hxxps://telegra[.]ph/HIDIMCNWKAFG825-08-25

Analysis

user interaction
yes
max time kernel
148s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
26/08/2026, 10:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://telegra.ph/HIDIMCNWKAFG825-08-25
Sample260826-l3g2dabp21

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
1908	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134322122059919337"	msedge.exe

Modifies registry class 3 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-668679576-120646659-2289335452-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-668679576-120646659-2289335452-1000\{B33A65FE-0B1E-4C8A-96EB-EE2B3ED94834}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2520	msedge.exe
2520	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 11 IoCs

pid	Process
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe
4696	msedge.exe

Suspicious use of WriteProcessMemory 52 IoCs

description	pid	Process	procid_target
PID 4696 wrote to memory of 4648	4696	msedge.exe	86
PID 4696 wrote to memory of 1908	4696	msedge.exe	88
PID 4696 wrote to memory of 1408	4696	msedge.exe	89
PID 4696 wrote to memory of 3516	4696	msedge.exe	90
PID 4696 wrote to memory of 1408	4696	msedge.exe	89
PID 4696 wrote to memory of 1408	4696	msedge.exe	89
PID 4696 wrote to memory of 3516	4696	msedge.exe	90
PID 4696 wrote to memory of 864	4696	msedge.exe	91
PID 4696 wrote to memory of 2652	4696	msedge.exe	92
PID 4696 wrote to memory of 864	4696	msedge.exe	91
PID 4696 wrote to memory of 864	4696	msedge.exe	91
PID 4696 wrote to memory of 2652	4696	msedge.exe	92
PID 4696 wrote to memory of 2652	4696	msedge.exe	92
PID 4696 wrote to memory of 3332	4696	msedge.exe	93
PID 4696 wrote to memory of 4636	4696	msedge.exe	94
PID 4696 wrote to memory of 3332	4696	msedge.exe	93
PID 4696 wrote to memory of 3332	4696	msedge.exe	93
PID 4696 wrote to memory of 4636	4696	msedge.exe	94
PID 4696 wrote to memory of 4636	4696	msedge.exe	94
PID 4696 wrote to memory of 4440	4696	msedge.exe	98
PID 4696 wrote to memory of 2136	4696	msedge.exe	99
PID 4696 wrote to memory of 4440	4696	msedge.exe	98
PID 4696 wrote to memory of 2136	4696	msedge.exe	99
PID 4696 wrote to memory of 3380	4696	msedge.exe	101
PID 4696 wrote to memory of 1764	4696	msedge.exe	103
PID 4696 wrote to memory of 1764	4696	msedge.exe	103
PID 4696 wrote to memory of 1764	4696	msedge.exe	103
PID 4696 wrote to memory of 2012	4696	msedge.exe	108
PID 4696 wrote to memory of 2012	4696	msedge.exe	108
PID 4696 wrote to memory of 2012	4696	msedge.exe	108
PID 4696 wrote to memory of 2236	4696	msedge.exe	111
PID 4696 wrote to memory of 540	4696	msedge.exe	112
PID 4696 wrote to memory of 1684	4696	msedge.exe	113
PID 4696 wrote to memory of 3712	4696	msedge.exe	116
PID 4696 wrote to memory of 3712	4696	msedge.exe	116
PID 4696 wrote to memory of 2140	4696	msedge.exe	117
PID 4696 wrote to memory of 2140	4696	msedge.exe	117
PID 4696 wrote to memory of 2140	4696	msedge.exe	117
PID 4696 wrote to memory of 4552	4696	msedge.exe	118
PID 4696 wrote to memory of 4552	4696	msedge.exe	118
PID 4696 wrote to memory of 4552	4696	msedge.exe	118
PID 4696 wrote to memory of 468	4696	msedge.exe	120
PID 4696 wrote to memory of 468	4696	msedge.exe	120
PID 4696 wrote to memory of 1200	4696	msedge.exe	121
PID 4696 wrote to memory of 1200	4696	msedge.exe	121
PID 4696 wrote to memory of 5072	4696	msedge.exe	122
PID 4696 wrote to memory of 5072	4696	msedge.exe	122
PID 4696 wrote to memory of 5072	4696	msedge.exe	122
PID 4696 wrote to memory of 2120	4696	msedge.exe	123
PID 4696 wrote to memory of 2120	4696	msedge.exe	123
PID 4696 wrote to memory of 2120	4696	msedge.exe	123
PID 4696 wrote to memory of 2520	4696	msedge.exe	124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://telegra.ph/HIDIMCNWKAFG825-08-25
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4696
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x23c,0x240,0x234,0x260,0x7ff967a6c188,0x7ff967a6c194,0x7ff967a6c1a0
  2⤵
  PID:4648
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1988,i,16228837990585776895,16042084684216665514,524288 --field-trial-handle=2388,i,5361409623639934504,321503854157446973,262144 --variations-seed-version --mojo-platform-channel-handle=2960 /prefetch:3
  2⤵
  - System Time Discovery
  PID:1908
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1624,i,14429405181730149150,12385526148702216643,262144 --field-trial-handle=2388,i,5361409623639934504,321503854157446973,262144 --variations-seed-version --mojo-platform-channel-handle=2384 /prefetch:2
  2⤵
  PID:1408
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2272,i,6401634060572979764,4753398490516899552,524288 --field-trial-handle=2388,i,5361409623639934504,321503854157446973,262144 --variations-seed-version --mojo-platform-channel-handle=2972 /prefetch:8
  2⤵
  PID:3516
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3428,i,9893295604038179889,4568940057302464081,2097152 --field-trial-handle=2388,i,5361409623639934504,321503854157446973,262144 --variations-seed-version --mojo-platform-channel-handle=3460 /prefetch:1
  2⤵
  PID:864
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3448,i,4156682456750443883,14404441373871403347,2097152 --field-trial-handle=2388,i,5361409623639934504,321503854157446973,262144 --variations-seed-version --mojo-platform-channel-handle=3464 /prefetch:1
  2⤵
  PID:2652
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4196,i,12263892745936885192,3744936819058242260,2097152 --field-trial-handle=2388,i,5361409623639934504,321503854157446973,262144 --variations-seed-version --mojo-platform-channel-handle=4200 /prefetch:1
  2⤵
  PID:3332
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4216,i,13118403791203156484,3392219645086627159,2097152 --field-trial-handle=2388,i,5361409623639934504,321503854157446973,262144 --variations-seed-version --mojo-platform-channel-handle=4236 /prefetch:2
  2⤵
  PID:4636
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3612,i,3790720094975220747,13884916743142259510,524288 --field-trial-handle=2388,i,5361409623639934504,321503854157446973,262144 --variations-seed-version --mojo-platform-channel-handle=5140 /prefetch:8
  2⤵
  PID:4440
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3588,i,5780364286354488713,10093190669754629472,524288 --field-trial-handle=2388,i,5361409623639934504,321503854157446973,262144 --variations-seed-version --mojo-platform-channel-handle=5180 /prefetch:8
  2⤵
  PID:2136
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,451668868215058785,3444228375826856577,524288 --field-trial-handle=2388,i,5361409623639934504,321503854157446973,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  PID:2036
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5832,i,451668868215058785,3444228375826856577,524288 --field-trial-handle=2388,i,5361409623639934504,321503854157446973,262144 --variations-seed-version --mojo-platform-channel-handle=5844 /prefetch:8
  2⤵
  PID:3380
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=12 --always-read-main-dll --metrics-shmem-handle=5064,i,11414157379337099552,18227135535515926988,2097152 --field-trial-handle=2388,i,5361409623639934504,321503854157446973,262144 --variations-seed-version --mojo-platform-channel-handle=4224 /prefetch:1
  2⤵
  PID:1764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=13 --always-read-main-dll --metrics-shmem-handle=4248,i,12072906847542118614,10742450895929697388,2097152 --field-trial-handle=2388,i,5361409623639934504,321503854157446973,262144 --variations-seed-version --mojo-platform-channel-handle=4196 /prefetch:1
  2⤵
  PID:2012
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=756,i,9359132820075907950,15319302591874051524,524288 --field-trial-handle=2388,i,5361409623639934504,321503854157446973,262144 --variations-seed-version --mojo-platform-channel-handle=6212 /prefetch:8
  2⤵
  PID:2236
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4108,i,2840600378589302082,1682405218624109272,524288 --field-trial-handle=2388,i,5361409623639934504,321503854157446973,262144 --variations-seed-version --mojo-platform-channel-handle=6244 /prefetch:8
  2⤵
  PID:540
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4340,i,608005496468809763,15573719923069477551,524288 --field-trial-handle=2388,i,5361409623639934504,321503854157446973,262144 --variations-seed-version --mojo-platform-channel-handle=6252 /prefetch:8
  2⤵
  PID:1684
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3612,i,14867036423281881661,16219950180756533642,524288 --field-trial-handle=2388,i,5361409623639934504,321503854157446973,262144 --variations-seed-version --mojo-platform-channel-handle=5156 /prefetch:8
  2⤵
  PID:3712
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=4856,i,5841849783114969435,5932888601272531179,2097152 --field-trial-handle=2388,i,5361409623639934504,321503854157446973,262144 --variations-seed-version --mojo-platform-channel-handle=5880 /prefetch:1
  2⤵
  PID:2140
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=19 --always-read-main-dll --metrics-shmem-handle=4420,i,6040179370073840696,17617667037734239549,2097152 --field-trial-handle=2388,i,5361409623639934504,321503854157446973,262144 --variations-seed-version --mojo-platform-channel-handle=3416 /prefetch:1
  2⤵
  PID:4552
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6236,i,13517975270421578501,5257012509459841740,524288 --field-trial-handle=2388,i,5361409623639934504,321503854157446973,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:8
  2⤵
  PID:468
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_collections.mojom.CollectionsDataManager --lang=en-US --service-sandbox-type=collections --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6460,i,2233123035948033850,3466939227253221673,524288 --field-trial-handle=2388,i,5361409623639934504,321503854157446973,262144 --variations-seed-version --mojo-platform-channel-handle=5984 /prefetch:8
  2⤵
  PID:1200
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=22 --always-read-main-dll --metrics-shmem-handle=5152,i,1304120206769503320,1699484851159908368,2097152 --field-trial-handle=2388,i,5361409623639934504,321503854157446973,262144 --variations-seed-version --mojo-platform-channel-handle=5196 /prefetch:1
  2⤵
  PID:5072
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=6212,i,11532941714851506876,13512310781538527290,2097152 --field-trial-handle=2388,i,5361409623639934504,321503854157446973,262144 --variations-seed-version --mojo-platform-channel-handle=6648 /prefetch:1
  2⤵
  PID:2120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=4204,i,4832733722284750313,2196180513969300106,262144 --field-trial-handle=2388,i,5361409623639934504,321503854157446973,262144 --variations-seed-version --mojo-platform-channel-handle=6468 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2520

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:2388

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

blocklist

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Ad Blocking\blocklist
Size 105KB
SHA256 f0ead82c3c8a4cd9959a8cd1cef74705c67e276b4a574243e75c890cb0b0b8fe
MD5 f8a5a8774310485121aa8917052b352c
SHA1 78542cc17bce16f7d0117a4beed6ae29c39c3042
SHA512 94c06ac4086f7321e54c95657a2fc0769092ed3577572d27a9a75f404a57f6b0c02e9bb5c1e8c0c285a577d89a5801c60face4ebf1cee334d6be346c240f09ad
SSDEEP 1536:B/lv4EsQMNeQ9s5VwB34PsiaR+tjvYArQdW+Iuh57P7C:fwUQC5VwBIiElEd2K57P7C
TLSH
T1D5B3B931457E36BF26E93EE828CF1511B84F3912664895D4ABE1FE2C4845E68633CEF4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 1c8e6fcbb66aba64fe595f222fc4117e00e82ccdc0eef2100a1b4f7babb04f87
MD5 398d1e7948d46a763209c466fdacd0fb
SHA1 b26f2c32bc106089a59ce779d792beaba59f92bf
SHA512 a0bbf31d803e7333d004f03de9c261732d00cceb5d82dd64b5f0decf8adc8b840891187c72bb21cce83873e6d4dd2fab89d4c7efa320afe2ef3589678dcb1424
TLSH
T1B6D080277A196004F3964175A483D7061319956129575711F310C44CA9775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 5d2c4e39ddbeb0ac61628bae04f1ac5787600ec893b0e230d1a84d61470771a9
MD5 cd6e704306442404371caebfec7f5b29
SHA1 e4beab8b7820af3633bf7c75a5498a958a95832e
SHA512 de66681a9245e8ece7d7e2ea2080251c395f2aeb8a885ac007eaf16f2ee3a3e36610d2afc17be964a038704371cedfbe4da91143ebed5adac20dbda97768d6e6
TLSH
T13AD080273A196404F7964175A483D7061319956129579712F310C44C99775D553C11C2
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 334B
SHA256 2a79b8024f1acd1443622c9251ceacc6dc5185a10aec579b59ce67051a4a13d4
MD5 639642fbc9f3207b25a817020f2e72af
SHA1 8338a6b953bc75b5e0b67b3eed0277e9502736c6
SHA512 416b790e5e0a5786f1708610ba200d9498a4ab593dbc5444ca51a791c14eee1a9f0eaf43032e77aea4d7df8c1bf938089087269d14ead077695652e93fb661e0
TLSH
T175E026B50CCCC2AEA618688F93BC630DE380373A92CEB91E1B0088C67001840A6877A0
MD5 SHA1 SHA512 TLSH

Submit Download

BookmarkMergedSurfaceOrdering

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\BookmarkMergedSurfaceOrdering
Size 6B
SHA256 4489f9e3e454748b3521eb214e0a5694d562cff3d9ff511cb456953c8f534c00
MD5 377d072e137022223a370760763420bb
SHA1 534e5f914ae99bf0a342a2f7a7e0724bd0d11ef7
SHA512 d1e37e45e8d603c46c9254d7295744104222b09340246c5e5f50d661d4688ccc2068adf1e0cd78599bcdcf475f8a0a6255dcd3e429812aa14cc2e2022309955c
MD5 SHA1 SHA512

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 3KB
SHA256 d44757d6abc597cf93a55231e16734574744c39fc76cff39f7b8a8c1eac7f3b8
MD5 216fef8fe55ae6166c79b2bd40c8de93
SHA1 46061bc4d86356190c34dce6cbfa865ead6fd49f
SHA512 18897b19fd4cbf9b1a7224b4943d1eac892baed672144eb57f251d9396f52a69f4741d3f7e33ae45a9683b17f909f72bc2225180d0e43f0bdbb2c8824f86fa46
TLSH
T1F6718F351D710F82EBD402BF95E3F220757A85E4FA131E39C9606B7E6B1C79802ABC56
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe58843e.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe58843e.TMP
Size 3KB
SHA256 ec06903d313b754069edae8145d5651376b9aeed81e293000a5ec247b2090bf9
MD5 dda8f93669c3379ef1c56c28fa04051a
SHA1 f5bbce0ab41a8983c761905c8c5a14ef9b4b9e70
SHA512 c756a7bd5edd3489ac0194df1f396eb0652701e77174aece55da3b29ddc886cc8138819b332861c6e4e9d42c0fd08ce11a68b8d4602b6e3b4eef43928a9d3810
TLSH
T1D4717B350D314F42EBD401BF64E3F21071BA85D8FA131E79C960AB3E2B1C7A802ABC56
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 eef196c298db8d6600c1b536434211b64252facb269a3b3b7dd4ff2950ab1d72
MD5 363f31111d457e1e95f00cdc57d6dc6a
SHA1 6b655c428d28e4a90e5657e944526611cce7bc73
SHA512 3535a5d4896dc708ed7b9c40c12b3ef1349f3b7d34768f96ba316fd1042bcb032b7c98940a700bcbf3698e8af3ea30fc8e715859759505090077283a98cdfae9
TLSH
T16D31ACF783F0896E891156F0AA146E2BCE6C0515431C3D1AC9D4BF5793F3071E102A9F
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 37e2e82771bf4bd475a67eccda5c4575136a32ea0a55b808b91da9d239b595c3
MD5 e1ca2d28bdb8ed8c94490f3336842b35
SHA1 f249baa6f3250df97dd1397f514a4f8545ec0ebf
SHA512 639b0236d6b0e487f9e5151b61f5866d3e7f8400d919cb702f379677e63c547882d6dd34413a598856436d7e8bcb5c88d3bb153a56429b6faeaca12a68fc05bc
SSDEEP 384:sxZMyBF4MHw/fn6s3wNHRHaSHbRU0/aAbt9:s0yBF1Hw/fn90HR6SHbRUGaAbL
TLSH
T16B42F9116A34A977CCDFD209F951BF63D6F90572A2940E54AAFCCA1C04E6EED220781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 39bad5f0d9725afa4f5bab5b751e265e06e9910c358e2ed5119c8e5d86365e32
MD5 1927e8f5d6793113d370c2093c13b8ec
SHA1 0e6fed2e40f360ca95f1261cee4d61749d59a1f3
SHA512 399903eb3b1e5ae84ec8428eacd3c37002ff5078447928a779313cbed40a975a58dd1e8a5154fb2ab3c928f6af1dc96c75de0d4d593c0a0209f6d6303a8408ff
SSDEEP 384:sxZMyBF4qcHw/fn6stjNHRHRSHb2gXKbtd:s0yBFfcHw/fn7RHRxSHb2mKb7
TLSH
T1D752F712A6346977CDDBD209F941BFA3D6F4547292940E54AAFCCB1C04E6EED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 08cb8173a98e2a5bd1bf2081662640c73a7b64fa11da924d8645b453cfb9af0f
MD5 6d63b4fe815345529474cd8f9caaa42a
SHA1 82dfb2387d69a1e15bb5ee33a7a9f1e1b9393faf
SHA512 e7ab9df1bc65be6e0441360a20a586f65921e6aec3f1f277cd0083da99aed08b3e140c463d9b13b655dbcfadcf95b849184d0ea6c9a738879a263d8f4e94fddc
SSDEEP 384:sxZMyBF41Hw/fn6stjNHRHRSHb2gXKbtd:s0yBF4Hw/fn7RHRxSHb2mKb7
TLSH
T14C52F71266346977CDDFD209F941BFA3D6F8547292900E54AAFCCA1C05E6EED220782F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 5e34c0ac44081894af97a91a06dd61595a88a5f4d64716cf58b186b21510f603
MD5 4c9a7bc6520b59423debd5a53d1000b1
SHA1 5768d0fede5b982e7aec0a5f93c6e9ec1a85f657
SHA512 5a874eb50e8418f0ced523681ff2f1cd5396bf4d2957b1853bce77e0044e52f945127e7732cf44666b61d3f463c5188e8fd0ca6cdccf4081ab2d51a64b20649f
SSDEEP 768:dy8bqn+WvSCt68F1+UoAYDCx9Tuqh0VfUC9xbog/OVnZLlRTKVqro3:dy8bqn+WvSCt6u1jaCZLbWVB3
TLSH
T11ED20A3B280CCB7E4F845E5DDC26AF966DD801CB6B988D4447FA884C03C76EA511B5DB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 9c6fc19904a5e4a5404a2c78a472b4e2b818ddc52444b475e3fe6939eb4596c1
MD5 231f1bbba3480012590158dc14c9f313
SHA1 708523b5371af9b4e79f4df91f6910d7ec79d17a
SHA512 6fdea0dd5fdda1a65552d35f5f0a96a4064edb9e21c6daf95df0df4fd901712ccd0cd9397b89c11843ad628498b25ce4b6ec16c8e2ca7132e3f98e5d402861f6
SSDEEP 96:KcOUKnqCKAwKxqmhZsLfZb7xG/2sEnxK84E5xoBJen/:invrhZsLfZb7o/2Ln94E5OBJen/
TLSH
T118918502713B228138FE2908929395768E4272633904A46F7FF944A60E7AF515EFDDDD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

ebd8f470-5330-4476-b4d7-bc78a02e2a1d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\ebd8f470-5330-4476-b4d7-bc78a02e2a1d.tmp
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 26KB
SHA256 2832dccb7c895132cc6dcc2fb5721cdee27c537a8ba17e95ba6a8bf5f291d7e6
MD5 201d4fd2c36804742aef8e8f6c60a855
SHA1 16fab09a25df41708418eacb36c3163200a7febc
SHA512 e842a7a012f765aa1a962940a6d0bd5428abb205129e00c9a5d00479f9640d0f8a777cafca72ac4cd64725f35c8a9873fe69aec06453e97ddd0844be68ee22a7
SSDEEP 384:tiFiZcIlsNq8TUNTUlIlmGSZ8p2Ea+5OHfaXFjH0+LBNj5IQoQ:kFQlDwg+mplaYOH89H0WN5tD
TLSH
T186C219F248E7887AD96D5747E77E2E038EBCC063B584A950B3885B0CCC865BFD30A815
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 8e9e0035d0c83b20d1ce62254cc7f222d9eec3b697235d55abd0870fca3f7773
MD5 0a6eb7e19898ac4680ae068ca32f9d2e
SHA1 4e98ac4981ad734ae280a0c59b25f070fbdcd4d8
SHA512 ba97d5dcde0a67fd2cc53127a3ae8733d3a5d309d78927508a421710d5bf677a3931f89cea59355e1882e2a6d74df1a9df4b469d9a5911f33c80652c31d89b53
SSDEEP 192:vONm6Db6QmiUy6qHBa+j9OmaftmH+Rgt6U6:vONm6umHBa+5OHfal4U6
TLSH
T10002F93569786CB79EB26E49F88B3B279F94107BD9552F84DAD81F0C00D765C2307836
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 d004ca14c44c93335039ed8aed2eb7e4bdd9c3f9f5dbd046274c19058f75a780
MD5 d6f46ce6294274fff76f15f16b8f0310
SHA1 9e73cdb215121656af1854d8329479238ec389b4
SHA512 b508816ff36c4041a13f7314c1a1554fe7cd9bd9fe92d18b699666178c71caa9b1e807c237740d00b6fe005a093275075a432e5394cb310fe4a82febbec6f79c
SSDEEP 384:lZcIhsNJUmGSZkp2Ea+5OHfaXFjM0+LBNj5IQoQ:dh6OplaYOH89M0WN5tD
TLSH
T1BF82AF736C785C765DA5B244F98B3A179FB4807796CC6E90D5DDAF0D00C6AA8230BC2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 ac7aa35a62aca0d0f750890d9dde3f89fb651c56a2cd8f887d41baba12c627ae
MD5 38fec00145f3a82c48fa9fb7c448760f
SHA1 8c0eae59371e919223da4c7e474a6b36406b29a6
SHA512 5b0d53df61dc43f017981b0dfe2c1c0e3681b6d2fe5b4f7963ba8a052dd45c5e4f5cece03e63d0619d36ef708ced62aa8dccb9f8f9df0e31cb41d7152e2366df
SSDEEP 384:QZcIhsNJUrGSZzYEa+5OHfaXFjM0+LBNj5IQoQ:uhFl7aYOH89M0WN5tD
TLSH
T1FF82AF736C785C765DA5A244F98B3A179FB4807796C86E90D5DDAF0D00CAAA8130BC2E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 b794c465952a16ac2048595fb15fdd0cdfdb21a3aae3ad1bcc077bdddc762a74
MD5 eb3f050985ab74973ffc9e3950aceb4c
SHA1 9d7f7a1031c5b5b22fb56ad96c6b81420cc5040b
SHA512 07b84286a89dd06bd2e98bd7528315c765057609f712c1c8d0885541d8e5bf77f896bbf7aaa5e1086b05f0250e4c8005e83b21b7f49a392cd8f69fe48697a273
SSDEEP 192:eONz6Db9QmiUyyqoBa+j9OmaftmHXFgEZNzLqLU6:eONz6DkoBa+5OHfaXFjP0U6
TLSH
T190122B327878AC775EA2A584F48736179FA44167DA4A7F91D6CC2F1C01DBA9C230FC26
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 8755ba8361209f0576c2cda418342628a04bd0d44cff7805ef8fd827d63e75da
MD5 b7e12db3da1d927c3315a34a7adafb70
SHA1 ec347d7d202c61126f519a0bf8d819d64c63f74c
SHA512 4937bb6f7407977350b26d2db6e61fb69061c55fee921881cc9bf4d28331190bfe9f497cd8545f3446ebb1e35fa618ae6e780f48143f97d93900cd6f8f72d9bb
TLSH
T1A6E00441F3100157D414433044D3171033D1C170113113475C0003517C4370C0D033C0
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe5893ee.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe5893ee.TMP
Size 392B
SHA256 726cce129ae50402ca4a4e9337f966923c5cd0acc8a85709afb37a89e1cee484
MD5 bce6f8c022545fa51571ce565056460d
SHA1 5f49550786dcfd8386a5d3bba1ed14c7aef12f62
SHA512 120010e8c3855bbd09858c89d0955a75545e9c277abbae1896a2d3aabdc27dd06c60ef005dc487ba86a4802e0552847016742d492d041c936e93f4ff02f11ffb
MD5 SHA1 SHA512

Submit Download

5064d355-5149-41b1-a002-2314334ac17d.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\5064d355-5149-41b1-a002-2314334ac17d.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 9088b86ddf90ee317c87de511afd6a8184d006ba1c20001a37ed8b5d89887c18
MD5 b17a8980bbe1ee7b17b94a8b5bd8c2e7
SHA1 6f179354ead74945bbdee3444176fe0174792904
SHA512 26278285c5d4b1e08cd0b26139c113e9e6e35fcbd400f91bf41c418633d7cc777275a3dc1513d86c5cfffba524353bea8aaba77ad529284572405042a2f55df4
TLSH
T1E1415D5CA6F91148B3B77E5AABF6A46E487BB9372E16D05D10110E4F0A32B40CDB2737
MD5 SHA1 SHA512 TLSH

Submit Download