ffb131bf323e4e88ed968e6f7a26999c468bc19a3804188499cbd7e064ac4577

Resubmissions

28/08/2026, 02:47

260828-c9x7hasfqd3

28/08/2026, 02:44

260828-c794aasfpd6

28/08/2026, 02:42

260828-c7emdasfng3

Analysis

user interaction
yes
max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/08/2026, 02:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Super Mario Maker for Nintendo 3DS (USA).html
Size 6KB
Sample260828-c794aasfpd
SHA256 ffb131bf323e4e88ed968e6f7a26999c468bc19a3804188499cbd7e064ac4577
MD5 07980c5be4af87f0f4ef7eeb46c0ca8c
SHA1 2fbb28cc8e81245e20e88a936b68284dcd37725a
SHA512 5b619ab7955c38a3b182c26f50d544309a2d4d5828b870df7e8abdc7311c701e2bee8588f40a6b508a2a4eca7f9baf5c6155c6e55f4d3f0bd02e886ef8430c23
SSDEEP 96:PNyMtoXZzIEb0EaW87sE23jRYg/8y2tek8tJu4SPYzueh85Gmw:PNFtkCBlyH/kQLO4hy/Jw
TLSH
T182D16D775E33101693FA9F5528B6731CA12076753D05A2A4D6D1E76CA7CEF8A820B2D0
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

discovery motw phishing

Malware Config

Signatures

Mark of the Web detected: This indicates that the page was originally saved or cloned. 1 IoCs

phishing motw

flow	ioc	pid	Process
193	https://www.freevpn.win/lps/gbox-lp/index.html?cid=185764073&kw=PA_POP_2484562	4748	msedge.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4748	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134323586696903733"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-2246396966-3025826688-3847171515-1000\{CD91B124-C717-4EEE-99C7-BF28E601DBC5}	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4664	msedge.exe
4664	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 17 IoCs

pid	Process
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe

Suspicious use of FindShellTrayWindow 33 IoCs

pid	Process
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe

Suspicious use of SendNotifyMessage 16 IoCs

pid	Process
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe
4000	msedge.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 4000 wrote to memory of 3392	4000	msedge.exe	90
PID 4000 wrote to memory of 4748	4000	msedge.exe	91
PID 4000 wrote to memory of 4392	4000	msedge.exe	92
PID 4000 wrote to memory of 4392	4000	msedge.exe	92
PID 4000 wrote to memory of 5572	4000	msedge.exe	93
PID 4000 wrote to memory of 5572	4000	msedge.exe	93
PID 4000 wrote to memory of 5572	4000	msedge.exe	93
PID 4000 wrote to memory of 4840	4000	msedge.exe	94
PID 4000 wrote to memory of 4840	4000	msedge.exe	94
PID 4000 wrote to memory of 4840	4000	msedge.exe	94
PID 4000 wrote to memory of 916	4000	msedge.exe	96
PID 4000 wrote to memory of 916	4000	msedge.exe	96
PID 4000 wrote to memory of 916	4000	msedge.exe	96
PID 4000 wrote to memory of 4920	4000	msedge.exe	97
PID 4000 wrote to memory of 4920	4000	msedge.exe	97
PID 4000 wrote to memory of 4920	4000	msedge.exe	97
PID 4000 wrote to memory of 2836	4000	msedge.exe	98
PID 4000 wrote to memory of 2836	4000	msedge.exe	98
PID 4000 wrote to memory of 2836	4000	msedge.exe	98
PID 4000 wrote to memory of 3948	4000	msedge.exe	101
PID 4000 wrote to memory of 3420	4000	msedge.exe	100
PID 4000 wrote to memory of 3948	4000	msedge.exe	101
PID 4000 wrote to memory of 3420	4000	msedge.exe	100
PID 4000 wrote to memory of 3960	4000	msedge.exe	103
PID 4000 wrote to memory of 1136	4000	msedge.exe	106
PID 4000 wrote to memory of 1136	4000	msedge.exe	106
PID 4000 wrote to memory of 2384	4000	msedge.exe	107
PID 4000 wrote to memory of 2384	4000	msedge.exe	107
PID 4000 wrote to memory of 2384	4000	msedge.exe	107
PID 4000 wrote to memory of 1404	4000	msedge.exe	108
PID 4000 wrote to memory of 1404	4000	msedge.exe	108
PID 4000 wrote to memory of 1404	4000	msedge.exe	108
PID 4000 wrote to memory of 3372	4000	msedge.exe	109
PID 4000 wrote to memory of 3372	4000	msedge.exe	109
PID 4000 wrote to memory of 3372	4000	msedge.exe	109
PID 4000 wrote to memory of 2120	4000	msedge.exe	110
PID 4000 wrote to memory of 2120	4000	msedge.exe	110
PID 4000 wrote to memory of 2120	4000	msedge.exe	110
PID 4000 wrote to memory of 1304	4000	msedge.exe	111
PID 4000 wrote to memory of 1304	4000	msedge.exe	111
PID 4000 wrote to memory of 1304	4000	msedge.exe	111
PID 4000 wrote to memory of 868	4000	msedge.exe	113
PID 4000 wrote to memory of 1412	4000	msedge.exe	114
PID 4000 wrote to memory of 3808	4000	msedge.exe	115
PID 4000 wrote to memory of 4300	4000	msedge.exe	116
PID 4000 wrote to memory of 4300	4000	msedge.exe	116
PID 4000 wrote to memory of 5184	4000	msedge.exe	117
PID 4000 wrote to memory of 5184	4000	msedge.exe	117
PID 4000 wrote to memory of 5184	4000	msedge.exe	117
PID 4000 wrote to memory of 2856	4000	msedge.exe	118
PID 4000 wrote to memory of 2856	4000	msedge.exe	118
PID 4000 wrote to memory of 2856	4000	msedge.exe	118
PID 4000 wrote to memory of 2432	4000	msedge.exe	119
PID 4000 wrote to memory of 2432	4000	msedge.exe	119
PID 4000 wrote to memory of 4968	4000	msedge.exe	121
PID 4000 wrote to memory of 4968	4000	msedge.exe	121
PID 4000 wrote to memory of 4968	4000	msedge.exe	121
PID 4000 wrote to memory of 2836	4000	msedge.exe	122
PID 4000 wrote to memory of 2836	4000	msedge.exe	122
PID 4000 wrote to memory of 2836	4000	msedge.exe	122
PID 4000 wrote to memory of 4596	4000	msedge.exe	123
PID 4000 wrote to memory of 4596	4000	msedge.exe	123
PID 4000 wrote to memory of 4596	4000	msedge.exe	123
PID 4000 wrote to memory of 3480	4000	msedge.exe	124

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument C:\Users\Admin\AppData\Local\Temp\Super Mario Maker for Nintendo 3DS (USA).html
1⤵
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:4000
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x238,0x264,0x268,0x22c,0x288,0x7fffadb6c188,0x7fffadb6c194,0x7fffadb6c1a0
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1852,i,2323015818745614045,9319653084934807304,524288 --field-trial-handle=2600,i,4405966384124035928,5626277189014622821,262144 --variations-seed-version --mojo-platform-channel-handle=2648 /prefetch:11
  2⤵
  - Mark of the Web detected: This indicates that the page was originally saved or cloned.
  - System Time Discovery
  PID:4748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2224,i,2128178452640325392,9262766293989881326,524288 --field-trial-handle=2600,i,4405966384124035928,5626277189014622821,262144 --variations-seed-version --mojo-platform-channel-handle=2692 /prefetch:13
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1584,i,7175860514506587214,8561953011396538154,262144 --field-trial-handle=2600,i,4405966384124035928,5626277189014622821,262144 --variations-seed-version --mojo-platform-channel-handle=2596 /prefetch:2
  2⤵
  PID:5572
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3528,i,10493715499314052667,14856636816460116720,2097152 --field-trial-handle=2600,i,4405966384124035928,5626277189014622821,262144 --variations-seed-version --mojo-platform-channel-handle=3576 /prefetch:1
  2⤵
  PID:4840
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3532,i,6366330780681057658,3844356386634648638,2097152 --field-trial-handle=2600,i,4405966384124035928,5626277189014622821,262144 --variations-seed-version --mojo-platform-channel-handle=3604 /prefetch:1
  2⤵
  PID:916
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4292,i,2937583756621375255,825784268088903430,2097152 --field-trial-handle=2600,i,4405966384124035928,5626277189014622821,262144 --variations-seed-version --mojo-platform-channel-handle=4312 /prefetch:1
  2⤵
  PID:4920
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4304,i,13658798868203882573,7951463384183213467,2097152 --field-trial-handle=2600,i,4405966384124035928,5626277189014622821,262144 --variations-seed-version --mojo-platform-channel-handle=3508 /prefetch:9
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3776,i,2808284675148050984,10107231831900544396,524288 --field-trial-handle=2600,i,4405966384124035928,5626277189014622821,262144 --variations-seed-version --mojo-platform-channel-handle=5284 /prefetch:14
  2⤵
  PID:3420
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3576,i,16308182771698473829,9829007495453092211,524288 --field-trial-handle=2600,i,4405966384124035928,5626277189014622821,262144 --variations-seed-version --mojo-platform-channel-handle=5344 /prefetch:14
  2⤵
  PID:3948
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,1378871268169954563,397814912479034835,524288 --field-trial-handle=2600,i,4405966384124035928,5626277189014622821,262144 --variations-seed-version --mojo-platform-channel-handle=3404 /prefetch:14
  2⤵
  PID:5000
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6024,i,1378871268169954563,397814912479034835,524288 --field-trial-handle=2600,i,4405966384124035928,5626277189014622821,262144 --variations-seed-version --mojo-platform-channel-handle=3404 /prefetch:14
  2⤵
  PID:3960
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=PooledProcess2 --lang=en-US --service-sandbox-type=utility --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6472,i,18220682607398320831,644676285155638152,524288 --field-trial-handle=2600,i,4405966384124035928,5626277189014622821,262144 --variations-seed-version --mojo-platform-channel-handle=6456 /prefetch:14
  2⤵
  PID:1136
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=14 --always-read-main-dll --metrics-shmem-handle=6600,i,6283308250487026360,3785582362220458431,2097152 --field-trial-handle=2600,i,4405966384124035928,5626277189014622821,262144 --variations-seed-version --mojo-platform-channel-handle=6616 /prefetch:1
  2⤵
  PID:2384
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=15 --always-read-main-dll --metrics-shmem-handle=6756,i,17594824846128044679,5026608648129955606,2097152 --field-trial-handle=2600,i,4405966384124035928,5626277189014622821,262144 --variations-seed-version --mojo-platform-channel-handle=6780 /prefetch:1
  2⤵
  PID:1404
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=16 --always-read-main-dll --metrics-shmem-handle=4504,i,15229957649213415806,14167265834866375471,2097152 --field-trial-handle=2600,i,4405966384124035928,5626277189014622821,262144 --variations-seed-version --mojo-platform-channel-handle=4616 /prefetch:1
  2⤵
  PID:3372
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=17 --always-read-main-dll --metrics-shmem-handle=3780,i,4498558883031911112,3697400171130498036,2097152 --field-trial-handle=2600,i,4405966384124035928,5626277189014622821,262144 --variations-seed-version --mojo-platform-channel-handle=3716 /prefetch:1
  2⤵
  PID:2120
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=18 --always-read-main-dll --metrics-shmem-handle=6940,i,2219839330508274043,619090544017824530,2097152 --field-trial-handle=2600,i,4405966384124035928,5626277189014622821,262144 --variations-seed-version --mojo-platform-channel-handle=6932 /prefetch:1
  2⤵
  PID:1304
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=7000,i,11739555374140642620,17629097807181696596,524288 --field-trial-handle=2600,i,4405966384124035928,5626277189014622821,262144 --variations-seed-version --mojo-platform-channel-handle=6664 /prefetch:14
  2⤵
  PID:868
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6736,i,7578751436050394845,13412963941013118861,524288 --field-trial-handle=2600,i,4405966384124035928,5626277189014622821,262144 --variations-seed-version --mojo-platform-channel-handle=6732 /prefetch:14
  2⤵
  PID:1412
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6068,i,11598511924752696424,13530456797642570075,524288 --field-trial-handle=2600,i,4405966384124035928,5626277189014622821,262144 --variations-seed-version --mojo-platform-channel-handle=6692 /prefetch:14
  2⤵
  PID:3808
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=audio.mojom.AudioService --lang=en-US --service-sandbox-type=audio --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4672,i,16602139938740875947,11521251012101191708,524288 --field-trial-handle=2600,i,4405966384124035928,5626277189014622821,262144 --variations-seed-version --mojo-platform-channel-handle=4684 /prefetch:12
  2⤵
  PID:4300
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=23 --always-read-main-dll --metrics-shmem-handle=4700,i,17987894153131854439,10011546158161509646,2097152 --field-trial-handle=2600,i,4405966384124035928,5626277189014622821,262144 --variations-seed-version --mojo-platform-channel-handle=4596 /prefetch:1
  2⤵
  PID:5184
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=24 --always-read-main-dll --metrics-shmem-handle=3828,i,17366143760703905345,2027520058714328966,2097152 --field-trial-handle=2600,i,4405966384124035928,5626277189014622821,262144 --variations-seed-version --mojo-platform-channel-handle=3392 /prefetch:1
  2⤵
  PID:2856
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=6672,i,12776815751795034632,1530569913097311267,524288 --field-trial-handle=2600,i,4405966384124035928,5626277189014622821,262144 --variations-seed-version --mojo-platform-channel-handle=7160 /prefetch:14
  2⤵
  PID:2432
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=26 --always-read-main-dll --metrics-shmem-handle=7192,i,223337550982928426,11075677203959269927,2097152 --field-trial-handle=2600,i,4405966384124035928,5626277189014622821,262144 --variations-seed-version --mojo-platform-channel-handle=7332 /prefetch:1
  2⤵
  PID:4968
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=27 --always-read-main-dll --metrics-shmem-handle=6884,i,4727671075490652801,17750379321442095674,2097152 --field-trial-handle=2600,i,4405966384124035928,5626277189014622821,262144 --variations-seed-version --mojo-platform-channel-handle=7496 /prefetch:1
  2⤵
  PID:2836
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=28 --always-read-main-dll --metrics-shmem-handle=7536,i,8758143815280900369,11777928207081769724,2097152 --field-trial-handle=2600,i,4405966384124035928,5626277189014622821,262144 --variations-seed-version --mojo-platform-channel-handle=7560 /prefetch:1
  2⤵
  PID:4596
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=29 --always-read-main-dll --metrics-shmem-handle=7432,i,6818619592655912290,16978427728633730561,2097152 --field-trial-handle=2600,i,4405966384124035928,5626277189014622821,262144 --variations-seed-version --mojo-platform-channel-handle=5668 /prefetch:1
  2⤵
  PID:3480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=30 --always-read-main-dll --metrics-shmem-handle=7736,i,2566728323190423285,13815204117524136144,2097152 --field-trial-handle=2600,i,4405966384124035928,5626277189014622821,262144 --variations-seed-version --mojo-platform-channel-handle=7728 /prefetch:1
  2⤵
  PID:1040
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.26100.1301 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=7800,i,9990355132617288938,792872231542532628,262144 --field-trial-handle=2600,i,4405966384124035928,5626277189014622821,262144 --variations-seed-version --mojo-platform-channel-handle=7876 /prefetch:10
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4664

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3312

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --no-startup-window --win-session-start
1⤵
PID:3388

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 67b546fed422708faf33930b82ff4826bc323bc64f67af30b02bb9e565fa27ee
MD5 04925ec9b8ab191e010732cba0eeefe1
SHA1 a6847bd1b4e86ab3cf9f2a8e109e78b04f51204d
SHA512 25e65b33281d8c58aaf4bad265d912d01bcadd9284dc1ce818ccc1dcf59200f57de5e8d8f4ce5ef6da06c777b54dd4dbee7a3aad7a16da9542538e92104e9c68
TLSH
T1C7D0C0343948E288C9832172DCA033117320007074B147054031B41CCE2049323DF5CF
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 719f844e62c5a3916fba05dc2f32d02dadec54c424efb41ba161d1fca59227ae
MD5 e633a9ff8da83df3b4dca0ad6f30e5d9
SHA1 610df135117504b2857ee3cc03a5ac9797b10333
SHA512 56404607616c88e3d1268893aa0c748db1db04fe698a8f5d214c6a2a533823ff606c3f2a3f007d08bc16bd8838597597f9fdcfe0f631495c1928104ff11d002f
TLSH
T16BD0C0303948E188C9832172DCA033117310007020B147054031F42CCE2049323DF5CF
MD5 SHA1 SHA512 TLSH

Submit Download

f_000051

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000051
Size 60KB
SHA256 a221cbf72963df1c02c8bc202b159379f26e3d0d06225a5933209e745040e35b
MD5 b90c0e06b88c09158b13db21c7fc9ef7
SHA1 a4b968f5abcd2addd2d8f2d3e6fc01f4127c95a3
SHA512 430aadb5315738f414c2d4ca0d9e2be42f5242a3b28765993602aed4b34e334d854a88a051e6519877b7ffd8a5bf4ee7276885d6daec541826dba878f8c07f2e
SSDEEP 1536:iw916VqIkIFHzR32SF2Sjm+KW3IS7uchJEsZP8:nngaGzR32ceS7uchJ1ZP8
TLSH
T18C530227CA3085D2572D05004B9EF35A1A6079FDEA09CD7E920157F772ACAACFE20E21
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000052

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000052
Size 68KB
SHA256 fc70b88dddb2da85326b7ff7e1fa801f0099e5c0d3a85863afd2737af9b199a2
MD5 cb3d1e69fbf9c94b15e92f2fa26892f0
SHA1 b8e5aff1547d49a1285e2e0c4cb43dcd9993f468
SHA512 0f890af69b223aaec8bbc753bbc626f6cf0e0660182e38871a03337f1eec7be6b47cb9d5034a3cb8c226feb6cd964d396f56fecf07257f3cbc13de642c175ac2
SSDEEP 1536:1RrPSv8UR94fNhLVxko8PojNVcL7tk9/yGeJ3GI:PPZGefNhLVxko8MrcL7fJWI
TLSH
T16E63026A7FAAA437FB2C87016FF23034D1F8FD579034042826515BB5A4578E92326F99
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000053

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000053
Size 19KB
SHA256 af18b3681e8e2a1e8dc34c2aa60530dc8d8a9258c4d562cbe20c898d5de98725
MD5 1bd4ae71ef8e69ad4b5ffd8dc7d2dcb5
SHA1 6dd8803e59949c985d6a9df2f26c833041a5178c
SHA512 b3ff083b669aca75549396250e05344ba2f1c021468589f2bd6f1b977b7f11df00f958bbbd22f07708b5d30d0260f39d8de57e75382b3ab8e78a2c41ef428863
SSDEEP 384:/Und3PKicut4yiFkC9RWzlJpa2/CKYOyDJmCZyXJTW4PO821GyLjSoBwNeS:0UizQDYlJpaQCKYOyDJpI5Kx821DS3Nz
TLSH
T13692E1670BCE314E422EE25FA316A51733E41BE1EFE49640D6AA70D81C38DA243179D9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000054

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000054
Size 40KB
SHA256 839ff4459cf5fd3d0d1815e4eddefcd5e5fab6d8fc69a82875fe0b33774abc79
MD5 aee1b71a210fb54ac7545483fb4944d2
SHA1 94fb6a5e29733a462770f3dd517103680df2b199
SHA512 b02ed771da9cf752307786cbfe00f04607ee048bb1784437c808683a42aa97a888cd01ca344a8b4be74ae72e7424ebe50b3b52be7031c09ebf0dc189634bb5c5
SSDEEP 768:rv+0Vtu8YAK/FnOejZkBu/dy4qbW2HH8hAKt00vMM3iOCaIpf3uyWkW62:T+028PK/NOOXy/bJ8hjv6zQyO
TLSH
T18703F12600EF9DF0540CDF2D2C22A7D4AC34C5A724C96A2AF4593D3C14FB59B6995BC7
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000055

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000055
Size 65KB
SHA256 f12de7e272171cda36389813df4ba68eb2b8b23c58e515391614284e7b03c4d4
MD5 56d57bc655526551f217536f19195495
SHA1 28b430886d1220855a805d78dc5d6414aeee6995
SHA512 7814c60dc377e400bbbcc2000e48b617e577a21045a0f5c79af163faa0087c6203d9f667e531bbb049c9bd8fb296678e6a5cdcad149498d7f22ffa11236b51cb
SSDEEP 1536:654NcGosP0w+UcGoanS2RR/QwNdIvEsgXn:6iRsw+UkC5QdEfXn
TLSH
T1055302E4123CA75C49FC43EA5434D635BA4B31ADABD4102FB69BC4258F6EA824447CFB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

f_000095

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cache\Cache_Data\f_000095
Size 78KB
SHA256 de0c1b6ffe4969acfed3b4c582ee14e6d0040fc1df214197827667463e90303f
MD5 b9fd24adc912f1900ca213dd198c8ac7
SHA1 867fb04cf457325c74cfe642e4985d7a2ace28cc
SHA512 f2c7245faa5ca8c6b110e44764151462ab5ff663607450b6afac90230f7765e7da20d9734f683425e150eaaa41011e2f6b96df9c5dde79a4cefa7bb1144ae324
SSDEEP 1536:6jLEl494aVCfOs6sldYJaq9RA0Lr0WXKQZ5LRwo8lIPuhbWfwpCYp8PU0:+pGKo96sQ9HJXluhKf6pt0
TLSH
T1C783F21180FBE514FB277EB13693A7CB7AFA42F5C03BD95170416DE0086DDAA8A741D2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 9KB
SHA256 322c6aeb122faa77bb08544e1c7071e27b57565c11f36b41fd9cf82dff3100e5
MD5 d472c7aa380db03ae931ccbe66184e1f
SHA1 6a046880eb9186acf5e26451d3e3726e5ef08570
SHA512 ffae7f4a2656cd925f73a8c706c075bb1c1c6fd1d49f8d18ed7d48ddd8b6045ba2fbb5a64b92c97df44235f4835c93570ee3789f8db92168631e994b2e72ff66
SSDEEP 192:A1Xij9PPS/WjA9Pf5V3dOvdktpONLEvOha2IzF/bjCrA:xBP9M9XX3adkPONHI2OZF
TLSH
T1B5120D64A32EBC98EF1B4DF8A1E80977B7B85472578F6F87C4031DB60646318E24C42B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index~RFe5b1cfa.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5b1cfa.TMP
Size 2KB
SHA256 e5c19dd554ba788152cae7ed3339104e9395364ae754c42d6a171c3d77b6ef64
MD5 2e38eaf1b526932d67c5b15cb7526c3a
SHA1 a3ac444a81ddf4b1a44dcde5805f7d4e9428bfdc
SHA512 fd73e55abefe7b57cf316c587d55c5f4257cf6ae58d2444bf443ba5f83f001184cd1b5be630e8a7375ad5bff9123a640697cdbf18fef86494294583b6869296e
TLSH
T1CC5191A4CB33FAEDCF24CEFE52C0444BB6F5A8334A039A5705092E38848A3041301957
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

000003.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\000003.log
Size 22KB
SHA256 a0127ccab655002b9bcad128e2e434da48b42785b1cad68310ba12d5c7bbe2f6
MD5 937f0b231b6fe2c9b09e48288d0ccc95
SHA1 4687e6f0cd8c056d9c219abc470815c4deca5ebd
SHA512 455275cd5ac90d144c1a289ca680b06ee2fe716bd9e922cfadad0abf674d1d60e67c84e51d91494ba1a198a5c7b87c74602fa8ecc5817205641e63aabcfda69a
SSDEEP 384:9AvGgNZXB614aAvGgNZXB61hzAvGgNZXB61D:6cH
TLSH
T121A2EEC570ED9427DFB743322C716D686CB1B910A84088ED908A3F2D41F7FA2B9E4B56
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\IndexedDB\https_github.com_0.indexeddb.leveldb\MANIFEST-000001
Size 23B
SHA256 720a78803b84cbcc8eb204d5cf8ea6ee2f693be0ab2124ddf2b81455de02a3ed
MD5 3fd11ff447c1ee23538dc4d9724427a3
SHA1 1335e6f71cc4e3cf7025233523b4760f8893e9c9
SHA512 10a3bd3813014eb6f8c2993182e1fa382d745372f8921519e1d25f70d76f08640e84cb8d0b554ccd329a6b4e6de6872328650fefa91f98c3c0cfc204899ee824
MD5 SHA1 SHA512

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 27894558ecb598aa4268bd16aa3615ffc0a7aa24795c144c8c69e5d667cd13c7
MD5 b5178694e204f807f69819bdfb8700f3
SHA1 4cebcd5c0b8f69f00afdb1fad25518a7454ba8c1
SHA512 ac702262a3d07b5fbb6dcdbf4d479e99ce7885172af9a71a100da40a99f9fb4f73af0cf44b494baae2369da665476d615abde46bb24c82dab7fc39bfd6fa9bbb
TLSH
T1EC21B1F7C3F8597E8A4182F867142E1BCE2D0815431C7E5BC4D46F5BA3E2871D28095E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 8KB
SHA256 d03bf97559a0d8fbb8c4a8fae94b453ac79fc25ec752cad9fe86a4ee6a3f43f7
MD5 be74d982d37b17f92aaf29109d70e9a7
SHA1 320088a80520050e98c868a0600fe3a6073a11ad
SHA512 e4f618b8d732aeea836fa28a3df930dcd8833670dd04a8b1de0403b84072f3c04abe8d89fab7073b7029b9431ab8fe0ee73a4e3115b7da77008f289c034259a5
SSDEEP 192:DfHmO9DmjRJPoNZVaZaXS453qvmBmrmtmbmDmgWQfz3zjFhOhjwErZG9rCcDG9X:DfHmO9DmjRJPoNZVaZaXS453qvmBmrmo
TLSH
T1B212DDF783E9862DDA1256F0EB14AE1BCE1D0515831C3C6AC8E4BE4B93E3471E141B9E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 5KB
SHA256 ab679bab3869136b2094081a76a25840522ce951f0a93b468ee70ebd6dad5e8a
MD5 bc72b445b6798224fa292e5d9538107e
SHA1 145d2852597f0890881307c278505142d79c7999
SHA512 6bf06e4fcf9915be7089f0e944f7042e6b0c0ed5c2ccd7b02cd775575088e0296f28a6b92b294332508c757f52b75c9661e5bfa2f66cc260ae53463c323947e7
SSDEEP 96:DUOHTSO9Dm3VaZaXz24EI3qvmnBwBmrmtmOSmDmgWqGlLrhd3Qk:DfHmO9Dm3VaZaXS453qvmBkmrmtmbmDo
TLSH
T145C1BAF783E5862DDA1296F0EA08AE1BCE1D0515831C3C6AC4E0BE5BD3E3471E141B5E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 40B
SHA256 6028bd681dbf11a0a58dde8a0cd884115c04caa59d080ba51bde1b086ce0079d
MD5 20d4b8fa017a12a108c87f540836e250
SHA1 1ac617fac131262b6d3ce1f52f5907e31d5f6f00
SHA512 507b2b8a8a168ff8f2bdafa5d9d341c44501a5f17d9f63f3d43bd586bc9e8ae33221887869fa86f845b7d067cb7d2a7009efd71dda36e03a40a74fee04b86856
MD5 SHA1 SHA512

Submit Download

Sdch Dictionaries

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Sdch Dictionaries
Size 211B
SHA256 22ae18d70b951862c6dff60b6eec102a6d5d2540c0a5a9ebf25a4bad83e2b5fc
MD5 c6fe1cf3e1f9220347bddc180d4b9db5
SHA1 ba5df87ede6cdd7c125acae8ed873e0a794d5074
SHA512 9ac305cb4d73d006d437f125d7f39c8687f43d7d6be4cc40e53cb84e998fe5cebc298dff6d4d71e0c7ae6746db6d9769b24b78a25ac5f155e13335700920463b
TLSH
T16CD02223270130F5B6EDBEA1406AECCFC72A80250812EED921D0A8AA053256C850B140
MD5 SHA1 SHA512 TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 a9b91f231f6a8952b3e9ff448c8d188b2480034d0d050c164d378534796a5cdd
MD5 9885961c05c1c95d3993b8c67d45718c
SHA1 bc5ab6e15f39528528423d33fa2b16851eaa5afd
SHA512 f6e3df06c2759754e77f0d9a8b3d604e9a0ace4d002ad5171f76a8405569626d4e5d7d1904b61b6422075c8c6fb64d33861003be5db720a02bc3e253d2a9a57f
SSDEEP 192:sxRrR6HcB4a/fZVsw0P/ppoA8pKQ3P/g6+WNY21/YZ7xqBsUG9IgDJ9C:sxRrCm4a/f3s1Pxg//5D/axjC
TLSH
T13652C7569924D93B8CCAD61DFE35BF53D7F9102298911E4CAAFCC61C00EB6ED220784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 14KB
SHA256 56ab89c9387daca368ad54baa7be7bad44b6c68047b70109504021b49c479f13
MD5 3b719be92422e80955f443e547d6c726
SHA1 4bbd342effad3b79dfb10ff1f4a9bed4e0a1c241
SHA512 11837c7c15660e553e66cc282b88974d3a788f186a7dd0f1bb08e3835f3d2550449f81844b6d543cf0ca15c3d44155c8faf58d83c0159fae950368df854a1a48
SSDEEP 192:sxRhR6HcB4a/fZVsw03/WpoA8pyPy73ok/g6+WNY21/YZ7xTBsUG9IgDv9C:sxRhCm4a/f3s13+gDl/5D/NxBC
TLSH
T1F262A7569524DA7B8CC6D61DFE757F13D7F9102298921E4CAAFCC61C00EB6DD220784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 04837ef430abd2cb3251f6e1b1c5010024262884e2fce859e42c523945956be8
MD5 92af3e7d33a7315994840b20f3c5543d
SHA1 6d189b48f54856c95e7832cd62c19e78a458fd8f
SHA512 acaf60d409a495cc03d33a9013afacc66f8b3838cf8e1451746768333710965014212b2d22f0f2cf65f02df32da28f022f146dcf5013e20d7280d6459735442f
SSDEEP 192:sxR8R6HcBza/fZVsy0P/wpoA8pKu3V/g6+WNY21/YZ7xqHsUG9IgItC:sxR8Cmza/f3sHPogD/5D/MxCC
TLSH
T1ED52C7565A24D93B8CCAD61DFE367F62D7F9102298951E4CAAFCC61C00EB5ED220784B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 23KB
SHA256 7bd825bad2f75aee2db88379283c949045a1a39093e72a3bdd4807b907030886
MD5 c1f874f5182e5bffaa3e5443bb1c2db6
SHA1 513c2ee42b17bba1219bba284d567efd4bec82f2
SHA512 549db638b8191f28a792f21dba29f527bcb086afc258ff38b904bb8475071775a48b3ecc4debde4695ece21d16760a33cc6d01f714300df2f3ea8b454a944c41
SSDEEP 384:kyr2SGXfCtgdDFf/bKhOObJ+UoAYDCx9TuqZz0VfUCh7xbog/OVA89VXR6WroOp9:ky2SGvWgd5f/b8F1+UoAYDCx9Tuqh0VC
TLSH
T134B2DA2B604DCB7F9F801A9DAC196FD67D9802C797988D4047FE990C03C77EA912A4DA
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 4KB
SHA256 b240cc65783808b4fc161ff46879512b617220eb1bfd0cdfd55b8828224d45a6
MD5 0fc832b2d5fd8e4738b063a144abe189
SHA1 4724becc65a5862665af3c5d632d6cc62bd29c2b
SHA512 e74dac3ac4e2769470fb5eaa23bf267914991c4e2a1369510cd33babb4d7f8c003c9cc21db32574b54dd0716892f71f195b78bfc81c245a2a8184f0e9a53918f
SSDEEP 48:KM2IHKL6kXynAP0w6GykCGRPIRokKcBUSkYQ0fx6Q5yx4IXKFWc7:KM2gKL6uzR6K606i4QKFWE
TLSH
T18E91DF5172BA96012C7F391C83A49667DA8230727018A52FBBEC04B64FAFF054DFD9C9
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

CURRENT

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\CURRENT
Size 16B
SHA256 0f1bad70c7bd1e0a69562853ec529355462fcd0423263a3d39d6d0d70b780443
MD5 46295cac801e5d4857d09837238a6394
SHA1 44e0fa1b517dbf802b18faf0785eeea6ac51594b
SHA512 8969402593f927350e2ceb4b5bc2a277f3754697c1961e3d6237da322257fbab42909e1a742e22223447f3a4805f8d8ef525432a7c3515a549e984d3eff72b23
MD5 SHA1 SHA512

Submit Download

MANIFEST-000001

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Extension Settings\ghbmnnjooekpmoecnnnilnnbdlolhkhi\MANIFEST-000001
Size 41B
SHA256 f9d31b278e215eb0d0e9cd709edfa037e828f36214ab7906f612160fead4b2b4
MD5 5af87dfd673ba2115e2fcf5cfdb727ab
SHA1 d5b5bbf396dc291274584ef71f444f420b6056f1
SHA512 de34583a7dbafe4dd0dc0601e8f6906b9bc6a00c56c9323561204f77abbc0dc9007c480ffe4092ff2f194d54616caf50aecbd4a1e9583cae0c76ad6dd7c2375b
MD5 SHA1 SHA512

Submit Download

OperationConfig

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig
Size 22KB
SHA256 d988156066b7fd22de278fbc96759d2caea6552094ffeb2ddd9307806059c5e4
MD5 f768bcb451a187c18099961c484eef8b
SHA1 99472c2d1918ea56c632734bc5c8a89ae6d2551c
SHA512 a4d78de6bcc1e940c466c41c31ee100235b32fef4cb3e7815a9c62dfae1eb3e4588d2c9e8597152ad7754527643c59ea8b811277ac58e4134a3dbf1507fe97bf
SSDEEP 384:90JOk/FY7A42lagbkDtCkQ7wDThH/64+hkmbA6BQpGMgSVlkFIum1z4tfLTvq/ue:WJOk/FY7/2lagbCtCkQ7wDlH/h+umbAJ
TLSH
T131A2B81DC81C7E3257CA2F7D6A2F9DB276DA30CA7080459A7E8CC54DD31B0AD56862BC
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

OperationConfig~RFe5a5303.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Edge Cloud Config\OperationConfig~RFe5a5303.TMP
Size 3KB
SHA256 8b2e057387e9714efef3580a36459acf56aab53c806cd7d7dbb6e17cef977ef9
MD5 904e6e94a1d46374c8630cfd86cc729f
SHA1 e1d9c3f7813878acc6510d48d95b2bf48b2e1a0d
SHA512 081e2a26252860ff8d8f7a9d0378ae56f0cc50574d13d2a121afdf74284963747ef874a4d73b1df7774cd8570972f4f513eefe0a0325fd088556d5b1ba946712
TLSH
T1DB815C4FCC0CBE77ABAB6A719A35D6B2F79131EA94518A977F8C444EE3050ED0242E50
MD5 SHA1 SHA512 TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 38KB
SHA256 fd2c8d383db5510de26cdce6826ceb46767ff3cddb4bf50e4d6cd9a3b573b325
MD5 4f8e7a9ac2cf3457f0cacc3fd9ee8b56
SHA1 81e5e400fc0002aa9ef60dd23d2cd13417e100e7
SHA512 8d04be3d13ee1c764bd55f8c9dc012f3b50438fba753dcb4a82ba81e07e18ca4a7be6e2be1b3bd05b6a83ca2bfd6baa33e040f4b5dd3a622ad7be824fe82c7b9
SSDEEP 768:7FQw3AwgXvRqeXAam6aQMGdjWca4Ghf9Mnh:Ow3AxmaME6pMh
TLSH
T1110338F148D78936DC6E9793A73E2E02ADBCD163B4848940B7D8590DCE961BFD30B816
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 36KB
SHA256 45b6458efb62bb12cfccb0fa131c95ab74c27049a2c497031ced1c48a2ecb8fb
MD5 c1e40cf35daea5d1a8ddf254d6a1db23
SHA1 d67d1065f11efb06eac7c0ca82c263723809a104
SHA512 bbbe633761bb218278e1342f5280b89da2137dd3872ea1be734d31f85ece32473980948f9b0c61b07e553758f19cee7b2c9f736beff10d2f088b72699a3cb768
SSDEEP 768:mrv+4UNbdq3V5qeYrAam6aQMGdjWca4Ghf9MRM:mbsbc39YdmaME6pM6
TLSH
T179F2BE31A868D9738DB39695F21B7643BEB461A389C80E90C9DD6B0D03DB59E230BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 679a9f37363036d0f6367c288a63bdda3bd8c55f83927b4e64e6b11ace5564f8
MD5 af28b76e931bb612d78f0330c6390f3f
SHA1 7077558707deacf667a85543cd9ee274b0ddeee3
SHA512 46e46cede752a2ac463bd50bb395eaf60800622f9c17583e602d72c37c9f797cc878a9b8bb128f96020faa824477169fd7d83e738d724d0ad549a3ff43b52d24
SSDEEP 384:sZcIV38N3bVRimiv0CHuBd+dfYbKxCzug2WmkA1QiZh6vPqQMQYeJfjWca4G2KCt:6V3J5qeYfAam6aQMGdjWca4Ghf9Mnh
TLSH
T14EE2AE309CA49D778CA6A695F61B3643FDF451A385D84E40C9EDAB0D03D759E230BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 30KB
SHA256 a34c6f2ee900517a3378d7da2a0f343104037f3288f5c1783b291113775d7a4a
MD5 7f5759747a49ac32c4838de1ff6b5d9d
SHA1 665dc3a9f59584d3b5e8fb056a9f0a503f7f8737
SHA512 21f0780cb41862fd7b964374838513a4b0e3aaa544982a5b6b42b34a86628c77381b0333b7da1d3c3e64443d46c59d98104703f6b007715d3a26489863868688
SSDEEP 384:gZcIV38N3bVRimiv0LHP2Bd+dfYbKxCzug2WmkA1QiZh6vPqQMQYeJfjWca4G2Kc:eV3cvRqeYfAam6aQMGdjWca4Ghf9Mnh
TLSH
T152E29E30ACA49D774CA6A696F61B3643FEF451A385D84E40C9EDAB0D03D759E230BC1B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 35KB
SHA256 0f9fb7193bb29c737ebaf99e089faee8adca844f9d1b77c826056d842cbca627
MD5 e80f9f3255cf4c935209a3b741978f1c
SHA1 132d2fb9f3d15042279ae49c2e26a61957710a58
SHA512 3f33977266b13fa61fb441aaea47c6dcf35ff4b84ac6c5d49571110461371e1d9793b68124f7d1b80214972779e5f0cab5559f4095bba91a42a10248be82e89f
SSDEEP 768:4rv+4UNbdq3tHqeY0Aam6aQMGdjWca4GhfwMPeU/:4bsbc3PYWmaME6pfH
TLSH
T11FF2BE31A868D9739DB39695F21B7687BEB451A389C80E90C9DD6B0D039B4CE330BD17
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 34KB
SHA256 0abecb03a629db75435e42243b9980d45d2bf0578ede150d9190231800e3268d
MD5 a2aefd49f078d2237105e0583c136d7b
SHA1 d2abdc0c0966acdb0549630b5a52189edd648e53
SHA512 a62eb20c592a3cc8e17837ff6ad83af28fd5d6011d4f0106ae632ba2a4cdaae62811fb729c8bc9d20c2bb59bb8bfc2b2fdac338cac4575d6dc87211b7f602b0d
SSDEEP 768:/rv+4UNbdq3SQqeMAAam6aQMGdjWca4GhfBQPeU/:/bsbc3vMKmaME6p4H
TLSH
T1F8F2AE31A8689973DDB79A99F21B6B87BEB421A384D40E80D9D95B0D43970CE2307D27
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 c3104466d38c9d81c2fa33cad4597ad9ed3ec1943130660fe7219b73bb9999e1
MD5 b991dc1317785fec315fbfcec223a2c1
SHA1 b24af5b1fbd164a1e3bf8ac224d99ae2fb4a4710
SHA512 7f146027f1bd196d73dfd702d404555eb4c8413cc2f4a0fed736893e95f998e30479ae8dff5cdc5399594967cb1dc969c42e725d121275c2f84113009cbdb55b
TLSH
T14BE0092AE70521AEC068037404975FB93BE6D02102A613465B340A6D3C623807F20A82
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 c82e23647e4c0c320e9c9121106b10075719b86eec572d98997ed2e70b2f28d9
MD5 8f6904a82e5254bbac29dc9d4b761dc5
SHA1 0814ad63e94972580f6e02a3b7b5965f67a93e0a
SHA512 6acb1571259cb25e1e1d1ed1e252bbf486a6626499c60c0b19865566a5808edea1108ce325125c3d18ce4a2f179fcd702641561798400f5c337e5d5e409adb91
TLSH
T1DBE00214D6012069C068037400835BA53AD5901101A10245562406593C223007A20781
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 bd99c8832c8c8b3613448a3143d993bb5d4fb212f478d16e15548f4242a45424
MD5 374c76ae7aaf1678282d82c88173ad9a
SHA1 14ffa51b3db87f117eab927cffcbbbca4b960eed
SHA512 a9e5ef940d79e9a8fe29266746ceadfdcc1e0c704c74abbc51332454417ea24d8db45dd603ef7d84bf4de3949fc1046ded1979f1ad4e8f2a39c7d27ee477be43
TLSH
T1FEE00216E70520EEC078037400975BB93AD7903101B002455E2406593C633807F207C2
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 52747fbc8021612bade58f9594f1c0fc14f15dab88eb6d6eee32745e110b1127
MD5 9967f9469da003407ed68baef560fef4
SHA1 1ec3359cb55af58dfd8ab4485ae11282c626b3d6
SHA512 dc8f4f508cc208811d78a30caac159666d7b1c32b29cb3386907109c8a3efaa04ff56942ef0a00bd4d717c3bc144d0e4bedec2e405aaaa354271840fdb35b9d2
TLSH
T1AAE0092AE71921EFC038437854AB5FB93BF6D02217A613565B355A793CA23807F20AC6
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter
Size 392B
SHA256 f7b1ff47875eb2f2dfa4042297c8f4995a4b8266f3d821e414ff879841606419
MD5 4a9d1b00b5b166b329baac75822a0144
SHA1 57b0a701c338316dda80080138cfc8a1e985d471
SHA512 af6115762db22b15047ae5e4c03b75757156713b0bcfa4f61c8a5493c18a2066b84fe231299119210903c8ea86f43a313cf75dbb2eacb761d7c2b03c7c3a1cdf
TLSH
T1BFE0092AE70921AFC038037854A75FB93BF6902212A613565A340A6D3C223807F20AC6
MD5 SHA1 SHA512 TLSH

Submit Download

RevisitationBloomfilter~RFe59d17f.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\RevisitationBloomfilter~RFe59d17f.TMP
Size 392B
SHA256 beb1a6e417247e65cfbfe17d777d69e2ec6f202eb62f0511ce7a9c0007130e9a
MD5 b19550180106a1d1174dedb8716c9c79
SHA1 a8b43a3edd59e7dd14cd4118597df87f8e521981
SHA512 40b4f26ff09ce3c1e52e7b712ee51188b42df874934797d27833df9d022c12f7d9dbcba40c9d439792ab4accc5549d77c27c79b944e2532b5d02ee14f2db3e53
MD5 SHA1 SHA512

Submit Download

595eccca-df95-46c5-898c-913199981108.tmp

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\595eccca-df95-46c5-898c-913199981108.tmp
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download