hxxps://www[.]google[.]com/goto?url=CAES8wEB6zswFQL7lM2xrsNwNok8Fvm8T1PVIpNUDBStGjHlQA3Gf0mcLuPy039Rd3DF0qwT4b0g3bpM8lFPweeaMhsTyZBlarbS30_WSu2_iYwebIeDkNFC8xnqHOybbkIIqDxZiyXPAi1Z38v38-zTqtuLgTBEepQkQvs587C0aPuN5bH5gCFNhjEch6L7KZzJJ4FrSsnSq43dVgJf6aRcHEGI7svfgFzxfXiybj226BMgNnwiZ0lEDGIC7AdQLzb2uy9Ach4zI4bEWcfcO7QVBxm4CDYgRl3drZ5C4D0lL7h9FbN0UXqgshL0D34AeU4iFAXwrFg

Analysis

user interaction
yes
max time kernel
148s
max time network
151s
platform
windows10-ltsc_2021_x64
resource
win10ltsc2021-20260513-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20260513-enlocale:en-usos:windows10-ltsc_2021-x64systemwindows
submitted
26/08/2026, 01:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://www.google.com/goto?url=CAES8wEB6zswFQL7lM2xrsNwNok8Fvm8T1PVIpNUDBStGjHlQA3Gf0mcLuPy039Rd3DF0qwT4b0g3bpM8lFPweeaMhsTyZBlarbS30_WSu2_iYwebIeDkNFC8xnqHOybbkIIqDxZiyXPAi1Z38v38-zTqtuLgTBEepQkQvs587C0aPuN5bH5gCFNhjEch6L7KZzJJ4FrSsnSq43dVgJf6aRcHEGI7svfgFzxfXiybj226BMgNnwiZ0lEDGIC7AdQLzb2uy9Ach4zI4bEWcfcO7QVBxm4CDYgRl3drZ5C4D0lL7h9FbN0UXqgshL0D34AeU4iFAXwrFg
Sample260826-bjtkys1dkf

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4488	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134321802670742141"	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-4045429996-2364296335-1634900306-1000\{60BC008C-970A-4E84-B52B-4C90D35C1CA0}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2456	msedge.exe
2456	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 8 IoCs

pid	Process
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe
4328	msedge.exe

Suspicious use of WriteProcessMemory 41 IoCs

description	pid	Process	procid_target
PID 4328 wrote to memory of 3988	4328	msedge.exe	83
PID 4328 wrote to memory of 4488	4328	msedge.exe	84
PID 4328 wrote to memory of 3604	4328	msedge.exe	86
PID 4328 wrote to memory of 3604	4328	msedge.exe	86
PID 4328 wrote to memory of 3604	4328	msedge.exe	86
PID 4328 wrote to memory of 5204	4328	msedge.exe	87
PID 4328 wrote to memory of 5204	4328	msedge.exe	87
PID 4328 wrote to memory of 5072	4328	msedge.exe	88
PID 4328 wrote to memory of 3528	4328	msedge.exe	89
PID 4328 wrote to memory of 5072	4328	msedge.exe	88
PID 4328 wrote to memory of 5072	4328	msedge.exe	88
PID 4328 wrote to memory of 3528	4328	msedge.exe	89
PID 4328 wrote to memory of 3528	4328	msedge.exe	89
PID 4328 wrote to memory of 2096	4328	msedge.exe	92
PID 4328 wrote to memory of 2096	4328	msedge.exe	92
PID 4328 wrote to memory of 2096	4328	msedge.exe	92
PID 4328 wrote to memory of 3640	4328	msedge.exe	93
PID 4328 wrote to memory of 4076	4328	msedge.exe	94
PID 4328 wrote to memory of 3640	4328	msedge.exe	93
PID 4328 wrote to memory of 4076	4328	msedge.exe	94
PID 4328 wrote to memory of 5380	4328	msedge.exe	96
PID 4328 wrote to memory of 1112	4328	msedge.exe	100
PID 4328 wrote to memory of 1112	4328	msedge.exe	100
PID 4328 wrote to memory of 4248	4328	msedge.exe	101
PID 4328 wrote to memory of 4248	4328	msedge.exe	101
PID 4328 wrote to memory of 4248	4328	msedge.exe	101
PID 4328 wrote to memory of 2112	4328	msedge.exe	103
PID 4328 wrote to memory of 2112	4328	msedge.exe	103
PID 4328 wrote to memory of 2112	4328	msedge.exe	103
PID 4328 wrote to memory of 5992	4328	msedge.exe	104
PID 4328 wrote to memory of 5992	4328	msedge.exe	104
PID 4328 wrote to memory of 5992	4328	msedge.exe	104
PID 4328 wrote to memory of 4740	4328	msedge.exe	105
PID 4328 wrote to memory of 4740	4328	msedge.exe	105
PID 4328 wrote to memory of 4740	4328	msedge.exe	105
PID 4328 wrote to memory of 6108	4328	msedge.exe	108
PID 4328 wrote to memory of 728	4328	msedge.exe	109
PID 4328 wrote to memory of 6092	4328	msedge.exe	110
PID 4328 wrote to memory of 3444	4328	msedge.exe	116
PID 4328 wrote to memory of 3444	4328	msedge.exe	116
PID 4328 wrote to memory of 2456	4328	msedge.exe	117

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://www.google.com/goto?url=CAES8wEB6zswFQL7lM2xrsNwNok8Fvm8T1PVIpNUDBStGjHlQA3Gf0mcLuPy039Rd3DF0qwT4b0g3bpM8lFPweeaMhsTyZBlarbS30_WSu2_iYwebIeDkNFC8xnqHOybbkIIqDxZiyXPAi1Z38v38-zTqtuLgTBEepQkQvs587C0aPuN5bH5gCFNhjEch6L7KZzJJ4FrSsnSq43dVgJf6aRcHEGI7svfgFzxfXiybj226BMgNnwiZ0lEDGIC7AdQLzb2uy9Ach4zI4bEWcfcO7QVBxm4CDYgRl3drZ5C4D0lL7h9FbN0UXqgshL0D34AeU4iFAXwrFg
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x260,0x264,0x268,0x25c,0x288,0x7ffbd92ac188,0x7ffbd92ac194,0x7ffbd92ac1a0
  2⤵
  PID:3988
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1940,i,7732545203419177718,16312400974988880433,524288 --field-trial-handle=2352,i,9807889660934832368,16988707813390445425,262144 --variations-seed-version --mojo-platform-channel-handle=2376 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4488
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1804,i,13767733878027548763,15409405829846127072,262144 --field-trial-handle=2352,i,9807889660934832368,16988707813390445425,262144 --variations-seed-version --mojo-platform-channel-handle=2344 /prefetch:2
  2⤵
  PID:3604
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2272,i,16610597765723817716,12199458972567491386,524288 --field-trial-handle=2352,i,9807889660934832368,16988707813390445425,262144 --variations-seed-version --mojo-platform-channel-handle=2576 /prefetch:8
  2⤵
  PID:5204
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3472,i,2089176349647433357,13104271545330834680,2097152 --field-trial-handle=2352,i,9807889660934832368,16988707813390445425,262144 --variations-seed-version --mojo-platform-channel-handle=3536 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3476,i,2971056555038893201,8083044372741607752,2097152 --field-trial-handle=2352,i,9807889660934832368,16988707813390445425,262144 --variations-seed-version --mojo-platform-channel-handle=3540 /prefetch:1
  2⤵
  PID:3528
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=5016,i,12426052620072876995,11229241562768019256,2097152 --field-trial-handle=2352,i,9807889660934832368,16988707813390445425,262144 --variations-seed-version --mojo-platform-channel-handle=4996 /prefetch:1
  2⤵
  PID:2096
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3580,i,5952736878556303628,15159496956012494276,524288 --field-trial-handle=2352,i,9807889660934832368,16988707813390445425,262144 --variations-seed-version --mojo-platform-channel-handle=5184 /prefetch:8
  2⤵
  PID:3640
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3616,i,11068387638949386872,9099588273755916031,524288 --field-trial-handle=2352,i,9807889660934832368,16988707813390445425,262144 --variations-seed-version --mojo-platform-channel-handle=5172 /prefetch:8
  2⤵
  PID:4076
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5808,i,18057225611055333962,2312733796995777290,524288 --field-trial-handle=2352,i,9807889660934832368,16988707813390445425,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:8
  2⤵
  PID:2020
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5808,i,18057225611055333962,2312733796995777290,524288 --field-trial-handle=2352,i,9807889660934832368,16988707813390445425,262144 --variations-seed-version --mojo-platform-channel-handle=5788 /prefetch:8
  2⤵
  PID:5380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6116,i,10993792968619312573,9386261067713453913,524288 --field-trial-handle=2352,i,9807889660934832368,16988707813390445425,262144 --variations-seed-version --mojo-platform-channel-handle=6080 /prefetch:8
  2⤵
  PID:1112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6256,i,11798258138734730197,1071653338234440477,2097152 --field-trial-handle=2352,i,9807889660934832368,16988707813390445425,262144 --variations-seed-version --mojo-platform-channel-handle=6280 /prefetch:1
  2⤵
  PID:4248
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6468,i,1615422640263886438,16634569658448582442,2097152 --field-trial-handle=2352,i,9807889660934832368,16988707813390445425,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:1
  2⤵
  PID:2112
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6600,i,15595783579032438415,8392593797436958462,2097152 --field-trial-handle=2352,i,9807889660934832368,16988707813390445425,262144 --variations-seed-version --mojo-platform-channel-handle=6628 /prefetch:1
  2⤵
  PID:5992
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=6752,i,9491428996225043492,11358516912956834484,2097152 --field-trial-handle=2352,i,9807889660934832368,16988707813390445425,262144 --variations-seed-version --mojo-platform-channel-handle=6796 /prefetch:1
  2⤵
  PID:4740
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7028,i,13646123677697672794,11869202797743319992,524288 --field-trial-handle=2352,i,9807889660934832368,16988707813390445425,262144 --variations-seed-version --mojo-platform-channel-handle=7024 /prefetch:8
  2⤵
  PID:6108
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7128,i,4667474639389980381,9609881528020485914,524288 --field-trial-handle=2352,i,9807889660934832368,16988707813390445425,262144 --variations-seed-version --mojo-platform-channel-handle=7080 /prefetch:8
  2⤵
  PID:728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7132,i,14312664823779933609,4645219534368040348,524288 --field-trial-handle=2352,i,9807889660934832368,16988707813390445425,262144 --variations-seed-version --mojo-platform-channel-handle=7156 /prefetch:8
  2⤵
  PID:6092
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5448,i,13168389222920285164,11936410819575714467,524288 --field-trial-handle=2352,i,9807889660934832368,16988707813390445425,262144 --variations-seed-version --mojo-platform-channel-handle=7068 /prefetch:8
  2⤵
  PID:3444
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.4355 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=3732,i,4132685560184516973,1121114384437214715,262144 --field-trial-handle=2352,i,9807889660934832368,16988707813390445425,262144 --variations-seed-version --mojo-platform-channel-handle=6932 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2456

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:4740

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:4968

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 fc69248227d1b80ff41106426895bcd599abcddfbfe7fdbeabc0fcc2aca903ae
MD5 be6741080fa256162cf6b0264133ca7c
SHA1 4914334b0edd1e4c3a470920450bdee63ee2f5b6
SHA512 8d42ac6412ff316aaa68e317e92c2167dbcac331381aec8d8be8410c5bfab4657127a0601dfc90f771660e393667d62af5e917155d6fcc5c7aa6a8ca1e03f903
TLSH
T149D08037394D7015E35D5175A463C7152B664C611497DF01F166CA7CD9B61C462C71C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 44e095af7ccad1927602b4b935aae3524939df30218011b877b59c782e6c6106
MD5 3c1bf221dd0438f719ae47a265c3e436
SHA1 b382689171539f473d331bdcef3739b0fa0b1062
SHA512 b7f8bf66ea12f9b37e5f8d1af222c106c1dfa377331d2153d9380edcc3af7381e9c3490378c0b160e05f5c4fd2e1590d5cb8ed07cdeb7b74fb7b38b0e8e1e57f
TLSH
T18ED080333D4D7015E35D5175A463C7153B7648611497DF01F166CA7CD9F61C466C71C2
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

BrowsingTopicsState

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BrowsingTopicsState
Size 414B
SHA256 61dc9abe32e476909573798f277fe5b7a151f1d57e7addb09dc0d9165995acc0
MD5 26e9a720b0f3b007918a131000ed669c
SHA1 410da27f7263c841709f51917b055f4ad1661c3d
SHA512 85262ffe4f7c3027dd67dbf2c26159b189015103b8f006ebf9d1ac6da65e3b3eaf4fc4905d684692e59af1be85935c6ccb8bc65003264efdc50a18330e592494
TLSH
T1BAE022F9CC32EC3B08FD0B2895A1074BE755135B2B8058AB3A3CA0188FB163B418682C
MD5 SHA1 SHA512 TLSH

Submit Download

temp-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\temp-index
Size 7KB
SHA256 e380a19e7220e6030d7cef46e2154c16ab09ee0773f72825dbcc26f730335930
MD5 8a8dd71570e083e03b96b287761e36ce
SHA1 11e7adca8a3767f974158861426c2e9253b97d6d
SHA512 5595d38d41e3c21a38d2cc10f1f7c263d4365a3bbfe44e1bf1bee6374281477a3ce54419eedcd2a7fcfc8c9f19f539adcf3d6d50415038a66068931a7c2cd59c
SSDEEP 96:TpATQxSp8rZWDPK6mixzKAIhddH5oNtXjW2sJ17:JZrZWD/mipKAadroXSb17
TLSH
T199F1A067603D8C80C735AEF0A0D036673A7578B1B8CB4E266FA055B41A2E7BC41FB46D
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 b7b715442c502841ebb252c87531ada0584a7700f8490aaf897e2330ea0e40af
MD5 3c9ee5efdb5641f48d7370a3216f939d
SHA1 089543d2d3272e586900950de93fff566e26850e
SHA512 e287352f4e0c78dc38df600e07b6153cdb0c116ec10f977920c70b69c68d2be1b2f74d70171c46b2a7cc3f5c8a45a1bd3c1c926dce3d9974c382dfbab885b5e8
TLSH
T15E71A4387601CC40E33505F5A4D122133DB489E8F9CF4E5BABE0A5F4562DB7241BA97C
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

9dddc877-2d8a-47ee-9aa6-b18875847fd7.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\9dddc877-2d8a-47ee-9aa6-b18875847fd7.tmp
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 64b4048dad03d79825817984e1c65d41af1ad1df5a9f421d166c59318d48ffa5
MD5 7458db1451d3f77cf4162f4ad363a0b6
SHA1 a7888d604082304d17deefb7381e6664f8fd33ad
SHA512 c3ef96647b612cc67f1f6c1f4f2d9048628b2a5da9f396ac5b556cd52cc7295409d37ab0223bf0ff27de263132bb946805d383b1ed421bc2b52c0c80fe06ab9a
SSDEEP 96:D1o5OTlMm1WKaaij6+HzBGBEKB1z5vmnBmrmhmDwBmO+m2Qa6:D1o8TlMm1jaaij6+H1erB1z5vmBmrmhZ
TLSH
T1E2B1ABF787E5862DCA1156F0EA18BF1BCE1D0515831C3C6AC4E4AE1BD3E2871E145B6E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 dcfbc08a3de1915ce4c5d6e40d29d6ab91e17873d37a6205aba6ed2c3969dc22
MD5 8690e78f87c28a49678d6941dc39d009
SHA1 87d0d175ed92ba53a6c07e93162120a9f624422d
SHA512 98b03e2810f44665a95e060906e6941d7b9add585aca67eea191b711e860ca98c9ec6c97c1a73268cdebbe2439f0435def23e36cfde77800bcff0c4f5e47069a
TLSH
T1733180F783E4856E8A0195F0BA18BE2BCE1D0515432C3D9AC5E4AF5B93E2471E141A5B
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 4KB
SHA256 75253d96d6bd8ab8d4ae3305705f1112360cd504375af38919b39a6fb5a44be1
MD5 997b1d22f6961e673d2723e8f323ac31
SHA1 a5b0fbda7c78914be2108a52c56b14d497eb4492
SHA512 3349408428db8928c42639a80217c987cc45a3e46de117dd2b7ed61426edcfe9de2d483e44a82a5d4d72dc37ca7b4557fcb2bff74b165356c39cce16ba8dfc74
SSDEEP 96:D1o5OTlMmNaaij6+HzBGBEKB1z5vmnBmrmhmXQGmgmO+wJ:D1o8TlMmNaaij6+H1erB1z5vmBmrmhmh
TLSH
T1F7A19BF787E5862DCA1156F0EA18AF1BCE1C0515831C3C6A84E4BE1BD3E2871E141BAE
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 26d43855ba9351d7772c26209de829b213eb3420716a2a3c263e585cd8a30bc2
MD5 ed4c114d8fb9812fd5dc707a7f3f90f1
SHA1 93cd4a29139f04b66d1ea3a418c7da8fc22f142d
SHA512 a4137b863f50ac869fc502c20c5fb0c70ce023936288fe01a91b7ac7dd98b8514ee88d5003041ec3315fb2fe3d68fcbed15a11ba4f1f9c0158dbdf26f68bdc3d
TLSH
T14AD022271204B0BDA5FCBE9144BEFCCFC727103A0DC2DDE810D0AC9805314AC8A0F14A
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 26ee62be81c58e59033a0e5f70660da7e20352e32665d8d55579354fcabe2d8c
MD5 25a3ffaec6839495f31d014c75fba893
SHA1 8630866a813b177c4aeb9736bf09f03427724ef3
SHA512 04b696cd20510bc1e615b4cdde3da047026357c10483155cf08c74a614b54652202f94620b25e3a7ddd73221c6e9e246a4ce57e58d4d8b18dbe91284c7b25633
SSDEEP 384:sxZQ9qOmz6/fMsRlzVmZqkHbQoFLx/zOft/7TXdg:sYMOmz6/ffVYHblzi3Xdg
TLSH
T14D82D75265249D77CCCAD619FA657F63D7F90423DA914E486AFCCA0C00EBAEC220781B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 d9aef2251af0d7ec7829bba4ce808ea4a0ccbc48860a07b9dc0615ac40845b9f
MD5 5021f96f8aa5c396b49f88214b049268
SHA1 66541a592056b02d69b726d390d95a750aead977
SHA512 4322bf29047b2da8501603260aecf79fcaa462d2203f580ad0ac3ef29fc4a7df83f36a0e3606662d19631afeb482ef72de58cc77e9cf115a3d4e3034d7eb56bb
SSDEEP 384:sxZ39smz6/fMsRlzNmZVYHbQNLx/zOftv:sfamz6/ffNnHboziv
TLSH
T10972D85669385E77CCDBC219FA85BF63D2F9156392904E449AFCCA0C04E7AEC220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 18KB
SHA256 ae7a20c3bd8a6703058d99a4c6134f74d3d1ac01161fad7b31e6b7d70980054c
MD5 be1f31a1de1eb4196c586b61993db056
SHA1 130e21659bb9a18424ce6c04ff6d5141f3ba6fd0
SHA512 8d18f806921ace76a9e5a3a5cd5a0f60773e89f6d28af273814fd8eb54c9d9773933f3c2e007734a0c15675b361569c45f6e7defe81b9b475bfab20eaef4d524
SSDEEP 384:sxZQ9smz6/fMsRlzVmZqkHbQNLx/8Oft/7TXdg:sYamz6/ffVYHbo8i3Xdg
TLSH
T18282D75665249D77CCCAD619FAA5BF63D7F90423D9914E485AFCCA0C00EBAEC220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 15KB
SHA256 961c29e925bd206d5c14b5ee285069e28f89406e5fa16833c0e80c08c9430436
MD5 92c86e97223e3cb25e1953c38b439228
SHA1 4f8979c74343e3006b444b71f33ad7382092d3af
SHA512 4bc1a31c994866b64f92863a0ea387e0ecf50f035e54aef6d2004a8b3b5b4ba844745f272f355baae9f4c605d5ece00a357d930c1566ccd7283c9d3f093f0ad6
SSDEEP 192:sxZ3RwyMqZjK1Ml8Mk6/fMsFlz4GYZZyKzodppGHW6+WNQi9S/YB0w01/MIgjtFJ:sxZ39M6/fMsFlzNmZesHbQx/FOjtv
TLSH
T17762E8156A389D77CCDBD219FA85BF53D6F9156392904E449AFCCA0C04E7AEC220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 4a5db2156eb4fef5daa5096bff3f90657bd3e3f7e4afca552041515b3bb00ef9
MD5 d8fc0d9ea27f21fb344721ee644926d8
SHA1 13d74fb1b76636436ea648ef0842d2db1c86ea2f
SHA512 6e20274faa19d10d87a4ce06ab63f89516038cb2f97b7aac380d044960e3c29640ac920260a09b885f4ab19ece0927ab3c06e980b145b56014170d5af7d4cccd
SSDEEP 768:P4E/aX6WvCuFO8F1+UoAYDCx9Tuqh0VfUC9xbog/OVDVLlFX6BaroVNm5Pa:P4E/aX6WvCuFOu1jayVLfqBRVMha
TLSH
T18FD20A3B280CCB7E4F844E9CEC266F976DD801C796988D5447EA884C03CB7EE511A5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 24KB
SHA256 7322f5c39567112c440a85c643f4d00294489ae7ba4be2aee3360762199078ad
MD5 4304acaba1f312b38e4e5d41b04699d4
SHA1 b2614a7dbf135f97df2cf2d6960ca2d965031eef
SHA512 30e2324cd906e64969a53d7370d751a286af9b25b4bcf150ada3402b48e142143c5669f1acd6e3d0ad56565fe27c55a7ab7c3082a7076ecc2f7d8eb41da97661
SSDEEP 192:OotE42aG3iLEAs1AOvQA7uItfg1MhlfznKzO5tZBBHaFlufF5XYP7cNBv3dR5LAe:8ptDYDcfvNR1ANAJ5DYo
TLSH
T127B27C16717B065238BF2508A29799379E4231A33818F4EF7BB914A20F67E125CFD8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 25KB
SHA256 e6332870206305a06fd26d3be822b9ed7faac6ff1a4f0fbfd8797e6a183b9573
MD5 edc9d3247d7b13870fa3e2cf1fa60c5c
SHA1 dafb3ce023fc5e366ff7a76edc766e33f3a05209
SHA512 85681f77b5fc71b40b0a8a251b9972e977d1be8cae6279efe89e96ef832501123f311b93a1a34f8c978073848c9fc3948d44699720a2743c98693849fa8d3339
SSDEEP 384:nBiF9CcmyWCs3sNs8TUNTUlImkrDcY0QhJBfpG2sIypVUXKITYzyhkP+lFYS/n11:oFccps33wgx3jG2Jyp6szyhkoFYS/jH
TLSH
T10FC24B35E898DAABECD64BD9F74A3A47DEE04263C68C9AD0DAD81D1C00DB0DD534BC16
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 f54a7cec9ca92dda0b9a72f16df635e9c0c6ac2d4a8287463f52306d94a962dd
MD5 48e0ebe02a14e4cb7d3a997a592f2d21
SHA1 b22d022ae23e14119834e3aa28adf79c29f6e938
SHA512 04cd0453bcbaddff3788b9ca4561a187017e921e5e5ca20dbb8c7ae37bff022ee535de9f9db16a2599b1e1efacc37a684a7fdaa38fe192381495b9e91a773a52
SSDEEP 384:nPiFiZcI83sNo8TUNTUlI4kADcY+RL4JBfpG2sIypVUXKITYTy+LBNj5nDQHy/7V:aFQ83nwgUkL2G2Jyp6sTyWN5D3p
TLSH
T156C23B72D8A4D9BBACE65BD5B74A3B07DEF04163C6CC5AD4D9D86D0C009B5AE030BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 32KB
SHA256 c820e4235df7a758bda2ac4def2c9096b549c26903ed71abcc5248af0fcd3c27
MD5 5b9a90e0d9cb691f16e29db63bd81e12
SHA1 55ef38176006c440dfb424596ce2a48a673341a4
SHA512 f8e0a95e5b3884947b31210d0b84e84255d86c86ecfc1c8592528460a71eab10b3b0cfc1e11b3659b4e4976880cff779229311d88c5674f4e13a96bf8fa4863b
SSDEEP 384:n8iFiZcIn3sNo8TUNTUlI4kADcYSvFbLJ2JBfpG2sIypVUXKITYiy+LBNj5nDQH0:nFQn3nwgUoLJkG2Jyp6siyWN5D3p
TLSH
T16DE2D5F198D7897BE89E4787A77D2E029AFCC153B5885A90B7C85D0CCC865BFC306816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 24KB
SHA256 14081fe23b0d6d55591d71380e8e383ce62c93130fc288e00a77c7367290a56d
MD5 943997593b0c3cd709369b7c4472df8e
SHA1 5d7cb5ab7d1f227651579080b35c7511f8fd9232
SHA512 d643703ff22629d8d4e3811e2eb95ca6040d634517f21db8480c499c55342949c63937d5efa34c090d7c758198b69a9ba36690bf82d90b61e4a221ade9c5bd43
SSDEEP 384:nKiF9CcmyWCs3sNl8TUNTUlImkrDcYhX9JBfpG2sIypVLHhkP+lFYS/n1lYHy/77:BFccps3SwgxLfG2JypdHhkoFYS/jH
TLSH
T183B23A35EC98DABBECE60F99F74A3A47EEE0026786985AD4DAD81D1C00C71DD1347C26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 27KB
SHA256 bf51d8df47756415318ba33ae025393a1ae8806653206098ff7bc98a543e6c17
MD5 992e479e13b8622d2aca68ef3fe116ed
SHA1 a7e2d2ed38daebd4eaed6349128efc1125c12ab7
SHA512 bba15eefc9b301db7bd30e2849e8d29d4bd244e2a33a382831312ab59764d321f6b00d7523199877a23ede0a55539b9b99686ac43c524f5a0a8b881571adb564
SSDEEP 384:nSiFiZcI83sNo8TUNTUlI4kADcYSv8LJ2JBfpG2sIypVUXKITYTy+LBNj5nDQHyB:ZFQ83nwgUDLJkG2Jyp6sTyWN5D3p
TLSH
T14FC23B72D8A4D9BBACE65BD5B74A3A07DEF04163C6CC9AD4D9D86D0C00975AE030BC1A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 e5e1e04b6914e3de5da533ac9f16382d64233f1e0f63821156e1feea66cc1827
MD5 21b8c5531578ccf42ece4ed8b830db86
SHA1 a74555c983ef7d950cec9bea68c7e78606b7c187
SHA512 af4e29f0104ca42936e34dd2ea2e26ed4c9c7d42d82b772e39ca984bd228e97bf28f64648bbc1040d55aa77ea82c2f098587429d8ed6f3733959a67944fce275
TLSH
T114411C586AEA1148B3B77F5A5FF6A86D487BBD772E06D05D10110E4E0A32B40C861B37
MD5 SHA1 SHA512 TLSH

Submit Download

memory/5380-235-0x0000020E63F10000-0x0000020E64F10000-memory.dmp

Download