hxxps://monochoputeritics[.]top/

Analysis

user interaction
yes
max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/08/2026, 06:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://monochoputeritics.top/
Sample260826-hl554azzht

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4728	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134322006384501866"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-1788976790-1541110888-1636651838-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-1788976790-1541110888-1636651838-1000\{3577D459-D114-4A9D-B5A1-EC2D3BD9A1CE}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4776	msedge.exe
4776	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 9 IoCs

pid	Process
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe

Suspicious use of FindShellTrayWindow 36 IoCs

pid	Process
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe
4592	msedge.exe

Suspicious use of WriteProcessMemory 46 IoCs

description	pid	Process	procid_target
PID 4592 wrote to memory of 4468	4592	msedge.exe	85
PID 4592 wrote to memory of 4728	4592	msedge.exe	86
PID 4592 wrote to memory of 2428	4592	msedge.exe	87
PID 4592 wrote to memory of 2428	4592	msedge.exe	87
PID 4592 wrote to memory of 2428	4592	msedge.exe	87
PID 4592 wrote to memory of 4828	4592	msedge.exe	88
PID 4592 wrote to memory of 4828	4592	msedge.exe	88
PID 4592 wrote to memory of 1072	4592	msedge.exe	90
PID 4592 wrote to memory of 888	4592	msedge.exe	91
PID 4592 wrote to memory of 1072	4592	msedge.exe	90
PID 4592 wrote to memory of 1072	4592	msedge.exe	90
PID 4592 wrote to memory of 888	4592	msedge.exe	91
PID 4592 wrote to memory of 888	4592	msedge.exe	91
PID 4592 wrote to memory of 2104	4592	msedge.exe	92
PID 4592 wrote to memory of 2512	4592	msedge.exe	93
PID 4592 wrote to memory of 2104	4592	msedge.exe	92
PID 4592 wrote to memory of 2104	4592	msedge.exe	92
PID 4592 wrote to memory of 2512	4592	msedge.exe	93
PID 4592 wrote to memory of 2512	4592	msedge.exe	93
PID 4592 wrote to memory of 372	4592	msedge.exe	96
PID 4592 wrote to memory of 372	4592	msedge.exe	96
PID 4592 wrote to memory of 372	4592	msedge.exe	96
PID 4592 wrote to memory of 960	4592	msedge.exe	99
PID 4592 wrote to memory of 4408	4592	msedge.exe	100
PID 4592 wrote to memory of 4408	4592	msedge.exe	100
PID 4592 wrote to memory of 960	4592	msedge.exe	99
PID 4592 wrote to memory of 4192	4592	msedge.exe	102
PID 4592 wrote to memory of 3756	4592	msedge.exe	108
PID 4592 wrote to memory of 3756	4592	msedge.exe	108
PID 4592 wrote to memory of 3756	4592	msedge.exe	108
PID 4592 wrote to memory of 2792	4592	msedge.exe	113
PID 4592 wrote to memory of 2792	4592	msedge.exe	113
PID 4592 wrote to memory of 2792	4592	msedge.exe	113
PID 4592 wrote to memory of 1944	4592	msedge.exe	114
PID 4592 wrote to memory of 1944	4592	msedge.exe	114
PID 4592 wrote to memory of 1944	4592	msedge.exe	114
PID 4592 wrote to memory of 3060	4592	msedge.exe	117
PID 4592 wrote to memory of 812	4592	msedge.exe	118
PID 4592 wrote to memory of 1524	4592	msedge.exe	119
PID 4592 wrote to memory of 2420	4592	msedge.exe	121
PID 4592 wrote to memory of 2420	4592	msedge.exe	121
PID 4592 wrote to memory of 1476	4592	msedge.exe	122
PID 4592 wrote to memory of 1476	4592	msedge.exe	122
PID 4592 wrote to memory of 2540	4592	msedge.exe	123
PID 4592 wrote to memory of 2540	4592	msedge.exe	123
PID 4592 wrote to memory of 4776	4592	msedge.exe	124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://monochoputeritics.top/
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4592
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x2b4,0x7ffb40b6c188,0x7ffb40b6c194,0x7ffb40b6c1a0
  2⤵
  PID:4468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2088,i,7797232336058788601,11713791715808503379,524288 --field-trial-handle=1956,i,468552674694699773,9461326069511201080,262144 --variations-seed-version --mojo-platform-channel-handle=2292 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4728
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1636,i,13787641857812484014,3305880009509874732,262144 --field-trial-handle=1956,i,468552674694699773,9461326069511201080,262144 --variations-seed-version --mojo-platform-channel-handle=1952 /prefetch:2
  2⤵
  PID:2428
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2408,i,2358776975505716101,16461639500963063925,524288 --field-trial-handle=1956,i,468552674694699773,9461326069511201080,262144 --variations-seed-version --mojo-platform-channel-handle=2532 /prefetch:8
  2⤵
  PID:4828
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3436,i,12867012740414739750,5295978163286764322,2097152 --field-trial-handle=1956,i,468552674694699773,9461326069511201080,262144 --variations-seed-version --mojo-platform-channel-handle=3496 /prefetch:1
  2⤵
  PID:1072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3440,i,9497876110886198142,11580888590656860476,2097152 --field-trial-handle=1956,i,468552674694699773,9461326069511201080,262144 --variations-seed-version --mojo-platform-channel-handle=3500 /prefetch:1
  2⤵
  PID:888
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4260,i,1040013116608477506,8869527012259559232,2097152 --field-trial-handle=1956,i,468552674694699773,9461326069511201080,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:1
  2⤵
  PID:2104
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4272,i,4256143227106819117,11554660612193311186,2097152 --field-trial-handle=1956,i,468552674694699773,9461326069511201080,262144 --variations-seed-version --mojo-platform-channel-handle=4320 /prefetch:2
  2⤵
  PID:2512
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=5072,i,10066650252081442486,17548373185895191336,2097152 --field-trial-handle=1956,i,468552674694699773,9461326069511201080,262144 --variations-seed-version --mojo-platform-channel-handle=5092 /prefetch:1
  2⤵
  PID:372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3540,i,12786787727886264621,761487558565097790,524288 --field-trial-handle=1956,i,468552674694699773,9461326069511201080,262144 --variations-seed-version --mojo-platform-channel-handle=3736 /prefetch:8
  2⤵
  PID:960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5232,i,17081990680353619868,16313467229229670775,524288 --field-trial-handle=1956,i,468552674694699773,9461326069511201080,262144 --variations-seed-version --mojo-platform-channel-handle=3680 /prefetch:8
  2⤵
  PID:4408
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,14285220621917257358,14384743110906256165,524288 --field-trial-handle=1956,i,468552674694699773,9461326069511201080,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:5092
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5892,i,14285220621917257358,14384743110906256165,524288 --field-trial-handle=1956,i,468552674694699773,9461326069511201080,262144 --variations-seed-version --mojo-platform-channel-handle=5916 /prefetch:8
  2⤵
  PID:4192
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=6260,i,3271230839905517972,7580453345118737841,2097152 --field-trial-handle=1956,i,468552674694699773,9461326069511201080,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:1
  2⤵
  PID:3756
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6392,i,13577282258867629135,765641986462443824,2097152 --field-trial-handle=1956,i,468552674694699773,9461326069511201080,262144 --variations-seed-version --mojo-platform-channel-handle=6412 /prefetch:1
  2⤵
  PID:2792
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6480,i,14116061479479458774,15574594601315221142,2097152 --field-trial-handle=1956,i,468552674694699773,9461326069511201080,262144 --variations-seed-version --mojo-platform-channel-handle=6484 /prefetch:1
  2⤵
  PID:1944
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5932,i,12397829893141648648,33951637234136494,524288 --field-trial-handle=1956,i,468552674694699773,9461326069511201080,262144 --variations-seed-version --mojo-platform-channel-handle=5968 /prefetch:8
  2⤵
  PID:3060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4296,i,3067446864153358022,10843012682719566481,524288 --field-trial-handle=1956,i,468552674694699773,9461326069511201080,262144 --variations-seed-version --mojo-platform-channel-handle=4324 /prefetch:8
  2⤵
  PID:812
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4332,i,12583020643153543950,8897186319372137710,524288 --field-trial-handle=1956,i,468552674694699773,9461326069511201080,262144 --variations-seed-version --mojo-platform-channel-handle=6352 /prefetch:8
  2⤵
  PID:1524
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3516,i,1261582418508445910,4123023680202877658,524288 --field-trial-handle=1956,i,468552674694699773,9461326069511201080,262144 --variations-seed-version --mojo-platform-channel-handle=4292 /prefetch:8
  2⤵
  PID:2420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5844,i,15528999414990320622,1815659740898279177,524288 --field-trial-handle=1956,i,468552674694699773,9461326069511201080,262144 --variations-seed-version --mojo-platform-channel-handle=5828 /prefetch:8
  2⤵
  PID:1476
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4408,i,10682654649131582372,4835349284865947221,524288 --field-trial-handle=1956,i,468552674694699773,9461326069511201080,262144 --variations-seed-version --mojo-platform-channel-handle=5820 /prefetch:8
  2⤵
  PID:2540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4352,i,9174966535739457742,14663511122964326965,262144 --field-trial-handle=1956,i,468552674694699773,9461326069511201080,262144 --variations-seed-version --mojo-platform-channel-handle=6220 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4776

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:1800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 bd5dff6b6a2953b678276fe774acb1020dcf956eee918258c4fbcebd9799de50
MD5 ad9e9cc59d40b3c4a865c23e526c194b
SHA1 ec6e5c23153f46461256dc2ee3316df628e2eda9
SHA512 781d6d2d74c84caa1d22367f03cb2eef3a2125624c47277182248dc2b092992ad8756b1ea9759b2d56ee2b90c008cd691688382416e421209d33f546892f8550
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P74:fwUQC5VwBIiElEd2K57P74
TLSH
T14FB3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 6d0f88884e23b1418c456620b79662feebdfd970ca9325ba2981c94b3b0f0b2f
MD5 7060eae8ec426d15de2849b1f7d261b4
SHA1 b252d90b9d7050d0b9b7c03141d9d3b7cae404ac
SHA512 8791005fae20dc1dc5dc5b0086efe814e0b1e36781ef1931cc1fc699fc4cb34d62ab3f9a83f4967824f3bb71aef6adc6ad457ab7a6addcba99f9e9b473eabb4d
TLSH
T118D01222BE08A415E65BA271A502C7141F5954A124938651E224D86CD9F84D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5b701b240f688ccd0cbb893821bc75fe1862d60cc935acf15185f5354486114d
MD5 a6b96bc3fb82f67fe02c065306c79a1c
SHA1 ea83f0f8e62d29a7ba15fc739e6704dfc873ba27
SHA512 23d1a6166b9d175d76e619ebd08ffc2ee62d59f8778f9eb54db2c85d98f0544424fbe4f5d47d0df434e43bdecd039785347df7dcc039a40d571210c87fa7f782
TLSH
T17AD02330ED08BFEAF03B317C321002083D8C14D2440340D1E414097D8CAD48286E0EFA
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 4d517b88a0fb88494276c126764235de9ee52961c86cc4d3abaf517b10a649a8
MD5 dde9ea8dd9c7e315ef614ab3476af02c
SHA1 e03e201e89770d15b4040d579c2cce8684959a2c
SHA512 410e016336529d709de957d44e67238e4f6592b9ce6646395a9e45ce592e7810b4cb6b1b6df5d8b26875a6aa235b77d41c0983ccc055556f8b8c02224093fdd1
TLSH
T16DD012227E08A415E65BA271A502C7141F5954A124938651E224D86CC9F94D49696387
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 e05b92803123c27b763d3abf59d71eb553537f7e330b17dbf6b21f329e0f97e6
MD5 9d99ae44d52c9619ab132af50c66115c
SHA1 39731305be9d5bd71f0af28a7ef200b5c9ffe525
SHA512 8a1d7fceb47e59a8cd3985333aa8060d8af1918f9aaba842f78002203758ea23bd243ba12d7b772f171901bc3fb9dee37fe71c2eb184f869a04a4c9335220fdd
TLSH
T1AEE0209608CCC25D970C65879168630CC180370F92C4A9257704855C3303480F691E64
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 352B
SHA256 c814be567c2d855771485a9a8ae1d17f681ebac4eb252b3f7ea46aea1d05cd62
MD5 5593f47b1767b54044a732c145ee20a3
SHA1 7ca3c52fef29e76bbb158fda23f50aca5e91eb49
SHA512 6a960f490d5ed916a3252354ff48ffdc6f94b83daafc2af6fafb30e5f99713fa28990538ad259ab79db0e7112fd8c84fee819cd4738cc84081ea93fd85967c99
TLSH
T142E0D8271BAFC399A509E7DBD4595F18C120F287964CCE6A220CB24C3D11C444275288
MD5 SHA1 SHA512 TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\MANIFEST-000001
Size 158B
SHA256 249358b1eab901f0b034023569e7f01b1f94c9179591789d99d6f279761d6e1c
MD5 e3fe72c0f542fbb29d9eb8933eefb382
SHA1 fce9a5a6bf89b76d58b4c0f0c691531330ab3b3e
SHA512 f71315278d44c74df19833e56e16d62705ddd45cc9bbabd13be55f51927a3d7464736846a1c4bcda6770c5b8c0720e1defbfbddb5206de648079efb1a9250340
TLSH
T17EC080D9BD4D845FD385187E5716F00007906511942796171650FDC032419A01E29220
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 61be7006d9af963cc628e58f1272382c99fd6bf9cca4bd86ec842dc4435d4d05
MD5 6f7ea69574d3bbae944f2d818cf0c1da
SHA1 c19aa47f212019f6247696d4759ea925ec4791a2
SHA512 312aa8dd3129364dddf1e180422f77c7ec8006cfae890a58c7d7212561198f2ee138894c0301e0386dedc95256471a30d39cfa651d9823ab19c75be13a55147a
TLSH
T1F9714CBE01262079D35080B9A2DD05F539F1A7EBF1163F5910E79DF23E8D3158C1A078
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 925b7ed765bad2ef95e136434450961a3c7d51ddf753ca18e3773c7c3ae04409
MD5 6c5d0fb91ae08def31f3d0b2919a524e
SHA1 0533464066a7c0a111a65dcee486b5703c435b0d
SHA512 4e75b4f343d857348facd1d28af90e98a4f7b1e7085ea337fdfd0466ced16928892aae950ddc5ead53dfb3d4fd3456ac4760f19188b27d58ba11d160e66ecd16
TLSH
T14E713BBE011620B9D71080B9A2DD05F939F5ABEBF5163F6510E7ACF67E8D315881A078
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe588c4d.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe588c4d.TMP
Size 3KB
SHA256 21f59e7a6a1634813e76fa1e34254b6ee56a6c41da92f854ad83f2b4824100c2
MD5 207a83530ef17d901d7a3394691de727
SHA1 682f2bd34551d5b767ac2a63d2ffebee42be7f5a
SHA512 5475dcd3405c0da5c31aa8b2ac59cada75e3d5a387891a1ad73724b9cb87046bece2641eea7d1762d74ca477505bb5b3ca23ef1ab5cc1368d729271a58309dbc
TLSH
T1BA714BBE01162079D31480B9A2DD05FA39F1ABEBF2163F6910E79DF27E8D3158C1A078
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 2KB
SHA256 23b5c2c3f7757a60fa3038091cec0bd255abffbd69ebe2abd35241f8b867ff2d
MD5 25a5fd6399f7b6538caed9cc7e32781e
SHA1 bf3a82bd60117d82a7c0dc63961d58cf6849166b
SHA512 d8970471442716455ebd851df8f712de0af27e3b7b5d9a88caea2b322329a2878081f134cde670a1e6dd8483c3c7308c1b9601e632d0159fe3ac450d91c76a37
TLSH
T15051BAF3C7E5852E8805A6F09A14AE2BCF2D0651432C3C5999D8BE2BD3E3565E10269F
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 4e5109e37a243f639f6bef31b77ff723d1563badb92946482b390a827bd7ef35
MD5 b0bc0dcf1d2f38300133570794e7a8be
SHA1 8b980945bd6609f55e343b5483ff4640ac4f95de
SHA512 35a5e5054a9ae19b5ffdfddeeab348ccc57b6abedcf3e276a60d314f6841a1fbaf6219267c3b39fb588b0e4b0215845abb0c8ed66d3a468fc3266dec0a3ca71f
SSDEEP 192:sxZhRayM/jK1Ml8Mka/f2usO0uZVQIdpv+dHW6+WNNNgYf/Yvd3wv+kIgrJ:sxZhAMa/fzsOfV+Hbjv/tvB9
TLSH
T1A152D8126A34697BCCDBD209F941BB53D6F51562A2900E44AEFCDA1C04E7BED220BC1F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 d94ba71711578e0cf04168b6bd71567be68ed6026c9889b34bd4dfb26d58df68
MD5 c6416507e2c2732e36a3b49d4514b639
SHA1 548f8c5c5841bd875e83f1a9ad4b9fc5ff8d77fd
SHA512 d5e174a4808dcd061fb7134ba7ada7fc9ef6f0f313d172af2429800abbfc200fca9b3b755bc20f2ad1c60b0775321d6912c704956d2613b439bd73b9a118a652
SSDEEP 192:sxZhRayM/jK1Ml8UQ+Xa/f2usj0UZVQIdpRs+aHW6+WNNNgYf/YvHwIv+kIg5SJ:sxZhAq8a/fzsjRV+Hbjv/avBo
TLSH
T1BE62D652AA746977CCDBD209F941BF53D6F55472A2900E44AAFCDA1C00E7BED220B81F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 4b3ab091b65204d46d21082de2f32361ce97194830aaa24deaae2d8ed1a8171e
MD5 b3823d5b015d7b15bd1079a96ee24bf3
SHA1 3209bce76d10ad2d769147661691d8b7d40952fb
SHA512 9291985d5d5f7951489aaf3ff256862f17bc8f9c8d2b0f85054ede3a26c5c7efe29fb149cb4935bf6f5ed650075ec3f89946b3261976884a638bdb946f4694e9
SSDEEP 192:sxZhRayM/jK1Ml8MXa/f2usj0UZVQIdpLs+aHW6+WNNNgYf/YvDzwv+kIg5SJ:sxZhAPa/fzsjRV8Hbjv/NvBo
TLSH
T18C52D712AA74697BCCDBD209F941BF53D6F5546292900E44AAFCCA1C04E7BED320B81F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 f7b224f819309340bf1f275a0ceff3c9ac5d9b1b523ee0d9480284e54753d2c0
MD5 7b883b3bbb9e3c9e9bf6faaab4412d95
SHA1 ebe84e16bcfdb7d7bba162ae72712457a79dd002
SHA512 e40cd7933526b0f80a8869f03c6c6695e90be71abe8e78f7dd6b796f272018803383cab393be82eb55d8acbde740a208ce6687d1030d4aff6d2188ab9792b8db
SSDEEP 768:SgseJ3xWvhfyn8F1+UoAYDCx9Tuqh0VfUC9xbog/OVYcLly0ppNroUC:SgseJ3xWvhfynu1jaVcL88pmB
TLSH
T1FDD20B2B280CCB7E4F844E6DEC2A6F966EE801CB57984D5487EA884C02C77EB51175DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 11c8972ac127ebc684f17a543293f6a365ad58a475d1a27d804ece0d1b91c1be
MD5 e3ae046f7253ae7b9ff26c603df6b1bf
SHA1 1d7d53bb9839d78872c998d2549e8e0c18702e81
SHA512 a68aa0c54f23018ce74aa5dbaad3c95751ff17114c9d75e67d58ee7f706c026bf7295c411cc481a6d79ba0ba5a9f3c920054d68876a2098b4d44120b7a316516
SSDEEP 48:KYHIhKggkXyhWIPKvKY/y5mIPK/aU9sJ+:KYH+KggmSWsKvKqqm4K/aE
TLSH
T145911916343B22023DBD254CB2A5A9778E4631D3745CB8AFBFB814624D66E110EFE8DD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5929c5.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5929c5.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 23KB
SHA256 3ef4738f25c2a109b76f9e2662553ae0a0c75ebaa461c009edb39e7e05b83d52
MD5 160e5b9c98b6fd48f295c644e7fe07f0
SHA1 3d7b0ea23897c634a8b8b0e38d454994c51f9c5b
SHA512 1856deb97fcbaeb17c7ebbf292cdbc1976cdf11a26fcf89a466c20439048c54306841e38fbab877f6151b750a299fc5042a3d64bbff3d9dccace8b89023d07be
SSDEEP 384:1iFiZcIMsN28TUNTUlIlcTM7ew/+uYEimL8him:8FQMXwgGM/+u6mL8him
TLSH
T189B22CF248D7993AE96E9743E77D2D034EBCC067B5849A40B3D85A1DCC961BFD30A811
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 45175454c6b72da041afe7637854e38080b5b64585698afb160a7290bb9bc8c6
MD5 1c25922110f48afd277dd04b51967b57
SHA1 da6ff56a29a0c332c221a06da727c5947a43c8c3
SHA512 90a645234e5ca71cb94b732dc3ca468706691279898d94cb259fbde6ef8c4b0b2c31370cfc5679b9007b38cb6a907fe9f27b66fffe1ce4ebcd0ff887304d76c5
SSDEEP 192:u3m+xasuheOwQxMzsNFUcQ/SupKM7dAwQmiU1tmYB2MTc/CsbLq8z1BqAim:JZcIEsNFUcTM7ewSYEimLDhim
TLSH
T1F9725D715CA4AD7AA9B7F141F98A32135EB8902B93C45F40E5ED7F2D00DA5AC230B917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 bb3e09842afa01577c831c39cb4be57bbdacfa9cc9b976842783d30af157c102
MD5 f68af3d2b5b5780cc078c44bc9359aa1
SHA1 cb3c17ab1512718f5194f671058560d36eb79c17
SHA512 749ad7faee60dc7df20a934edc53b053d8828c2b7fa43a86f905ff4e0297704c9c28d35e5770663c5e02d4e4259adf3ee281db30913f94ec478e2da1af07d301
SSDEEP 96:eqONk9QsjpflMoUZre5ih/cIPURHl8h4otop5M7ODABjPYvlCr5pgz6qNGebL5Fa:lON56vMtPQmiUy1kThTc/CA8475pWU/u
TLSH
T1BE021935ACB86C7BEAA7AD45F48A23171FB0216FA5D05B50EAE82F1C00D764C2307D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 15KB
SHA256 0f55fc87ce55a335dd7b102a3b05b0ed05d7745ea1174275eaef8920fbc20dc8
MD5 2a49ba309f2c19a95813c1b79ec364bb
SHA1 9bf46918dbd2ce530383dfdc4f4bb297b84d0a35
SHA512 fa8b04f83e19640ce4dd798c64237f6b2783c7153e5381bc932fa44cb0b6f320d14ad24442a259cc4af9ca3de091585d25f211294f2616e364ecf8820d0339de
SSDEEP 192:uHm+xasuheOwQxMGsNFUvQ/SupKM7dA3QmiU1GxYB4MTc/CsbLq8z1BqAim:hZcIhsNFUvTM7eZYYuimLDhim
TLSH
T1FB626D716CA4AD7EA9B7F141F98A32035EF8902B97C45B40E6ED7F1D00DA5AC130B917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 9KB
SHA256 ddc49271493d24ad3dc3e1330c944d57fb18c2ed29a6546ee1a833305129e56e
MD5 a90f74361899071c6dfd4341f4ca22d8
SHA1 bd4426817f22b204462db3607e20a4adddcf94fe
SHA512 c7e69de700bc4cca16f16ee455874474ed1298a387bff05aaae2b581e33118e36299856b98a1e1d76d9bea65d1f157b68aac7e980bc897034f161aadc07272c7
SSDEEP 192:/ONH6vMKPQmiUyhkzhTc/CsbLe80IBqAU/u:/ONH6UKRrzhmL3hU/u
TLSH
T1E6122B72ACA8AC2FAD93B441F4CA32175EB4916BE6C49B50EADC3F1C01DB55C230B917
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 16bbc970b0aaa7f6e8b218fb39c218c78298fc2018da79f9f183049fe6fe2102
MD5 ac8f802e91faf0f140b3139720945a0e
SHA1 ddbdd8e53878a6b6f805d72c7fe55e778006b056
SHA512 08cba466f3840760006826dad4d8f1fd05c1ffd3c4a9c791a894aab4dd51f83b29d279706a531c92ea8362d53b0d8f51d3faef9ce0dbd5e43b3230376bc61f1c
MD5 SHA1 SHA512

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 4944848f5bafc3c5caf1074ee1ce0502227d33479bd7ce6c10d3940aca06da18
MD5 e11236eaf27e3db3de85859b3056241c
SHA1 7f89322cf6145218702fac60340ef315d33535df
SHA512 772ad8dde00797de21884a3c3a51a2a12369b1c0e81766bb8dc536d8e21653f508f9b79037f594e8bf81db24af8db88fbf00cb3b088a5865e8daf2a36074b5f6
TLSH
T1BDE00202E2004447D000877000D71F113EF24424033302546F39017C3C333413D00710
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5a5ebb.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5a5ebb.TMP
Size 392B
SHA256 ad8dc2923547806a20f496ff768a7587a78007fd553a673a1d7a7544eda2dd7b
MD5 16eac5aa224c33630602a61d717dde86
SHA1 9e250518707e1fb2fd924f27fbfa04142a111920
SHA512 7d185b3813410e18b9ddc2cc5fa2420ad753834b24fd109cfb3e3327926f84bcee3adeb4be9b035c6064a2ae46b0df0ad27a6a931aedeb3d15c09e230118ade4
MD5 SHA1 SHA512

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 8c0fd849c2c035ababdbc110dd755a004a52ea42d312e5b1d91b1f371601b6ad
MD5 65108d5a827975c7f8ce5c3c96281812
SHA1 a148091ecf210c93bc14c1ec3fa78091cf121022
SHA512 a7f16340fc6d03450c1c6224a676a6180a57ec998c74cd9b32f739fb83aa360e966ca8e519fde10b25dec7f770e8215346d78ff4dbcf17f1fef832d37e09fb7f
TLSH
T19E413759B6FD1148B3B36E5AABF6A86E487FBD372E06945D10010E4E0622A40CC72737
MD5 SHA1 SHA512 TLSH

Submit Download