hxxp://www[.]blastoffaustralia[.]com

Analysis

max time kernel
899s
max time network
903s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
25/08/2026, 18:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
http://www.blastoffaustralia.com
Sample260825-w7pbcsdn2y

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
2228	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134321564541541652"	msedge.exe

Modifies registry class 8 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2058276091-3280583803-376660292-1000\{DD52711F-713A-4F0B-8A74-1798E35A9A0D}	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-2058276091-3280583803-376660292-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2564	msedge.exe
2564	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe
3868	msedge.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 3868 wrote to memory of 2716	3868	msedge.exe	83
PID 3868 wrote to memory of 2228	3868	msedge.exe	84
PID 3868 wrote to memory of 4324	3868	msedge.exe	85
PID 3868 wrote to memory of 4324	3868	msedge.exe	85
PID 3868 wrote to memory of 4324	3868	msedge.exe	85
PID 3868 wrote to memory of 2068	3868	msedge.exe	86
PID 3868 wrote to memory of 2068	3868	msedge.exe	86
PID 3868 wrote to memory of 3740	3868	msedge.exe	88
PID 3868 wrote to memory of 4112	3868	msedge.exe	89
PID 3868 wrote to memory of 3740	3868	msedge.exe	88
PID 3868 wrote to memory of 3740	3868	msedge.exe	88
PID 3868 wrote to memory of 4112	3868	msedge.exe	89
PID 3868 wrote to memory of 4112	3868	msedge.exe	89
PID 3868 wrote to memory of 904	3868	msedge.exe	90
PID 3868 wrote to memory of 904	3868	msedge.exe	90
PID 3868 wrote to memory of 2148	3868	msedge.exe	91
PID 3868 wrote to memory of 904	3868	msedge.exe	90
PID 3868 wrote to memory of 2148	3868	msedge.exe	91
PID 3868 wrote to memory of 2148	3868	msedge.exe	91
PID 3868 wrote to memory of 1484	3868	msedge.exe	96
PID 3868 wrote to memory of 1484	3868	msedge.exe	96
PID 3868 wrote to memory of 1484	3868	msedge.exe	96
PID 3868 wrote to memory of 5012	3868	msedge.exe	97
PID 3868 wrote to memory of 3480	3868	msedge.exe	98
PID 3868 wrote to memory of 5012	3868	msedge.exe	97
PID 3868 wrote to memory of 3480	3868	msedge.exe	98
PID 3868 wrote to memory of 4168	3868	msedge.exe	100
PID 3868 wrote to memory of 2636	3868	msedge.exe	109
PID 3868 wrote to memory of 5056	3868	msedge.exe	110
PID 3868 wrote to memory of 4160	3868	msedge.exe	111
PID 3868 wrote to memory of 4880	3868	msedge.exe	112
PID 3868 wrote to memory of 4880	3868	msedge.exe	112
PID 3868 wrote to memory of 2564	3868	msedge.exe	113
PID 3868 wrote to memory of 1336	3868	msedge.exe	114
PID 3868 wrote to memory of 1336	3868	msedge.exe	114
PID 3868 wrote to memory of 4460	3868	msedge.exe	115
PID 3868 wrote to memory of 4460	3868	msedge.exe	115
PID 3868 wrote to memory of 328	3868	msedge.exe	116
PID 3868 wrote to memory of 328	3868	msedge.exe	116
PID 3868 wrote to memory of 1760	3868	msedge.exe	117
PID 3868 wrote to memory of 1760	3868	msedge.exe	117
PID 3868 wrote to memory of 1116	3868	msedge.exe	118
PID 3868 wrote to memory of 1116	3868	msedge.exe	118
PID 3868 wrote to memory of 4704	3868	msedge.exe	119
PID 3868 wrote to memory of 4704	3868	msedge.exe	119

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument http://www.blastoffaustralia.com
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x270,0x7ff8d81ec188,0x7ff8d81ec194,0x7ff8d81ec1a0
  2⤵
  PID:2716
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1828,i,271600895352685558,1432267143668101187,524288 --field-trial-handle=2180,i,14588247607639741701,5094591065649651060,262144 --variations-seed-version --mojo-platform-channel-handle=2208 /prefetch:3
  2⤵
  - System Time Discovery
  PID:2228
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1676,i,1711807747078580755,3313917964516837820,262144 --field-trial-handle=2180,i,14588247607639741701,5094591065649651060,262144 --variations-seed-version --mojo-platform-channel-handle=2176 /prefetch:2
  2⤵
  PID:4324
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2572,i,17847004714639045406,14529121469602659741,524288 --field-trial-handle=2180,i,14588247607639741701,5094591065649651060,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:8
  2⤵
  PID:2068
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3476,i,12428518637892619779,6543236845012803452,2097152 --field-trial-handle=2180,i,14588247607639741701,5094591065649651060,262144 --variations-seed-version --mojo-platform-channel-handle=3552 /prefetch:1
  2⤵
  PID:3740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3480,i,14313353720647993714,12429621405170218193,2097152 --field-trial-handle=2180,i,14588247607639741701,5094591065649651060,262144 --variations-seed-version --mojo-platform-channel-handle=3560 /prefetch:1
  2⤵
  PID:4112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4272,i,17542329176721413273,11267214608805599129,2097152 --field-trial-handle=2180,i,14588247607639741701,5094591065649651060,262144 --variations-seed-version --mojo-platform-channel-handle=4316 /prefetch:1
  2⤵
  PID:904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4296,i,14594219331373185905,6091978574216993136,2097152 --field-trial-handle=2180,i,14588247607639741701,5094591065649651060,262144 --variations-seed-version --mojo-platform-channel-handle=4344 /prefetch:2
  2⤵
  PID:2148
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5144,i,16833168604467761938,9262239889971145035,2097152 --field-trial-handle=2180,i,14588247607639741701,5094591065649651060,262144 --variations-seed-version --mojo-platform-channel-handle=5152 /prefetch:1
  2⤵
  PID:1484
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3596,i,10354792647204990698,14179840942065041482,524288 --field-trial-handle=2180,i,14588247607639741701,5094591065649651060,262144 --variations-seed-version --mojo-platform-channel-handle=3792 /prefetch:8
  2⤵
  PID:5012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3788,i,18312388230632985520,4549451246432431734,524288 --field-trial-handle=2180,i,14588247607639741701,5094591065649651060,262144 --variations-seed-version --mojo-platform-channel-handle=3740 /prefetch:8
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5796,i,15329701833518458958,7138664642884341825,524288 --field-trial-handle=2180,i,14588247607639741701,5094591065649651060,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  PID:4996
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5796,i,15329701833518458958,7138664642884341825,524288 --field-trial-handle=2180,i,14588247607639741701,5094591065649651060,262144 --variations-seed-version --mojo-platform-channel-handle=5816 /prefetch:8
  2⤵
  PID:4168
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4572,i,9204650062832214379,11440986397855237259,524288 --field-trial-handle=2180,i,14588247607639741701,5094591065649651060,262144 --variations-seed-version --mojo-platform-channel-handle=4560 /prefetch:8
  2⤵
  PID:2636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4576,i,2471980639581453093,17486684299669962800,524288 --field-trial-handle=2180,i,14588247607639741701,5094591065649651060,262144 --variations-seed-version --mojo-platform-channel-handle=4500 /prefetch:8
  2⤵
  PID:5056
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4556,i,5704353910125746291,17982595259561611445,524288 --field-trial-handle=2180,i,14588247607639741701,5094591065649651060,262144 --variations-seed-version --mojo-platform-channel-handle=3648 /prefetch:8
  2⤵
  PID:4160
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4500,i,16558029562750902658,15180679248779006376,524288 --field-trial-handle=2180,i,14588247607639741701,5094591065649651060,262144 --variations-seed-version --mojo-platform-channel-handle=5444 /prefetch:8
  2⤵
  PID:4880
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=5948,i,8079752693119189453,16600630512826157508,262144 --field-trial-handle=2180,i,14588247607639741701,5094591065649651060,262144 --variations-seed-version --mojo-platform-channel-handle=6096 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2564
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5504,i,8454761764596251972,6205244185413987100,524288 --field-trial-handle=2180,i,14588247607639741701,5094591065649651060,262144 --variations-seed-version --mojo-platform-channel-handle=6136 /prefetch:8
  2⤵
  PID:1336
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6188,i,7211795925430865936,6132983531546460856,524288 --field-trial-handle=2180,i,14588247607639741701,5094591065649651060,262144 --variations-seed-version --mojo-platform-channel-handle=3812 /prefetch:8
  2⤵
  PID:4460
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5524,i,331646584491812669,5881063402565312079,524288 --field-trial-handle=2180,i,14588247607639741701,5094591065649651060,262144 --variations-seed-version --mojo-platform-channel-handle=3728 /prefetch:8
  2⤵
  PID:328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3328,i,14013745945745764989,952916200261900811,524288 --field-trial-handle=2180,i,14588247607639741701,5094591065649651060,262144 --variations-seed-version --mojo-platform-channel-handle=6264 /prefetch:8
  2⤵
  PID:1760
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_xpay_wallet.mojom.EdgeXPayWalletService --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6336,i,3289341671435727290,14141416848786498373,524288 --field-trial-handle=2180,i,14588247607639741701,5094591065649651060,262144 --variations-seed-version --mojo-platform-channel-handle=6256 /prefetch:8
  2⤵
  PID:1116
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3812,i,466514621123491264,2157363241470131489,524288 --field-trial-handle=2180,i,14588247607639741701,5094591065649651060,262144 --variations-seed-version --mojo-platform-channel-handle=4296 /prefetch:8
  2⤵
  PID:4704

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3356

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 f581ea565cf0ece39a0cfdc05cae1573d34e8544d3d072c3f0598034de5e42f8
MD5 c80cb3ee13f62b490ae95d8bb68bb8fa
SHA1 a3baa3d078eae3e3de53faaf8b92df67f056d9e2
SHA512 f385ff91fe9914b069144548f6f36759de4228b81878118a49bc5d05a8f3055bf5724ef0be68d53b91691f095dc1736b8d3458eace80a0e31689f3d0c8f3f5eb
TLSH
T168D09B34F75AE445D1074531582C4711D9199DD014A6870B5160D41CABA401C73BF457
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 e091ac4f88db5453fb07661c5eb4ebedb553cc507ac11d855633af4bab0e74e5
MD5 2838a244aa4c14dbe7e2001806498b05
SHA1 1bb0bfd8bcc597bb5720c8093ec3d161d4012357
SHA512 6358674a949e5a667206cc69b328000a2144ad81bfbf5a0bb9b6cbf06ade5970c22882481326552ea44f9f58cdb8985b2fbafe455767bbc68818a67d9a6dc41d
TLSH
T160D09B34B75AE445D5074531582C4711D9199DD014A6C70B5160D41C9BA505C73BF457
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 6KB
SHA256 ff5cfc5072d4219c165948d349fc1aff7c626bea5fa419535cf960afa4ee98e9
MD5 67aba9b3fba4e83da8af19f570427e6f
SHA1 e0e1bf916f4e3bf2d0406d0c679033aa6bb4fdd2
SHA512 f28b4e32ef9b8a0619acd58ea0dfc958687ec38eaa1deaca3ecc7bbbe0ef895b30cdb3f585f8a458028f69a8307938700bf6855bf717cc15b66bc3b6f718ecb9
SSDEEP 192:BjSdyT88wwwwnnRqP4Qtqfhh6A33mdELO:BjSdyT88wwwwnnRqP4Qtqfhh6A33mdIO
TLSH
T1ADD1675687DCCB9EEF15108B4AA4735C41B1370EEBDCDE08038D9AED318E49AF9A5790
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 6KB
SHA256 16409fd83a55fad3923891eac38516a03dae1cd9ef8fe07abb9804f805e5dc4c
MD5 1103999240b289721cd9b847fed63eb9
SHA1 40ebb4ab78c630d523b020f96c97bc60e8f70503
SHA512 df142785a30c8910e3f4a09af0f8ac0bf4530cada4dceca494b88bd5c6b17ac9ddec13c1460c2abd17470c5f0f16282e12fde9f7ba8aecd2b771a4174e72c3f4
SSDEEP 192:8jGtobsj222///00011166DDD444vvYLO:8jGtobsj222///00011166DDD444vvcO
TLSH
T1BAD1778A83D4D79FCF0921CB49B4639D41B0370AEBDCD908138D9ED9304E9DEB6B9691
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 123945efd55c6143810081c2b643003777e2dd0b95de677c8086a8b86706136b
MD5 12fdac4a507ac5c1784bc69b5c3f540a
SHA1 ddb7d77b1c31164c3bc86bfc99331f38084514ad
SHA512 d6775867519fdf19692ef42cd24da83b66f92ca866e4442183085b4a53b20e40eda79621ea142bdfa1f63343f3038d4982181e5982554dc943d0c1eca57813c1
SSDEEP 48:WzJut57fwWSWWTekJepHGRVOkv2bCObCectYHKEiFdwwKYczO8hYK+FnMW:WNut5bUKMepIVOPNctgKEiPwLzO82K+N
TLSH
T15D91B4AD49B51A42DBA11A31D2F29A9CB73375CEFED3CF160B10607D981F39178B4029
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 4KB
SHA256 f43e8fc6c362d399dc01858f773b220f03f30d4a09b61c29536c6159f8b5dfb8
MD5 2367688668676fdf49400a0efd3de155
SHA1 fcdcb9c55c3e38065a5e6be07525bbaab66827e5
SHA512 004ff737c3ad948cc612b94c6f94429ebfc6074af0afdc0f847859e5c725c0c9dd3a0602dbe6bc4109b71f95bf39429baef63f8ce0f8dc19e9c8d959c0c058bf
SSDEEP 96:r4NTt5bUKMepIVOPNctgKEiPwLzO82K+A:r4Vt5bUKM7H2jiPwLzInA
TLSH
T1DD91A4AD49B51942DBA11A31D2F29A9CB77375CEFED3CF160B10607D941F39174B4029
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe58bc17.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58bc17.TMP
Size 3KB
SHA256 178de6e85b2f2ff58a5b7fd82e576c7b7e737fc499e148869fcf85fbb8a474e0
MD5 d2f4b314a72aebe08ebced50e6baee76
SHA1 4c62254668ef96480f86c912e099bde6659cd27d
SHA512 ce0d443e103795c9b07072069c655af8a52881ae4a6be3ea956a703e2f07b6e20255065a4b332ddcc29a4bbd927bb52bef6d28d4390739fb60b8cdcf9c2e27ee
TLSH
T1D571929D01222952E3B21331E2F1C2EDB733A0CBFED3CE251354657C941F752A178029
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 df6c4b18c1b79b13bee2393cc9f119b0a8a3196898678a17938fca8dd51104c1
MD5 40c1921d16d3671d3d0342af5342054a
SHA1 9299c6a822850aacdd08a4c9f43027b34ea4668a
SHA512 f78b5815f0afd90733779db2984ded8909f5b4e30e48ad94c49cffb2ba81f69321b366202e5c2f4713a1bfacc4b28a3ccf262dcdf0eb304400e5c6fd9e4886cc
SSDEEP 96:DlOj/biQgzcVGbB/A+MxNxCPDG+wBuNGlJp/E:Doj/biQgIVGt/A+Mx/GDG+kuNaJp/E
TLSH
T1EAA1DEB382E4871C99463AF0EE18BE2BCE5A1A54C31C3D5DC8D6DF2B97F2560D041A5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 27bc6db5980234370fa297af764be493effe9c0d7c58d9b70f5efe2175070cdf
MD5 6a83de351e25105794bd6fc0166e25f7
SHA1 91ef7500d7a1488e9de89058f9ecbbee4c2986b2
SHA512 33fdc6d0cf04a84d262e4a05eee115c7c65a0b8b2bef40daefc1bbaa5418536d4243373ee75745691fdeb3a0a55f7b11b2e880fa4e425099731c2571edb66195
SSDEEP 96:D/OtTEkQAaLzBbBhMMxNxCP3uNGlJpqSwBJGj4/3:DWtTEkQAm1thMMx/G3uNaJpqSkJGj4v
TLSH
T12591DEF742B4821C99017AF0EE58EE2BCF6A1614C31C7D9D89D29F2BD7F2161D080B5A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 aa10bf07b0d265bed28f2a475f3564d8ddb5e4d4ffee0ab6f3a0cc564907b631
MD5 807419ca9a4734feaf8d8563a003b048
SHA1 a723c7d60a65886ffa068711f1e900ccc85922a6
SHA512 f10d496ae75db5ba412bd9f17bf0c7da7632db92a3fabf7f24071e40f5759c6a875ad8f3a72bad149da58b3da3b816077df125d0d9f3544adba68c66353d206c
TLSH
T18DB01269E5507CFF074A83A41428B463C3FF0047421C8ABEEA3873AD42A21FE0828C57
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 d042a7788c4431b693118945be68baa795f502a0c1e91a20a907c3884b300896
MD5 5869076c41afca846aee764dd534a087
SHA1 f9018a21452897bcafa95a86a3bd8721446873e1
SHA512 db5dc62a01cd69311aabada4fd2babbfcc6c504ccf27f99ec09c02cd01319c4bd430ad0f813be3e072256aadc14fb37b09f07d87bd3d50d03fe056c8a7183a10
SSDEEP 192:sxZSRPyM/jK1Ml8UQDkj/ftsaDM8NIdp5FHW6+WNNWc/YrzZZsAWIg5MJ:sxZSFqoj/ftsyMFDHbL/0U7C
TLSH
T16E52D811AA349A77CCDBD209FA51BF53D6F5457292900E48A9FCCA1C04E6BED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 74554f81e49dc6efc41003caf403f851fefe13386846cacca5fe99ab038a0bd4
MD5 951ca7644e0f245e812096028a5c18ba
SHA1 c7ba25526109a740f799ce5cd79a6b84df8ece01
SHA512 5f3a04aabb891e30a3b7cbddc43bf7fdfb52d6f436fc5f347a798c5ca00d1488aae4ee1d67eead11cf611de12d1368e07ef766f3f924b35fe09862be31f1cfda
SSDEEP 192:sxZSRPyM/jK1Ml8Mkj/fts5D78NIdpbFHW6+WNNWc/Yr5Z+sAWIgrJ:sxZSLMj/ftsJ7FRHbL/yp79
TLSH
T17F52C811AB349A77CCDBD209FA55BF53D6F5056292900E48A9FC8A1C04E6BED2217C1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 56efcb5e253c290b8dbdd3ee77a9efdbd6d25a2f6cf10e68dc58d1eedaa7c376
MD5 8d8c083813c63696d91fb2ff2de41896
SHA1 d8134a2c3134e4cce754d2176539439c8f7bfd83
SHA512 479b9442987753d27caf7c5384c0de8da3645c7ff028c08af1062d8ffe3f312ed991c751faffcc146fe9c280dc47800a80f95fd40d0b88630e8de2611d485479
SSDEEP 192:sxZSRPyM/jK1Ml8Mkj/ftsaDM8NIdpbFHW6+WNNWc/Yr9ZusAWIg5MJ:sxZSFMj/ftsyMFRHbL/+t7C
TLSH
T14352D811AA349A77CCDBD209FA51BF53D6F5057292910E48AAFCCA1C04E6BDD2217C2F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 0d1b3df941dee23841f70557b799933f14403d944def06996a34f3071272959d
MD5 d951cbc7c1e90266498ea636ace38cc1
SHA1 b16194c8102213f6f311a27548d6b6063b3e3054
SHA512 f71077042670a3fcc2d0d48ee97aaca8b8c6cce000aca6b5021511eaa1465a00d99495d72dc173454dd13e4f047eb9137e92dd714643ec2b7c6e39317bcb511f
SSDEEP 768:TUgL6XeWviSZq8F1+UoAYDCx9Tuqh0VfUC9xbog/OVXJLlZzaREroWZNTwGL:TUgL6XeWviSZqu1jaSJL7+RPWkGL
TLSH
T18CD20A3B680CCB7E4F840E9CED26AF976DD801CB5B984D9447FA494C03C77EA512A49B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d8e94961-bf6c-4c15-8967-a37511e63ef3\index-dir\the-real-index
Size 1KB
SHA256 636e78d52ea4eb3394b21f392bd9b9905bd1aa1a8929da5201e102d344af71a0
MD5 fc3efca6144c98441a5b8a9cdc18efa8
SHA1 b853ced171905a51175734f3579b4ae090d27ae6
SHA512 713592dfb452971cdae4b650eab5f0181edece758b0f7b856d406415beda7268e3fb7c737a2c7663464e92b91f79df499f5c4373aa4f3c65df7f9b57be8b156c
TLSH
T17B2150899ED0990FF954457A0973B8E8B3708ACC8711A323183D22721E1138D2A5B1DC
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5d5b52.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\d8e94961-bf6c-4c15-8967-a37511e63ef3\index-dir\the-real-index~RFe5d5b52.TMP
Size 1KB
SHA256 7b35d21302abce5a40a80e4c043e274770ec92dc8b1750d25a97141e6bd782fa
MD5 b72c9c42eb5020cfa6c97b1d049c19f2
SHA1 32090c1b81cff4714756e514714256b196c8168c
SHA512 76b952f277d5ede79b1a60da1ab959fb5ead01b8b2c32f72380bee6cf40ad6e6db12bef6dd0c59ca4ca64bfbeb1193426e603a17c4f59317faa7dede2a7c1a89
TLSH
T1122104964AD14D1BF984517B1953F4F4B33189009322F393A93D21398D25BCD1A4B0C9
MD5 SHA1 SHA512 TLSH

Submit Download

index.txt

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Service Worker\CacheStorage\3cedfb74d44f2e84198d23075aef16c34a668ceb\index.txt
Size 371B
SHA256 0a157df61b908e0ec32a9fb96a5614e14c6d7acfd27aa892a6c10e4f7e36ce2c
MD5 d59ea37856892876851138ecbebfba46
SHA1 2c242af2b2d0c610f3731258169367f3b5c56c89
SHA512 fa65a7b57a8bcb4c5de49be4fa663f936efe8ba2ec11c89414b4572c802854fe384bbc3ad51e82dff5d8d037d8fc8e571fdd987cd865cbfa036af4f726d6629f
TLSH
T1C4E0D8B719DB1624ACBBD3E2587248A4414179B4C648ED4E1025D38311B2729345DD61
MD5 SHA1 SHA512 TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 b21a1a5cfdbce7e1442f1437901cb3a8e381ae220d0f6639514d4cfcd695ff16
MD5 67e4d84de68bb7fed542371a09907608
SHA1 6559783dba2a6a15c760f3a8416c65956f3e69e5
SHA512 cb888c0230292214e95b5e713b8d58a28b508627396c4559090ff126e2d01c633f1f12328255d975581a413ab7d984d7c53c3f9e8ee25b9d30ede0aadfe22b4a
SSDEEP 48:KsWT8Ae0k1VIRIIqo1K3E/u1r2lQ5YiI/KvaM/yZAIG9I9KuYgl:KwX+KUsWiAKvaeaAP92KuYU
TLSH
T174912617307B52022CFE640C96E1A5779E4232D33654A46F3FB855E51EA6D121EFC8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe59193b.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe59193b.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 dfc45822b9fda382ab7d7145433d4395cef24caa69435d66dae623ef3c5fe0fc
MD5 6b61c1082bd35109608d8230830e38ba
SHA1 43252299318be969fa80c5b23e3cd4de5741649f
SHA512 9bba2a277f04750b5917f35f62f359fc08b9044fdb0393047ca39e6b48619f122f20cebbbcf60cec716c2bbdcaab47b87040a3e6ff7b643756f5263c73ce717c
SSDEEP 384:gqiFiZcI+sNI8TUNTUlIlkF3Zg8IK09uO8liZg+HBbsuos:ghFQ+9wgE2nxZggBD
TLSH
T1BBC219F259D78876DCAE9743E77E2D029EBCC063B5806950B7D85A0CCC9A1BFD30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 13a836cb71ebee6f72829897522b16e62444860d7b69fd447e17ce6597208a44
MD5 b13f523b8ef79b08aadcededbdabe641
SHA1 11933d68d56d7b449883fd45bec2f0ceb3c6828e
SHA512 9464f27dbb1bbbda6fbadb5ea9d207bad1a96c899a759af549e12c7db10aa2b8fb22928ee74781004ffa23b6df837f9802f6c6d529f34cbb78c3c5a9c06e416d
SSDEEP 384:clZcIhsNYk23Zg8Ii09uO8liug+HBbsuos:cdhL2nxuggBD
TLSH
T16C828D73A9689CB75CE2E141F54736039FB88063ABC46E40D6EC7B1D05EE598230FD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 2074b0184da5b7a2bbc481e0517502ebbd8775f7bc9d1ce16e3d07ee0c4fe1ed
MD5 f5717d5b75dd643200a2727c4a398ed1
SHA1 4f5d31aad37b14351fd8fee47409b87d1e45ab22
SHA512 5e8a122e2cb45958adeba1f7f69b155e926dc645706cf8a99e972a34eaa5beaf985c36417c327f00bedbb178795be047d4b6183cb9f8996b0f857e89ca8f118b
SSDEEP 96:RqONkqQsjpfVC10tOJ5ih/cIPURHl8h4otop5DRDBBOPPvfzSuOaPzMvLeISqsLI:YONu6LCWtDQmiUyV3ILSuOCzZsEkP5U6
TLSH
T12702D836B9686C778DB36E45F5873B276FA41127E9A02F44DAE81F0C01DB64C2306976
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 1064677c3614e140e74acbb990f413f544306b61b9aa76d48f5630b272d1dca7
MD5 a53d55484ac9c57d5c8067bb52678689
SHA1 04fe32dff96a97e46cf70ca147c6e2bdded902ce
SHA512 d5532267e81262f1072461a856710f85670889dfceefddf7e4e2865c516539aa8f310a360e691328365bbafacf7d96a6e982b7a4b8445f4ee190982be89295af
SSDEEP 384:IlZcIhsNYkF3Zg8Ii09uO8liug+HBbsuos:IdhK2nxuggBD
TLSH
T134828D73A9689CB75CE2E141F64736039FB88067ABC46F40D6EC7B1D05EE598230BD26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 61e9fefd89ea4c330b49c32715c86d0a5c713f3c7c52be3c6438a7af7c897223
MD5 bce49fef7cd3da5091e40026e84c3f2c
SHA1 3a628d09eb956fe9d5ae83552196d911e5acf641
SHA512 7017aeb534ffe085d666c0fd2c40847794de6a3603746cd50027ef206bbef0e19ba5d6cd48807402347226a18f69959cdb248ee81b7a3f5779d36b21dcdc0f35
SSDEEP 192:KONh6LCWtdQmiUyR3ULSuOCzlE9NI/6qYU6:KONh6mgb0UmuO8liogU6
TLSH
T181120936B958AC778DE2B990F4833617AFB44123DA847F44D6EC2F1C01EF59C630A966
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 d262715907a8652f06d82d0a14b42f12eb0d735670bb798c9ea0db1a6c71f063
MD5 4e23fda419c2ade8e9e329a3bf52feb6
SHA1 d129d49100f186429b92ccfa084f34bec87e0674
SHA512 15bdbf01e095560265fb88086126c2e74e6d3f1ae95ec2efbdfd886d2784df35c44f7780c180aa5721ad93fc71117f8e74aae39e2e6c9d2019ef2f3c53067e47
TLSH
T16B413F98B6E91148B3B76F16ABF6996D887B78772E07D15D10020D4E0663B40CC71737
MD5 SHA1 SHA512 TLSH

Submit Download