hxxps://surgepopdownloadfile[.]monster/indexacrtbusa[.]php?flow=75&cid=ZrTHjE4nlGAWOX5Nc2SJIltmhWhFJfOkEzQi1kP9d33&bid=0[.]026281984999999997&source_subid=aad73db0be06c945434a35d2e&keyword=camel1[.]live,camel1,live&ref=camel1[.]live&IP=100[.]1[.]62[.]107&ua=Mozilla/5[.]0%20(Windows%20NT%2010[.]0;%20Win64;%20x64)%20AppleWebKit/537[.]36%20(KHTML,%20like%20Gecko)%20Chrome/150[.]0[.]0[.]0%20Safari/537[.]36

Analysis

user interaction
yes
max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
25/08/2026, 13:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://surgepopdownloadfile.monster/indexacrtbusa.php?flow=75&cid=ZrTHjE4nlGAWOX5Nc2SJIltmhWhFJfOkEzQi1kP9d33&bid=0.026281984999999997&source_subid=aad73db0be06c945434a35d2e&keyword=camel1.live,camel1,live&ref=camel1.live&IP=100.1.62.107&ua=Mozilla/5.0%20(Windows%20NT%2010.0;%20Win64;%20x64)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/150.0.0.0%20Safari/537.36
Sample260825-qargkaseph

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2380	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134321366352405678"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{78F8FA71-D4A3-4AC0-AA5A-DBE44D09B9F5}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4640	msedge.exe
4640	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe
1828	msedge.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 1828 wrote to memory of 4176	1828	msedge.exe	85
PID 1828 wrote to memory of 2380	1828	msedge.exe	86
PID 1828 wrote to memory of 2076	1828	msedge.exe	87
PID 1828 wrote to memory of 2076	1828	msedge.exe	87
PID 1828 wrote to memory of 2076	1828	msedge.exe	87
PID 1828 wrote to memory of 4880	1828	msedge.exe	89
PID 1828 wrote to memory of 4880	1828	msedge.exe	89
PID 1828 wrote to memory of 3796	1828	msedge.exe	90
PID 1828 wrote to memory of 3796	1828	msedge.exe	90
PID 1828 wrote to memory of 5028	1828	msedge.exe	91
PID 1828 wrote to memory of 3796	1828	msedge.exe	90
PID 1828 wrote to memory of 5028	1828	msedge.exe	91
PID 1828 wrote to memory of 5028	1828	msedge.exe	91
PID 1828 wrote to memory of 560	1828	msedge.exe	92
PID 1828 wrote to memory of 5056	1828	msedge.exe	93
PID 1828 wrote to memory of 560	1828	msedge.exe	92
PID 1828 wrote to memory of 560	1828	msedge.exe	92
PID 1828 wrote to memory of 5056	1828	msedge.exe	93
PID 1828 wrote to memory of 5056	1828	msedge.exe	93
PID 1828 wrote to memory of 2812	1828	msedge.exe	97
PID 1828 wrote to memory of 2812	1828	msedge.exe	97
PID 1828 wrote to memory of 2812	1828	msedge.exe	97
PID 1828 wrote to memory of 5084	1828	msedge.exe	99
PID 1828 wrote to memory of 1508	1828	msedge.exe	100
PID 1828 wrote to memory of 5084	1828	msedge.exe	99
PID 1828 wrote to memory of 1508	1828	msedge.exe	100
PID 1828 wrote to memory of 4332	1828	msedge.exe	102
PID 1828 wrote to memory of 4768	1828	msedge.exe	103
PID 1828 wrote to memory of 4768	1828	msedge.exe	103
PID 1828 wrote to memory of 4280	1828	msedge.exe	104
PID 1828 wrote to memory of 4280	1828	msedge.exe	104
PID 1828 wrote to memory of 4596	1828	msedge.exe	116
PID 1828 wrote to memory of 4228	1828	msedge.exe	117
PID 1828 wrote to memory of 1688	1828	msedge.exe	118
PID 1828 wrote to memory of 4992	1828	msedge.exe	120
PID 1828 wrote to memory of 4992	1828	msedge.exe	120
PID 1828 wrote to memory of 4160	1828	msedge.exe	121
PID 1828 wrote to memory of 4160	1828	msedge.exe	121
PID 1828 wrote to memory of 4640	1828	msedge.exe	122

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://surgepopdownloadfile.monster/indexacrtbusa.php?flow=75&cid=ZrTHjE4nlGAWOX5Nc2SJIltmhWhFJfOkEzQi1kP9d33&bid=0.026281984999999997&source_subid=aad73db0be06c945434a35d2e&keyword=camel1.live,camel1,live&ref=camel1.live&IP=100.1.62.107&ua=Mozilla/5.0%20(Windows%20NT%2010.0;%20Win64;%20x64)%20AppleWebKit/537.36%20(KHTML,%20like%20Gecko)%20Chrome/150.0.0.0%20Safari/537.36
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x2e8,0x7ff805eac188,0x7ff805eac194,0x7ff805eac1a0
  2⤵
  PID:4176
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1956,i,11880807628563817207,16995400907138241238,524288 --field-trial-handle=2280,i,18085204383100788858,3953506963674507732,262144 --variations-seed-version --mojo-platform-channel-handle=2316 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1772,i,17713943708446557319,15638823499093135906,262144 --field-trial-handle=2280,i,18085204383100788858,3953506963674507732,262144 --variations-seed-version --mojo-platform-channel-handle=2272 /prefetch:2
  2⤵
  PID:2076
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2552,i,4014162886819341246,15138332544182143479,524288 --field-trial-handle=2280,i,18085204383100788858,3953506963674507732,262144 --variations-seed-version --mojo-platform-channel-handle=2556 /prefetch:8
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3452,i,16799649868176304949,2691314287919545203,2097152 --field-trial-handle=2280,i,18085204383100788858,3953506963674507732,262144 --variations-seed-version --mojo-platform-channel-handle=3456 /prefetch:1
  2⤵
  PID:3796
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,17217113259672821793,14498199355405673355,2097152 --field-trial-handle=2280,i,18085204383100788858,3953506963674507732,262144 --variations-seed-version --mojo-platform-channel-handle=3368 /prefetch:1
  2⤵
  PID:5028
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4204,i,10565503638300099067,7515511597414575987,2097152 --field-trial-handle=2280,i,18085204383100788858,3953506963674507732,262144 --variations-seed-version --mojo-platform-channel-handle=4216 /prefetch:1
  2⤵
  PID:560
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4136,i,15047460949486353059,4054360393673735574,2097152 --field-trial-handle=2280,i,18085204383100788858,3953506963674507732,262144 --variations-seed-version --mojo-platform-channel-handle=4240 /prefetch:2
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3648,i,12009954242938416319,13309895209979313110,2097152 --field-trial-handle=2280,i,18085204383100788858,3953506963674507732,262144 --variations-seed-version --mojo-platform-channel-handle=3712 /prefetch:1
  2⤵
  PID:2812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3456,i,15109696986294188183,11478730413762649135,524288 --field-trial-handle=2280,i,18085204383100788858,3953506963674507732,262144 --variations-seed-version --mojo-platform-channel-handle=5312 /prefetch:8
  2⤵
  PID:5084
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3520,i,4361933003065635806,3208074761893721002,524288 --field-trial-handle=2280,i,18085204383100788858,3953506963674507732,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:8
  2⤵
  PID:1508
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5248,i,10971639038364689940,16556145019127977565,524288 --field-trial-handle=2280,i,18085204383100788858,3953506963674507732,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:8
  2⤵
  PID:4672
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5248,i,10971639038364689940,16556145019127977565,524288 --field-trial-handle=2280,i,18085204383100788858,3953506963674507732,262144 --variations-seed-version --mojo-platform-channel-handle=6020 /prefetch:8
  2⤵
  PID:4332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6300,i,10932278380404828100,8546152472023003843,524288 --field-trial-handle=2280,i,18085204383100788858,3953506963674507732,262144 --variations-seed-version --mojo-platform-channel-handle=6312 /prefetch:8
  2⤵
  PID:4768
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6536,i,18045429522691691043,8221195965589282544,524288 --field-trial-handle=2280,i,18085204383100788858,3953506963674507732,262144 --variations-seed-version --mojo-platform-channel-handle=6532 /prefetch:8
  2⤵
  PID:4280
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4236,i,10060336320603551236,13838712923026409271,524288 --field-trial-handle=2280,i,18085204383100788858,3953506963674507732,262144 --variations-seed-version --mojo-platform-channel-handle=4128 /prefetch:8
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4280,i,13960679106009383719,10582113369068284880,524288 --field-trial-handle=2280,i,18085204383100788858,3953506963674507732,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:8
  2⤵
  PID:4228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4436,i,16009198705417989130,6304199195933579684,524288 --field-trial-handle=2280,i,18085204383100788858,3953506963674507732,262144 --variations-seed-version --mojo-platform-channel-handle=5072 /prefetch:8
  2⤵
  PID:1688
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2828,i,514915833020541516,4096408675210569849,524288 --field-trial-handle=2280,i,18085204383100788858,3953506963674507732,262144 --variations-seed-version --mojo-platform-channel-handle=3656 /prefetch:8
  2⤵
  PID:4992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4272,i,18081361602501959424,10919280292657629546,524288 --field-trial-handle=2280,i,18085204383100788858,3953506963674507732,262144 --variations-seed-version --mojo-platform-channel-handle=4488 /prefetch:8
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5832,i,2044480664238616426,8799378039178039487,262144 --field-trial-handle=2280,i,18085204383100788858,3953506963674507732,262144 --variations-seed-version --mojo-platform-channel-handle=5992 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4640

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 92b83a0e542b7bb3ed324c35b5f2a40c47a6351981065b804e4d9d80ddd6d7ee
MD5 9ea20a12d0c030ae7f84014f382662b7
SHA1 7912569189cf07c1ce092a268e67e9f391b7c8c7
SHA512 39ca414f13163c8479fe7650ae0dd1607b267fe3f319c09aec7bd5f68448e9ac604351069bf6b166b3f897d3afb5d7f35e609b9fc72b9debbcb05bad8fad7d81
TLSH
T132D02B20FF04E002D1072172540047100E0848902093C140E030441CDCEC804D395307
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 7d64d2777f444a09968d6c155732e22d743fcf7c319c222bc06f6bb97808e489
MD5 89bc5edb6bd922f1cf8ec5536b066fa6
SHA1 c50aaf0fe1444780bb68ee7ab6e1c7468c2f303e
SHA512 77a1265c1484940562f1514202a0072e343efb323e1dcdb979fc9b7a2c69d85b814c076828b260c0b86a19e482ebb0a2df850f9b7c130a327861a7c56e26cde8
TLSH
T15CD02B20BF04E402D1072172540047100E0848902093C241E030441CCCED844D395307
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 343458d96b760da14e9378c93db662a280d407b3284bc99a3dcb98fa7867f5b7
MD5 bb87483663bae691baa0c6ee1c99e51a
SHA1 b4a60a14572e38014d70f502b2de893d2a0939ca
SHA512 1126ee6fc8fe2a24d83111ab71a5439c61718377ba001f4763c2cae4c1aaef74a319681806359bd233b42bb33f5909297644c32b3e22e255e69779bdf198688e
TLSH
T14A71E636159305F4EF44C633A9EA824D323785FBF90B9E535490087F2A0636CE75689F
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe589d45.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe589d45.TMP
Size 3KB
SHA256 784e1e8d801b20e63b0a9133d5713c6e94b2947b1a95deca165c521ea8ce71ba
MD5 065fc4bbdedca983da88ee60091f8bb2
SHA1 d74049b919fe10e6061f9803e2ba6aa765fc1c53
SHA512 c986d1753c4f46b0279c19ae2e83092f990de04b0a8053025343732c253e34362b5626973f5f8e6ed32bd1dc3b4b59f8289751331adbb38e6f578d95c57ebf9f
TLSH
T1C271F732145301F4EF40C63398E9824D323781FBF50B9D531490087F290635CE75688F
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\p\Paths\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\File System\000\t\Paths\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

3794f7b8-48b1-48a9-8e76-33649cb5755e.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\3794f7b8-48b1-48a9-8e76-33649cb5755e.tmp
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 177aee7240772f4bed6c15643d518481d51afee0a5b923bb1e811864c3659fca
MD5 3b13e3c86f0563e919de6a827e857d2d
SHA1 4cc29245e8e9f2306637dd8964df797605a8f748
SHA512 c73fe4fb4f8797ce74839c9c9ffd4cb3f5f1bacd83bd86648c15fcf13d5be2ea5cc748c8ff698ea8afd23205a6450b44a100633c045835476e53bd0460d22205
TLSH
T1CF410FF7C3E285ADDE1152F09A00AE1BCE5D0506535C3C5A8AE4FF6B93A3471E102A5F
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 95eaf22a8b03254f2d9447ce31a11165dea6b0cb88bda5eae6b037758a88a866
MD5 ca7ef53a2338e2dcff45acef72f39d06
SHA1 16dc9cb6a030166ee8f2b1e28682fc2091513d4c
SHA512 e59fa8d2cc00e9fdae3c2954bb6d7bf615ef99d1f1d565aa0ed497f166f6013fe2132ec905d156bea06055c3c867658693b89fdaa509b294c47b438d5df16f57
SSDEEP 192:sxZ6RvkO/fisgVwjV0IdpLZ9HW6+WNLIP/z/YvOl53cIgrJ:sxZ6iO/fisgiDTHbsD/LQ9
TLSH
T1C432D8526E38A93B8CC6D209FB19BF53D2F95032A1D15D58AAFC951C04E77DD220B84F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 ccfbd1be8c48d6c17e9c5c7b47a35df33e07e712c9cc08cb96472998f34ee5f6
MD5 1bcfab03d77eb8c6c56e30ac3a52ad52
SHA1 f1c2d5938d2d0d5c280c874b64651757d40328b0
SHA512 39e16cf26b20dfc365236ba7370495aa80ab88f5483e7083291200dff721b9fc7c8454101526520a6147047bb860c64b02083d17ac13050beaa82bf3968769b2
SSDEEP 192:sxZ6RvkO/fisvVwjV0IdpLZ9HW6+WNLIEy2O/z/YvHl53cIg5LJ:sxZ6iO/fisviDTHbsY0/cQ7
TLSH
T19632E9526E34A97B8CC6D209FB19BF53D2F9507291D05E58AAFC8A1C04E77DD220B84F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 11KB
SHA256 3502fe18fb03fc6311c71a3e35ad72138f44ddc3b946dcc05e5c3e23f6d0929c
MD5 d01489854b893e82a7c618e5be89afe4
SHA1 b1d56839ca4685f8b0c16ca497078b6a49c80147
SHA512 546c947e7f3d836144dc80c26b7d7ed1b69e43d2c8865b655251e5dbe5af5986af56930c1d2d5f75096433a131149d916c56a556b7c29420e9bbe0477796c8be
SSDEEP 192:sxZ6RvkO/fisvQwjV0IdpLZ9HW6+WNLIEy2O/z/Yvs/53cIg5pJ:sxZ6iO/fisvhDTHbsY0/fQ9
TLSH
T11932E8526E34A97B8CC6D209FB19BF53D2F9507291C15E58AAFC8A1C04E77CD220B84F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 27KB
SHA256 0a9708171c23b46514f2706bc6dbc38ee531e198b41f899f6294b6358052afe2
MD5 332e23ce18b2b13063addca99f47164b
SHA1 60c6dfd798a41041ef1cc7cade885584f0290713
SHA512 28e51902186850fe38f76dc9479eb2851b14c3783344865f5a4e34c8300a2fdb9c995e23e3c2f47a7e67dd42205c43b44b1ad5b008ac991e36a2319a549a44c7
SSDEEP 768:BEee3rxWvhffn8F1+UoAYDCx9Tuqh0VfUC9xbog/OV4cLly0pbarol:BEee3rxWvhffnu1jatcL88bRl
TLSH
T1CBC2FA2B640CCB7E4F800A9DDC5A6F977FA802C7A7549D4087F9994C02C77EA512A4DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index
Size 72B
SHA256 527fa36609487f15262ac1184b17597b57abc207c3cc8d22b5787da1377fe03b
MD5 7b3821c2ca55782a990c13ad9c9ba9fc
SHA1 d20bfde5a222cd9962fa1b2a8da60389efa6191c
SHA512 8bae043bc6f8f370bf37ee2f2348e46007ba5799b10555cf90d4ab22d91ca91cd7dc680628b4bd0b1e8990dbf0020873ccf5c8e09e43eb71fb640053b05e8055
TLSH
T16BA002500B4ED432E4004A745A7B5140F35689110105524145D0B19DCCE1180634566D
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58a515.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\ScriptCache\index-dir\the-real-index~RFe58a515.TMP
Size 48B
SHA256 2b808800a18a2b7476488778fe0165945a82f024e31a8119e05faaa912ebe92c
MD5 3b6b3d3409e07f658928b96c3f39dbfa
SHA1 a406a91a3e468253415570f929f997e833935ed2
SHA512 9099e155e11c1991adfdf676701ee36f8c8fb7ef8a289a041101c3ba19a6e6f45f3475cf5976a615102152aa9fd95888822edc45cd7c2f182685aaef5f07917f
MD5 SHA1 SHA512

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 c20b89cd0c7980fcf0ac120227209c6cdb8501e1ea3a391867c8fd6f04b1dcb7
MD5 f5d3ca7a3fd937d62f93efc633f6bea0
SHA1 4f03f3b5e75a342f444cf1cf3821d14682a08e19
SHA512 a013e55618b35326fb8cb93412c9fc228d2d1484ceed433b1558f94adde61ea21effadc251ec08bf758b4a1aaaf8871f5996dfe1c5c52b6055f82d7cb55e6682
SSDEEP 48:KYHIhKggkXypqI/Kva47ylVIhKeEUhoIbKJ:KYH+KggmKqcKvaW+VmKeE+oAKJ
TLSH
T14CA11107757A02023CBE2548B29395378E4535A3745CF4AFBFBA04A64E26E110EFE9CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

567161db-6328-440c-9533-095cd997b1c0.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\567161db-6328-440c-9533-095cd997b1c0.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 12KB
SHA256 2de9595098b0708e17909eb22dcdd04724841169c0b35402399676b7dc511c08
MD5 d2150aeb4fe6809cb35bd8704bd66e0c
SHA1 bf36adbe47689112b2001b49f53856ca627c3e3e
SHA512 b9033386567a46d3c2810f64e248596647014a5f941fb1863464924d19d5a6f2fa91808225ebe35989dd6175950682685de8805c5f534c5d8f85b42c7f6f4dbc
SSDEEP 192:uMLsNftQ3vSOel+M73O4QmiU1RIy+4MToqC5TagHFd3E38z1NqZob:PsNft2KVlT7+YDh55+YdU8Mob
TLSH
T188422BB2B8789D779DE3B645F04A37139FB4816B96C45F40A6EC6F1C01DB25C130B91A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 d5b5a28aa3d3726098ac26b762d92b8ee4527a56901d99aafd47f332d8b0fcfc
MD5 49c67f065a53ca21e6fd996a26376bf1
SHA1 40c2a42cdc921cbd312685a603b9de0bbe48e2fe
SHA512 ba04d71c9ed12979a90ffd0f33c655fbbbefa4f9403ad894d35678f9bdbf991ed0134d519fe857948f630ca711cc2e4fd16ab2324a74267b1d7eb242d983095e
SSDEEP 384:ciFiZcIvsNB8TUNTUlIlU2KVlT7+YVh55+YdU+Mz1:HFQvAwgyVpRDYqU+Mz1
TLSH
T1D2B22AF258D7893AD9AEAB43E77D2E134EBCC067B5849940B3D86A0CCC9617FC306915
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 16ff0a625e4b1486099c9978eed08ba7f143147389ce85776961501d86a3b2b2
MD5 e48934c391174a6d4a1113b89d44b5c7
SHA1 49cdf3f2bce466be64a6b47c54db444b5f1ce493
SHA512 557731d49ed7d845e01c8596ce6dd08f9c9fad71f446b576a93dd25be8377fb66afa81be8496a8cbd41b65168c9384592ee9f81494556e7926a555a0972c1b81
SSDEEP 192:lONz6vMtPQmiUyRLThToqC5Ta78479ldU/u:lONz6UtROT+5+7pU/u
TLSH
T115020975AC686C7BDEA7AE45F48A27271FF4116FA5905B40EAE82F1D00D724C130792B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 a5fd10f42c377816aae7172201ee4828c1aaf522dd00fb25dbf27520f65c2454
MD5 30dcdd87ae8f42132f00994a8f228790
SHA1 84c536e18fa15caae212dd97fc68c254c9ed7d6c
SHA512 0694aa408adb3b07d32fce968fcc4a75479c44bb21d88c4cf7130496fd3364ea16032975cffded00ee37c8438c721b7f3a33d7e3a5217a21e17fa52b95d9e05b
SSDEEP 192:CONa6vMEPQmiUyNzLThToqC5TagHFd3Ee80INqZU/u:CONa6UERQT+5+YdU3MU/u
TLSH
T1D9120BB2AC689C2BADA3B541F4CA26175FB4916BEAC49F40F6DC3F1C01DB65C1307916
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 c611b807b7beb4a8686d02a73c8d7d7bee11ce664b1a0ebb3e0e8140dc0a0de9
MD5 b5152a9dc47cc42978e7be6e7ab309b0
SHA1 b1424c522a1b7f408f6d65f648573fcb513fc81b
SHA512 c03d9efc6fdf213c8631782e375e1685744ecfd22db092a2d7b0da4fb452f05570a43a29c6cf0984e93771fc9fe4692b483bb3ce655b0380024dacfccc97fd16
SSDEEP 192:usm+xasuheOwQxMGsNfUQ3vSOel+M73O4QmiU1RIy+4MToqC5TagHFd3E38z1Nq7:0ZcIhsNfU2KVlT7+YDh55+YdU8Mz1
TLSH
T1A8626DB2AC789D3B9DE7F546F48A37135EF48067E6C85E40A5FC7B1D00DA258130791A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

VariationsRuntimeSeedV1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsRuntimeSeedV1
Size 522B
SHA256 532e27b1c35cecf3833a063deb0a05850d18f45002890d4dd9c69509841b7738
MD5 b809bb2b4dca57c6dcf6e141ab343c71
SHA1 3d858fed3e81f1ca3d3c105aaa579c0359654edf
SHA512 089d37cbd8d0d641052a8ffbbf4ee41489551f876cafb2dec05897f131d309580b9872e3493f6cec359efde76d766ef4a7f8ee86fa084740fbcbd049e7f749e6
TLSH
T177F0051380DA34D2EA6B00A0F1446DD4120FA1FA2919B7746975855681986716144736
MD5 SHA1 SHA512 TLSH

Submit Download

VariationsSeedV1

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsSeedV1
Size 1KB
SHA256 d23daf6d5be1deb986ebe2e5af78bdbe905ce7d6694a7420994e6773fecd033c
MD5 2cde333e031b4dd5d99570e959d1f266
SHA1 24a73568a87d1c8ca52d5694b0337652c681c342
SHA512 41cbf05aede8f59b7b4dd42840386e5c37a7d12b671a1ec2aac10c166dcaabd0035acc920902a5fb8933b15fcb464f9a908a7bb4bc690c1b29010b368e95e04a
TLSH
T1C9412A4B0B30B7D0E46EBA832A6F5D6064934F8F65C7F52B093A81B98A7B88AC005049
MD5 SHA1 SHA512 TLSH

Submit Download

VariationsSeedV1~RFe58b88d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\VariationsSeedV1~RFe58b88d.TMP
Size 584B
SHA256 588c51fc6126506176aeea642428a70e7232de14d3a3b0c7fe0fa18d1755e9d0
MD5 9ba2d61b87e8dad7462e469613070933
SHA1 f8854fe4211efb7961bdbf2604a6178b72fde8d2
SHA512 3b4988e42c1da7a2edfb6bb3fe10e502fa0e71a4e926f41dea157a1e6d060eca99178d51980eb948b16eb6e9f3614d04010e83c68aa5122de34bfec45b61bb55
TLSH
T103F04130778A44A2F5F2C56110EFF5816025C87C8E5805A79C2F83ACE236B6C9148B0E
MD5 SHA1 SHA512 TLSH

Submit Download

a7b2685f-59b6-4a0e-8484-47f86342f1ab.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\a7b2685f-59b6-4a0e-8484-47f86342f1ab.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 7635adcf45cb1585c778ab748bc5653dc5af35e20d49de494f1a8ad5c91d5019
MD5 594f8cc02a5851bfd8766acbad30420b
SHA1 b4d7784eb47eb6cf79d7519e57e8a44c8b0ba644
SHA512 a9cdcb05737c93f1e927fc73f0e0649ca56bec840b7fc447d0fcdb86c49f92d030ad775906c78d98d60c32524bd437fe8030ebead903d14ec4c2d86af7ee71eb
TLSH
T1ED412858B6F91148B3B77E5AAFF6A46E487EB8772E06C45E10110E4F0A27A40C871737
MD5 SHA1 SHA512 TLSH

Submit Download