hxxps://daacqeqnaffc73f5hrng[.]kndg-defender[.]pro/xm/xm1/?lp_key=17881076889cbe8dc7032faa4cb7333c6980037063&t1=2[.]810170&t2=30156472&t3=3307969&t4=5900733&t5=3856246&t6=s&t12=HQ&key=4a35944be1eb691352dd&clickid=daacqeqnaffc73f5hrng&trk=borvens[.]com&fdd=edb67e1fba86469fbae170080b4bcfd6&vpb=BMpK9rOA8iehIfvfqcw69CMm6HD-ERY7wcw7xjt1sUnxYoCuKLA6_N-rHqSzitHQrquL61vKv0ruXWLHWjaukqA&language=ja&feed=800e&zone=4497adf3&dm=1

Analysis

user interaction
yes
max time kernel
899s
max time network
729s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
31/08/2026, 01:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
https://daacqeqnaffc73f5hrng.kndg-defender.pro/xm/xm1/?lp_key=17881076889cbe8dc7032faa4cb7333c6980037063&t1=2.810170&t2=30156472&t3=3307969&t4=5900733&t5=3856246&t6=s&t12=HQ&key=4a35944be1eb691352dd&clickid=daacqeqnaffc73f5hrng&trk=borvens.com&fdd=edb67e1fba86469fbae170080b4bcfd6&vpb=BMpK9rOA8iehIfvfqcw69CMm6HD-ERY7wcw7xjt1sUnxYoCuKLA6_N-rHqSzitHQrquL61vKv0ruXWLHWjaukqA&language=ja&feed=800e&zone=4497adf3&dm=1
Sample260831-bskdmsck2s

Score

3^/10

discovery

Malware Config

Signatures

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

System Time Discovery 1 TTPs 1 IoCs

Adversary may gather the system time and/or time zone settings from a local or remote system.

discovery

System Time Discovery

T1124

pid	Process
4292	msedge.exe

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier	msedge.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	msedge.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	msedge.exe

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-19\Software\Microsoft\Cryptography\TPM\Telemetry	msedge.exe
Set value (int)	\REGISTRY\USER\S-1-5-19\SOFTWARE\Microsoft\Cryptography\TPM\Telemetry\TraceTimeLast = "134326130755379016"	msedge.exe

Modifies registry class 10 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\	msedge.exe
Key created	\REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-889581200-2041691093-2048517887-1000\{E1A2BFDC-5830-4D02-991B-CC2BD38983CE}	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\DisplayName = "Chrome Sandbox"	msedge.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Moniker = "cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe"	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Mappings\S-1-15-2-1760019844-2681172078-3872633735-798519778-3824819574-1684089895-1452983902\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\cr.sb.odmf5200eafd3ad904629cbb0f87a78a3c7211081fe\Children	msedge.exe
Key created	\REGISTRY\USER\S-1-5-21-889581200-2041691093-2048517887-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	msedge.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4328	msedge.exe
4328	msedge.exe

Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs

pid	Process
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe

Suspicious use of FindShellTrayWindow 34 IoCs

pid	Process
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe

Suspicious use of SendNotifyMessage 32 IoCs

pid	Process
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe
1748	msedge.exe

Suspicious use of WriteProcessMemory 45 IoCs

description	pid	Process	procid_target
PID 1748 wrote to memory of 2804	1748	msedge.exe	84
PID 1748 wrote to memory of 4292	1748	msedge.exe	85
PID 1748 wrote to memory of 4396	1748	msedge.exe	86
PID 1748 wrote to memory of 3904	1748	msedge.exe	87
PID 1748 wrote to memory of 4396	1748	msedge.exe	86
PID 1748 wrote to memory of 3904	1748	msedge.exe	87
PID 1748 wrote to memory of 3904	1748	msedge.exe	87
PID 1748 wrote to memory of 4480	1748	msedge.exe	88
PID 1748 wrote to memory of 4172	1748	msedge.exe	89
PID 1748 wrote to memory of 4480	1748	msedge.exe	88
PID 1748 wrote to memory of 4480	1748	msedge.exe	88
PID 1748 wrote to memory of 4172	1748	msedge.exe	89
PID 1748 wrote to memory of 4172	1748	msedge.exe	89
PID 1748 wrote to memory of 2632	1748	msedge.exe	90
PID 1748 wrote to memory of 2632	1748	msedge.exe	90
PID 1748 wrote to memory of 4328	1748	msedge.exe	91
PID 1748 wrote to memory of 2632	1748	msedge.exe	90
PID 1748 wrote to memory of 4328	1748	msedge.exe	91
PID 1748 wrote to memory of 4328	1748	msedge.exe	91
PID 1748 wrote to memory of 3452	1748	msedge.exe	95
PID 1748 wrote to memory of 3452	1748	msedge.exe	95
PID 1748 wrote to memory of 3452	1748	msedge.exe	95
PID 1748 wrote to memory of 4492	1748	msedge.exe	102
PID 1748 wrote to memory of 4868	1748	msedge.exe	103
PID 1748 wrote to memory of 4492	1748	msedge.exe	102
PID 1748 wrote to memory of 4868	1748	msedge.exe	103
PID 1748 wrote to memory of 4576	1748	msedge.exe	105
PID 1748 wrote to memory of 1820	1748	msedge.exe	119
PID 1748 wrote to memory of 4188	1748	msedge.exe	120
PID 1748 wrote to memory of 3392	1748	msedge.exe	121
PID 1748 wrote to memory of 1612	1748	msedge.exe	126
PID 1748 wrote to memory of 1612	1748	msedge.exe	126
PID 1748 wrote to memory of 2060	1748	msedge.exe	128
PID 1748 wrote to memory of 2060	1748	msedge.exe	128
PID 1748 wrote to memory of 4328	1748	msedge.exe	130
PID 1748 wrote to memory of 4392	1748	msedge.exe	131
PID 1748 wrote to memory of 4392	1748	msedge.exe	131
PID 1748 wrote to memory of 3764	1748	msedge.exe	132
PID 1748 wrote to memory of 3764	1748	msedge.exe	132
PID 1748 wrote to memory of 4296	1748	msedge.exe	133
PID 1748 wrote to memory of 4296	1748	msedge.exe	133
PID 1748 wrote to memory of 3616	1748	msedge.exe	134
PID 1748 wrote to memory of 3616	1748	msedge.exe	134
PID 1748 wrote to memory of 4624	1748	msedge.exe	137
PID 1748 wrote to memory of 4624	1748	msedge.exe	137

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --start-maximized --disable-default-apps --disable-component-update --simulate-outdated-no-au='Tue, 31 Dec 2099 23:59:59 GMT' --single-argument https://daacqeqnaffc73f5hrng.kndg-defender.pro/xm/xm1/?lp_key=17881076889cbe8dc7032faa4cb7333c6980037063&t1=2.810170&t2=30156472&t3=3307969&t4=5900733&t5=3856246&t6=s&t12=HQ&key=4a35944be1eb691352dd&clickid=daacqeqnaffc73f5hrng&trk=borvens.com&fdd=edb67e1fba86469fbae170080b4bcfd6&vpb=BMpK9rOA8iehIfvfqcw69CMm6HD-ERY7wcw7xjt1sUnxYoCuKLA6_N-rHqSzitHQrquL61vKv0ruXWLHWjaukqA&language=ja&feed=800e&zone=4497adf3&dm=1
1⤵
- Checks processor information in registry
- Enumerates system info in registry
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1748
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad" --annotation=IsOfficialBuild=1 --annotation=channel= --annotation=chromium-version=139.0.7258.155 "--annotation=exe=C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --annotation=plat=Win64 --annotation=prod=Edge --annotation=ver=139.0.3405.125 --initial-client-data=0x23c,0x240,0x244,0x238,0x264,0x7ffb546dc188,0x7ffb546dc194,0x7ffb546dc1a0
  2⤵
  PID:2804
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1828,i,1054118731407938910,648453722986372037,524288 --field-trial-handle=2668,i,16739645566312630560,7760067770755588763,262144 --variations-seed-version --mojo-platform-channel-handle=2696 /prefetch:3
  2⤵
  - System Time Discovery
  PID:4292
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-pre-read-main-dll --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=2220,i,17793102761834826215,9598501914664661020,524288 --field-trial-handle=2668,i,16739645566312630560,7760067770755588763,262144 --variations-seed-version --mojo-platform-channel-handle=2704 /prefetch:8
  2⤵
  PID:4396
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --no-pre-read-main-dll --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADgAAAIAAAAAAAAAAAAAGAAAQAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=1668,i,10279890705516767998,7330719385768402455,262144 --field-trial-handle=2668,i,16739645566312630560,7760067770755588763,262144 --variations-seed-version --mojo-platform-channel-handle=2664 /prefetch:2
  2⤵
  PID:3904
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --always-read-main-dll --metrics-shmem-handle=3384,i,1059247654133514694,6079013601056663948,2097152 --field-trial-handle=2668,i,16739645566312630560,7760067770755588763,262144 --variations-seed-version --mojo-platform-channel-handle=3468 /prefetch:1
  2⤵
  PID:4480
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --always-read-main-dll --metrics-shmem-handle=3388,i,5500403972036290782,4085963942581480701,2097152 --field-trial-handle=2668,i,16739645566312630560,7760067770755588763,262144 --variations-seed-version --mojo-platform-channel-handle=3472 /prefetch:1
  2⤵
  PID:4172
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --always-read-main-dll --metrics-shmem-handle=4072,i,28291165734242590,8489441080966088036,2097152 --field-trial-handle=2668,i,16739645566312630560,7760067770755588763,262144 --variations-seed-version --mojo-platform-channel-handle=4100 /prefetch:1
  2⤵
  PID:2632
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --extension-process --renderer-sub-type=extension --pdf-upsell-enabled --force-high-res-timeticks=disabled --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=8 --always-read-main-dll --metrics-shmem-handle=4076,i,2466871277472894950,4826257862983286078,2097152 --field-trial-handle=2668,i,16739645566312630560,7760067770755588763,262144 --variations-seed-version --mojo-platform-channel-handle=4172 /prefetch:2
  2⤵
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=renderer --pdf-upsell-enabled --force-high-res-timeticks=disabled --disable-gpu-compositing --video-capture-use-gpu-memory-buffer --lang=en-US --js-flags=--ms-user-locale= --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=9 --always-read-main-dll --metrics-shmem-handle=3464,i,15400278106684094038,12038295133008047735,2097152 --field-trial-handle=2668,i,16739645566312630560,7760067770755588763,262144 --variations-seed-version --mojo-platform-channel-handle=4056 /prefetch:1
  2⤵
  PID:3452
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3528,i,4390355064851047077,12718915199857038718,524288 --field-trial-handle=2668,i,16739645566312630560,7760067770755588763,262144 --variations-seed-version --mojo-platform-channel-handle=3672 /prefetch:8
  2⤵
  PID:4492
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-US --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3520,i,14443502548257261187,11751484813835289168,524288 --field-trial-handle=2668,i,16739645566312630560,7760067770755588763,262144 --variations-seed-version --mojo-platform-channel-handle=3632 /prefetch:8
  2⤵
  PID:4868
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,5052301888376131104,125352524620438648,524288 --field-trial-handle=2668,i,16739645566312630560,7760067770755588763,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:8
  2⤵
  PID:2956
- C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-US --service-sandbox-type=none --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5812,i,5052301888376131104,125352524620438648,524288 --field-trial-handle=2668,i,16739645566312630560,7760067770755588763,262144 --variations-seed-version --mojo-platform-channel-handle=5832 /prefetch:8
  2⤵
  PID:4576
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4228,i,13642359503368629274,8389160669165100158,524288 --field-trial-handle=2668,i,16739645566312630560,7760067770755588763,262144 --variations-seed-version --mojo-platform-channel-handle=4116 /prefetch:8
  2⤵
  PID:1820
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4212,i,8461426292153741785,779855106440530561,524288 --field-trial-handle=2668,i,16739645566312630560,7760067770755588763,262144 --variations-seed-version --mojo-platform-channel-handle=5896 /prefetch:8
  2⤵
  PID:4188
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=chrome.mojom.UtilWin --lang=en-US --service-sandbox-type=none --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4196,i,8135021729525700626,3723346650785030080,524288 --field-trial-handle=2668,i,16739645566312630560,7760067770755588763,262144 --variations-seed-version --mojo-platform-channel-handle=4680 /prefetch:8
  2⤵
  PID:3392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=edge_search_indexer.mojom.SearchIndexerInterfaceBroker --lang=en-US --service-sandbox-type=search_indexer --message-loop-type-ui --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3624,i,446887469196631323,1118517375181533591,524288 --field-trial-handle=2668,i,16739645566312630560,7760067770755588763,262144 --variations-seed-version --mojo-platform-channel-handle=2824 /prefetch:8
  2⤵
  PID:1612
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5700,i,9789712812451458915,3118984975082711894,524288 --field-trial-handle=2668,i,16739645566312630560,7760067770755588763,262144 --variations-seed-version --mojo-platform-channel-handle=5736 /prefetch:8
  2⤵
  PID:2060
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=gpu-process --disable-gpu-sandbox --use-gl=disabled --gpu-vendor-id=5140 --gpu-device-id=140 --gpu-sub-system-id=0 --gpu-revision=0 --gpu-driver-version=10.0.19041.546 --force-high-res-timeticks=disabled --gpu-preferences=SAAAAAAAAADoAAAIAAAAAAAAAAAAAGAAAQAAAAAAAACEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAQAAAAAAAAABAAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --always-read-main-dll --metrics-shmem-handle=784,i,2899526739130464113,10051637097888650150,262144 --field-trial-handle=2668,i,16739645566312630560,7760067770755588763,262144 --variations-seed-version --mojo-platform-channel-handle=6072 /prefetch:8
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4328
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3996,i,16434040599891341154,14610734395975407479,524288 --field-trial-handle=2668,i,16739645566312630560,7760067770755588763,262144 --variations-seed-version --mojo-platform-channel-handle=5872 /prefetch:8
  2⤵
  PID:4392
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=3716,i,8946281222001243156,12157582544365713289,524288 --field-trial-handle=2668,i,16739645566312630560,7760067770755588763,262144 --variations-seed-version --mojo-platform-channel-handle=5308 /prefetch:8
  2⤵
  PID:3764
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=on_device_model.mojom.OnDeviceModelService --lang=en-US --service-sandbox-type=on_device_model_execution --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=4720,i,4680497167387297050,7568229493529342509,524288 --field-trial-handle=2668,i,16739645566312630560,7760067770755588763,262144 --variations-seed-version --mojo-platform-channel-handle=6132 /prefetch:8
  2⤵
  PID:4296
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=1324,i,4659327967173922265,11287610272599039600,524288 --field-trial-handle=2668,i,16739645566312630560,7760067770755588763,262144 --variations-seed-version --mojo-platform-channel-handle=6140 /prefetch:8
  2⤵
  PID:3616
- C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
  "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --force-high-res-timeticks=disabled --always-read-main-dll --metrics-shmem-handle=5684,i,695887877366860559,4539109684713995887,524288 --field-trial-handle=2668,i,16739645566312630560,7760067770755588763,262144 --variations-seed-version --mojo-platform-channel-handle=3704 /prefetch:8
  2⤵
  PID:4624

C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"
1⤵
PID:3976

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Browser Information Discovery

T1217

Query Registry

T1012

System Information Discovery

T1082

System Time Discovery

T1124

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 11d3c4c52f9fc9cd2b10a22b48769759f994fd6364f9a0fc145f4cd2c2a22e9d
MD5 4751cf705a737c4226029624bf43b9a8
SHA1 fd8cf726ee3f8f75b97147829de5553530caa82c
SHA512 46e3fedbf7fa14bdc2b3aad129f2879a9d24252f5d7bd9b55766bc32a6b82ea77aaf193bcdbdf4423e3b67ef84955e589b6077609344091ef72204c1d50b0dab
TLSH
T17ED09B307A58A58BD14360F1A4114B4115375557205397757521508E9E98055B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

settings.dat

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Crashpad\settings.dat
Size 280B
SHA256 701082e4ac35f878dc5ff6eb27989aae9d20d9b5662643e20b3acd1720b367fc
MD5 2b3686986ce1fd99f079eb226e8b0a8b
SHA1 0d2cdee36351378b91ed7f6ecdb43457fe4d7b5d
SHA512 937da61c495fd21a02bb76a63556dec83ce132f1d1830ff8d9af6212d15f1844766dd4abadd15ea61b48f8ae03b52baca44c99117714c705da840dbff8f116dd
TLSH
T182D09B303A58A98BD54360F1A4104B41153755572053D7757521508E9E99095B3CA057
MD5 SHA1 SHA512 TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 6KB
SHA256 a3365b89684e537335e2cf58aec4e9a71eff877f241ac70cb4b8f4b6ebbc974f
MD5 8a6b2a0fd7e647441b2b8895bb883b7c
SHA1 56eddeac6df78e9dc1c05ff1d3a21b28e40b6e9a
SHA512 2bbc0fee3a471df5859d68958beb1c98ce111fc3bcf9e3f411074248a8163e1a2c6a19af7223893fb74f327b8a66e546bc2f5e00ec41222566dfcfe1ad1615ff
SSDEEP 192:gjkiXrrrrrrrrrrrrrrrrrrrrrrrrrrrrrMVLO:gjkiXrrrrrrrrrrrrrrrrrrrrrrrrrrh
TLSH
T1CFE12F4342E5C27ADF0A14CB99A4635E6070370AEBDCD54913BCCDDD314E4AAE8EBAD1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 6KB
SHA256 375d6c913c913d920f30c7f2ce80bd0805bddfc72d5dce1ff64e82e270623578
MD5 c6bb5d24e5645aac9e1b0f95f1fdbeec
SHA1 3bc1831638d3de624c8ab7c6ded6a5c484d4d4bb
SHA512 832f427e245bf0f3f9d9ebcf4a6545f967f66b1801cb9d43ce9361b648fe1f8a7c663d291ac3476b6aef464691d7b4685f9efeb14db852edbd3305f48b08eda2
SSDEEP 192:zjM1E11111111111111111111111111111MHLO:zjM1E11111111111111111111111111l
TLSH
T1DFE13F9287E4C79A9F1614CB8DA0629CA070B74AEBDCD50C13AC8DDD314F4DAE8F96D1
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

LOG.old

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old
Size 6KB
SHA256 b5713ea1cef03fbc95f46faeb3dfc69866952e3d88ec4e81fedab45aa5d54b4d
MD5 b442dd42d999274402a990ea8e7c770c
SHA1 3a2f4d6de3a77c09073fee400e98462203cb58d5
SHA512 526713596096d59584e70b829a8a83b291ebfdc7f45051c429e33fa20d438546396c70722de513d1a2b792517a7f43a953f8011870c786da06b1f597f64f0104
SSDEEP 192:NjEDse7sssssssssssssssssssssssssssMOLO:NjEDse7sssssssssssssssssssssssst
TLSH
T19CE1E78382E5C69EDF0914CF89A0624C54753B0EEBDCD50C139C8DCD328E4EAA8EE6D4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

the-real-index

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index
Size 2KB
SHA256 ac4a74a5208bdcef7093c1857c6407894d0a8bd610b49049b36c1e01c5a67411
MD5 6ea00f9865f457a39c2a7ceafa160b9c
SHA1 723660a2292105cde1ee8eee4052034ca171e13a
SHA512 57e12654233942e279e299b11d412693c08c1e916a5a306ccd8ff7e7a1d1266cb296795b49902b296548de747bbc856028626aa7960260253a74750c3042308c
TLSH
T12E51A2380D118865D760CAF1A2F0E24F7B70FAF2F873DEEA545354326A1273183D6298
MD5 SHA1 SHA512 TLSH

Submit Download

the-real-index~RFe5927c2.TMP

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Code Cache\js\index-dir\the-real-index~RFe5927c2.TMP
Size 2KB
SHA256 b1ad0c7a62a4ae97a927df265a0277f747711d99f299173b7b76636bd0ccc163
MD5 9700f42d3c2985432a435d50f2cbc8bd
SHA1 c6feea7a1ae135a4e85493469457710e94848a7d
SHA512 eafdab1a36565e2e296dd5a936c3559bb69e0e1ab67f771fdaace61f5f554f973ee46b3c324dd173f3f91dfeae11c0dbc84c3b9766d1e21f12037ee3629438fc
TLSH
T1BA51A3380D018865E760CAF1A6F0E64F7B70FAF6F873DEEA545354366A1273183D6298
MD5 SHA1 SHA512 TLSH

Submit Download

SiteList-Enterprise.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\DualEngine\SiteList-Enterprise.json
Size 2B
SHA256 44136fa355b3678a1146ad16f7e8649e94fb4fc21fe77e8310c060f61caaff8a
MD5 99914b932bd37a50b983c5e7c90ae93b
SHA1 bf21a9e8fbc5a3846fb05b4fa0859e0917b2202f
SHA512 27c74670adb75075fad058d5ceaf7b20c4e7786c83bae8a32f626f9782af34c9a33c2046ef60fd2a7878d378e29fec851806bbd9a67878f3a9f1cda4830763fd
MD5 SHA1 SHA512

Submit Download

Edge Profile.ico

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Edge Profile.ico
Size 70KB
SHA256 31a226211c491e1b0832d4cd3cf34d97165e24a7ce4ec655259cd188f3a2bd88
MD5 efe54a870e0f5ff28d7e00036b861065
SHA1 10663a71c9815382ca5a1689dfcebe737c557b1d
SHA512 4d7ed9d3e22a58f0e169c9200e351d3a938c82ab7920567f67bf29d33b28192329ea05657d1077aebaf2c2b5151eb50c84e5ab590733ff824389566d93381c01
SSDEEP 1536:fAlMWz7vLDtDSVlXXwpFlorgLUxF+nubjUDSlBczkF1D/u1:fvuWAUxFDbY+0zkjDG1
TLSH
T1DA639F406A6479E8E814CBF59C69B7D30B95CFDC51A252E831F4FE7AB681494C90CFC4
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 111B
SHA256 5dfc321417fc31359f23320ea68014ebfd793c5bbed55f77dab4180bbd4a2026
MD5 285252a2f6327d41eab203dc2f402c67
SHA1 acedb7ba5fbc3ce914a8bf386a6f72ca7baa33c6
SHA512 11ce7cb484fee66894e63c31db0d6b7ef66ad0327d4e7e2eb85f3bcc2e836a3a522c68d681e84542e471e54f765e091efe1ee4065641b0299b15613eb32dcc0d
TLSH
T136B01269E4517CFF074A83A41928F453C3FF0047421C8ABEEA3873AD42A21BD0C28C47
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 36024b20e6ee17b96b5e6ab36bbe059c884f85f6bc3a8b246d316a8193c47a5e
MD5 983da4d021576408b980fe044b8b91dc
SHA1 459a44c3a5bdb8fc03b8443f8d3db21295719fe4
SHA512 c1e60b511dd599f6dc4587f96cb483908261e2a33722f11578b23b1d79e78bf7fb559487c55343a68253aedfe55b1c79be3722bc71c61a4fc9c191ac027481eb
TLSH
T16D318BB3C2E5876D892117F0DA146E2BCE1D0A5843183D1AC5E9EF5BE3E3071E10254E
MD5 SHA1 SHA512 TLSH

Submit Download

Network Persistent State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\Network Persistent State
Size 1KB
SHA256 d05dac3b6333bd8fc550fd08486f7b285cc817bd247aadf3dc2261368f675478
MD5 b891d9c7ee09052ed14612f3ab37efe4
SHA1 14e496cd2ee646973a7c62a9da91c56ec6c52d48
SHA512 69f384ff4e07fffff1c4925417c50e437196f46ac45d45c2304580e2938f6feca19bf9ce439186fdc43fc06adebdc7be06ea62c6f59ae5aea189400246358fa4
TLSH
T1A031ACF2C3A1835D991067F0DA18AE2BCE1D0645431C3D6AC5E9EF6BD3E3072E14265A
MD5 SHA1 SHA512 TLSH

Submit Download

SCT Auditing Pending Reports

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Network\SCT Auditing Pending Reports
Size 2B
SHA256 4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945
MD5 d751713988987e9331980363e24189ce
SHA1 97d170e1550eee4afc0af065b78cda302a97674c
SHA512 b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af
MD5 SHA1 SHA512

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 12KB
SHA256 7187a5cd5e7c2e6d8f3429691d0d5da959b34d8d6c8b9dac5f18f7a366b9c60b
MD5 d1170bb0f326800e9087233c55a78457
SHA1 cae7dc9664f340f4aff2bcfbe58f16ccea514450
SHA512 003a33f44e6ca87505e7945894cd73820ee2452c57e56f48922b7ee3fcd618893b5950263aefefd002547447f377b3176a46170d7c58ec00b6a1f7c33d6fc5b9
SSDEEP 192:sxZeRsyM/jK1Ml8Mk7/frsk8Sp+JIdpNglzHW6+WNGY9IK8CxIgrJ:sxZeiM7/frsXSp1wHbG29
TLSH
T19542E901AA34A977CCDBD20DFA557F53D6F8547392900E44AAFCDA1C04E6AED221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Preferences
Size 13KB
SHA256 5c2812ca70ae77a5be109b7c7995076cbbe318474c43d41ef4bfa4155c4a671c
MD5 8c67f0de103de0e37986a853ce6d6577
SHA1 75bf0bfc661437d6376087fef8e4e9fe410d27ff
SHA512 20f3fccdda9b4021627802a0693f52060eedefb3cfe4096923d262dbd708a6a88ff80bf6bd3d04bc5970c10b3e217e56687bd033fe390ec2e1228bff0d46824b
SSDEEP 192:sxZeRsyM/jK1Ml8UQvk7/frsc8SC+JIdpjglzHW6+WN7Wi/Y9IZnCxIg5nGJ:sxZeiqc7/frsfSC1mHb//EJS
TLSH
T1B652F912AA349977CCDBD21DFA457F53D6F4587292900E44AAFCDA1C00E6BEE221781F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Secure Preferences

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Secure Preferences
Size 30KB
SHA256 11c1c0308c71274e1f51f44ecbe6a217ae5594e24e3835fd639538e655c4b0b5
MD5 4eebd719c57d224d62af968a6fb94c67
SHA1 f0b8ffa3db0ecc4519005ec38160f446962e5372
SHA512 ff1edef99fb7cc4a2e1b638c08d8e70fa6a206a579e5198ca77637ece6147b5fffd44617ff1f6948d5e3de7c2e9feb22cf8f6c0b79a6b4826a5fe279bb62371b
SSDEEP 768:/ocv21wWvu+Z+8F1+UoAYDCx9Tuqh0VfUC9xbog/OVjFLlwmWNwropg61:/ocv21wWvu+Z+u1jaeFLeRNbpF
TLSH
T1E0D20B2B280CCB7E4F845E5CED2AAF866DD801CB57988D5447FA884C03C77EB511B59B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

sync_diagnostic.log

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\Logs\sync_diagnostic.log
Size 5KB
SHA256 7d9ecb67d2795f4bf5311c19ebc1bbdcc0b59e673b3e1ab5649cb2f5e24da5c3
MD5 8ada71edbc200864ce57b5fe6d58e605
SHA1 37c81f95ecee882b265049873dd25a52448c9319
SHA512 884c9a54903c0d016507da454f4b3010e3478aedff10d4342c6923610aa0b64c0478ef6e711d53cf64a9d6487e44d2d07b98066b82a68e78572c763f57baf89f
SSDEEP 96:KaRklRnHnqlPKZThqKLfTzqHxJSrBDygha+IOKb5azq/WbKni/kbTgYbyqomJCKT:mTdBJVnY
TLSH
T18AB1233673371252397D6848A2958B374E8132633814A5AF7BFD00A24EB7E216DFC8CD
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 64b48e03c63c94ed52b13e03efee6f94b10f6e1abcb879be31b1043e917d2536
MD5 d1c42f52b37912f2ed4251dde7ab6b6f
SHA1 de22b7e4aa386c7c131afecc14c47f8b064d04b5
SHA512 fa6cd790072f1f207b884a2d132478960fee193db9d5ec4a92341cc164454bb59256e33216816aea806eb46101cc7713a97129bbe684041dd945fbf87de7faec
SSDEEP 384:JZcIhsNSCR3wziNGpe+CLOzta6R0X1puLKQoo9:Bhb9wTOzta6RsyLKQom
TLSH
T10B827C72AE789C7B65F2E544F54B36078EB88033D7C86F80D1CDBB1D02DA699130B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 085f4f262afaffcf66b027e1070b45a391ad7309c2f6ca8b28db0a530e62a1c2
MD5 e17a70841aa958d293d19466c48d44a8
SHA1 89df38555b05ae2017e17edcea8334a62aaa120c
SHA512 64627cb9fc6a17007f2621bf89032f147238bcace4c2234f29bfda760c200ecfbc43a496ee34eb49623fc89c26610ee06e1273b15619f10551e369bba6b029a8
SSDEEP 384:DZcIssNShR3wziNGpe+CLOztP6R0X1puLKQoo9:bsq9wTOztP6RsyLKQom
TLSH
T1B3927C72AE789C7B55F2E544F64B36078EBC8033D6C86F80D1DDBB1D01DA699230B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 84ebdfa0c5199def1a58caf30fa038f764ae3135ec34806546dbb07ad2247ca3
MD5 6859f165e0462bcaa22bf738f24c860f
SHA1 ff7e2f613ad19810b9f37366a06c566141e5bd1f
SHA512 19be774f637eeef1caed552812faad2e2858dd5fed4c99958ded32be6af9d94e239d7db3a34c97011f535dbe865e2ee9b1c81a58f475efbcda2e31478b07de0f
SSDEEP 192:JONl6v+YLNQmiUy+XZh+CGWOFmRMus6/rU6:JONl6vz//Zh+CLOR6jU6
TLSH
T1F1020935AC682C6B9EF2AE44F84737175FA8217BE6912F80D9D82B1C01D765C2306826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 18KB
SHA256 d23866acfde8f4a4018f48cec07b5fcdf5b522fd324837f34f2ce84327bfc340
MD5 f08b34b5dd1fbf7cb1c524f7dfd157ec
SHA1 2d6c19e7092c3a0d18033301446f5ad064f1bac9
SHA512 f49527c3761c96af268f9bf1a66ccceb1910e52d721937d33684338b7fa466e9e1b42d0ee00b6f8fb31eaaba8eca136b731eb9a8a8ce8dd8f64467f7d60c6b7b
SSDEEP 384:5ZcIhsNShR3wziNGpe+CLOzta6R0X1puLKQoo9:Rhq9wTOzta6RsyLKQom
TLSH
T12A827C72AE789C7B65F2E544F54B36078EB88033D7C86F80D1DDBB1D01DA699130B926
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Local State

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Local State
Size 8KB
SHA256 6d36d9569850b2e4eb8e4c188d07f25afea5cbde0f91c44348a219afb55c93f2
MD5 8162bd4d00f0655af71e00da45e69456
SHA1 7975b2e07fd89036626bbcef9b998046dc192c3d
SHA512 8e875310eb8a7fb5188003995c84e68891328490941d6f39f929b22cf7d5de8f974e54c28ff4314ee6af249d99f3c9acd01c1aa9e88f78dc7e4a6e15d27b6345
SSDEEP 192:FONj6v+YLYQmiUyCXLh+CGWOFmRetMCH6tqIU6:FONj6vz0ZLh+CLOztF6RU6
TLSH
T1BD122B36BD785C6B1EE2A944F48736179EA84177EB857F80C5CC3E1C02DF69C230A826
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

metadata.json

Path C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\extensions_crx_cache\metadata.json
Size 13B
SHA256 2771d13c637c267132afff9db67537bef95708534b79ae8d954254c4e64e4e0f
MD5 2aa9e263ee3796d9ce358460a2451b4c
SHA1 7a55d937c0cd1f7543a12be730e4a78d0a14a545
SHA512 4909e73ffd1a777a9f102a8831f6ae5a9091084a2755707363251f39164bb65e22c318972ea59e7155976c6a626691dfa94539ee752f58e31aa16f4de5cdbccf
MD5 SHA1 SHA512

Submit Download

5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Path C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres
Size 2KB
SHA256 0041d9931560e0e2f5065cb2674d5e3484225a95826fcc617346abc963f3e62d
MD5 8bfbd54932bfa9bf88bec8428f1e6dbd
SHA1 7d26bcfffb938feb9e3fc29660e0846f6b45ae61
SHA512 51816ba992a9b9b4ca28d24e2944921a14f9bde67541d8a19321413331373101edf42c9d643c6772acd8009e356685a9567c1ea6df06aab4e1a6d0a13c6d3bd7
TLSH
T165412858B7E91118B3B76F0AAFF7ACAD483BBC772E06D45D10110E4E0A63A40C8A1737
MD5 SHA1 SHA512 TLSH

Submit Download