c6f491134d602eb20b7f08655e8bc1878e1bf4dc7e4ba9c870aae84b385
TLSH
T1B0412858A6F91148B7B76E5A9FF6A86D487ABD772F0BC45E00010E4F0673A40C861737
MD5 SHA1 SHA512 TLSH

Submit Download